f7620368a80437963a5b63a54fe90cd80696b00182067c046cc8874ae6158ff6

Analysis

max time kernel
120s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240910-en
resource tags

arch:x64arch:x86image:win10v2004-20240910-enlocale:en-usos:windows10-2004-x64system
submitted
13-09-2024 11:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b49817dc59940bea9e99c5c064130b50N.exe
Size

468KB
MD5

b49817dc59940bea9e99c5c064130b50
SHA1

a371d2797af426bdf5dd4ae74d317ac0dc1fb8e6
SHA256

f7620368a80437963a5b63a54fe90cd80696b00182067c046cc8874ae6158ff6
SHA512

294066e205e3465b7a7bc81e80e7cb1c0441a5e4bcb8a6824d0449ba8e23eb9fff52b0d7c6c0baec49ebfdb23aee9143455beadabf4e1ccd19198377e05a7d8c
SSDEEP

3072:bb12ZX1V08U1bYTPzEl8f8FECDv+SO3udH0ZVpRCs8BghnNG3ln:bboV5U1EPgl8fnVbTCsgAnNG

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
4388	Unicorn-21614.exe
2840	Unicorn-41000.exe
4596	Unicorn-60866.exe
2008	Unicorn-50690.exe
1776	Unicorn-2833.exe
4936	Unicorn-48505.exe
5024	Unicorn-4871.exe
1508	Unicorn-46170.exe
3684	Unicorn-58785.exe
3188	Unicorn-12921.exe
2940	Unicorn-5500.exe
1176	Unicorn-25366.exe
5008	Unicorn-37353.exe
3744	Unicorn-37618.exe
5096	Unicorn-35572.exe
364	Unicorn-35021.exe
4316	Unicorn-31491.exe
452	Unicorn-4002.exe
5072	Unicorn-14216.exe
376	Unicorn-63225.exe
1368	Unicorn-39275.exe
4064	Unicorn-15176.exe
4692	Unicorn-7563.exe
4648	Unicorn-24222.exe
3120	Unicorn-24222.exe
3140	Unicorn-14719.exe
2492	Unicorn-17022.exe
2148	Unicorn-22582.exe
3216	Unicorn-14984.exe
4200	Unicorn-3287.exe
2152	Unicorn-24222.exe
2584	Unicorn-5420.exe
3896	Unicorn-26587.exe
716	Unicorn-34009.exe
3196	Unicorn-59390.exe
5100	Unicorn-59390.exe
4352	Unicorn-53260.exe
4992	Unicorn-59390.exe
1248	Unicorn-50153.exe
4948	Unicorn-21181.exe
2072	Unicorn-27355.exe
1180	Unicorn-17983.exe
2172	Unicorn-63920.exe
228	Unicorn-12118.exe
4268	Unicorn-27163.exe
2204	Unicorn-21949.exe
2076	Unicorn-26033.exe
1844	Unicorn-59966.exe
1064	Unicorn-34947.exe
2936	Unicorn-28446.exe
4376	Unicorn-56851.exe
1584	Unicorn-2872.exe
2456	Unicorn-7511.exe
1796	Unicorn-27377.exe
2240	Unicorn-31461.exe
4784	Unicorn-33690.exe
1120	Unicorn-19955.exe
2440	Unicorn-55395.exe
4616	Unicorn-2680.exe
4512	Unicorn-6764.exe
1140	Unicorn-59088.exe
2012	Unicorn-7319.exe
460	Unicorn-26920.exe
5012	Unicorn-32939.exe

Program crash 16 IoCs

pid	pid_target	Process	procid_target
5584	5096	WerFault.exe	100
5348	3120	WerFault.exe	110
4448	2152	WerFault.exe	115
6656	1584	WerFault.exe	136
8352	2284	WerFault.exe	169
7396	2012	WerFault.exe	147
7384	4616	WerFault.exe	144
7540	2808	WerFault.exe	174
9344	4884	WerFault.exe	182
9336	3668	WerFault.exe	167
9732	5232	WerFault.exe	191
12024	5548	WerFault.exe	237
12484	6152	WerFault.exe	277
12512	7156	WerFault.exe	288
12760	748	WerFault.exe	283
15136	6432	WerFault.exe	307

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54149.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13412.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51461.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50059.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53464.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30883.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21721.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28208.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1264.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11294.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7563.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29661.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23916.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3287.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17585.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15924.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35021.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24222.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47739.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6531.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40372.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2680.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53500.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3684.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13392.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5032.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18789.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38016.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46016.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61591.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21703.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27217.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32778.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25611.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18997.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28446.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50942.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32525.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13796.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2068.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10236.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36241.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39308.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2219.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63920.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38965.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53567.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58785.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57097.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57739.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51108.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50484.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37746.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37734.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56851.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18643.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18920.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40372.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40937.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42686.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16619.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34839.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16714.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12011.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	14344	dwm.exe
Token: SeChangeNotifyPrivilege	14344	dwm.exe
Token: 33	14344	dwm.exe
Token: SeIncBasePriorityPrivilege	14344	dwm.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
4016	b49817dc59940bea9e99c5c064130b50N.exe
4388	Unicorn-21614.exe
4596	Unicorn-60866.exe
2840	Unicorn-41000.exe
2008	Unicorn-50690.exe
4936	Unicorn-48505.exe
1776	Unicorn-2833.exe
5024	Unicorn-4871.exe
1508	Unicorn-46170.exe
3684	Unicorn-58785.exe
3188	Unicorn-12921.exe
5096	Unicorn-35572.exe
1176	Unicorn-25366.exe
5008	Unicorn-37353.exe
3744	Unicorn-37618.exe
2940	Unicorn-5500.exe
364	Unicorn-35021.exe
4316	Unicorn-31491.exe
452	Unicorn-4002.exe
5072	Unicorn-14216.exe
376	Unicorn-63225.exe
1368	Unicorn-39275.exe
4064	Unicorn-15176.exe
4692	Unicorn-7563.exe
2152	Unicorn-24222.exe
3120	Unicorn-24222.exe
4648	Unicorn-24222.exe
3140	Unicorn-14719.exe
4200	Unicorn-3287.exe
3216	Unicorn-14984.exe
2148	Unicorn-22582.exe
2492	Unicorn-17022.exe
2584	Unicorn-5420.exe
3896	Unicorn-26587.exe
716	Unicorn-34009.exe
3196	Unicorn-59390.exe
5100	Unicorn-59390.exe
4352	Unicorn-53260.exe
1248	Unicorn-50153.exe
4992	Unicorn-59390.exe
4948	Unicorn-21181.exe
2072	Unicorn-27355.exe
2172	Unicorn-63920.exe
4268	Unicorn-27163.exe
228	Unicorn-12118.exe
1180	Unicorn-17983.exe
2204	Unicorn-21949.exe
1064	Unicorn-34947.exe
1844	Unicorn-59966.exe
2076	Unicorn-26033.exe
2936	Unicorn-28446.exe
4376	Unicorn-56851.exe
1584	Unicorn-2872.exe
4784	Unicorn-33690.exe
2440	Unicorn-55395.exe
1796	Unicorn-27377.exe
2240	Unicorn-31461.exe
2012	Unicorn-7319.exe
4616	Unicorn-2680.exe
2456	Unicorn-7511.exe
460	Unicorn-26920.exe
1140	Unicorn-59088.exe
4512	Unicorn-6764.exe
1120	Unicorn-19955.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4016 wrote to memory of 4388	4016	b49817dc59940bea9e99c5c064130b50N.exe	86
PID 4016 wrote to memory of 4388	4016	b49817dc59940bea9e99c5c064130b50N.exe	86
PID 4016 wrote to memory of 4388	4016	b49817dc59940bea9e99c5c064130b50N.exe	86
PID 4016 wrote to memory of 2840	4016	b49817dc59940bea9e99c5c064130b50N.exe	87
PID 4016 wrote to memory of 2840	4016	b49817dc59940bea9e99c5c064130b50N.exe	87
PID 4016 wrote to memory of 2840	4016	b49817dc59940bea9e99c5c064130b50N.exe	87
PID 4388 wrote to memory of 4596	4388	Unicorn-21614.exe	88
PID 4388 wrote to memory of 4596	4388	Unicorn-21614.exe	88
PID 4388 wrote to memory of 4596	4388	Unicorn-21614.exe	88
PID 4596 wrote to memory of 2008	4596	Unicorn-60866.exe	89
PID 4596 wrote to memory of 2008	4596	Unicorn-60866.exe	89
PID 4596 wrote to memory of 2008	4596	Unicorn-60866.exe	89
PID 2840 wrote to memory of 1776	2840	Unicorn-41000.exe	90
PID 2840 wrote to memory of 1776	2840	Unicorn-41000.exe	90
PID 2840 wrote to memory of 1776	2840	Unicorn-41000.exe	90
PID 4388 wrote to memory of 4936	4388	Unicorn-21614.exe	91
PID 4388 wrote to memory of 4936	4388	Unicorn-21614.exe	91
PID 4388 wrote to memory of 4936	4388	Unicorn-21614.exe	91
PID 4016 wrote to memory of 5024	4016	b49817dc59940bea9e99c5c064130b50N.exe	92
PID 4016 wrote to memory of 5024	4016	b49817dc59940bea9e99c5c064130b50N.exe	92
PID 4016 wrote to memory of 5024	4016	b49817dc59940bea9e99c5c064130b50N.exe	92
PID 2008 wrote to memory of 1508	2008	Unicorn-50690.exe	93
PID 2008 wrote to memory of 1508	2008	Unicorn-50690.exe	93
PID 2008 wrote to memory of 1508	2008	Unicorn-50690.exe	93
PID 4596 wrote to memory of 3684	4596	Unicorn-60866.exe	94
PID 4596 wrote to memory of 3684	4596	Unicorn-60866.exe	94
PID 4596 wrote to memory of 3684	4596	Unicorn-60866.exe	94
PID 1776 wrote to memory of 3188	1776	Unicorn-2833.exe	95
PID 1776 wrote to memory of 3188	1776	Unicorn-2833.exe	95
PID 1776 wrote to memory of 3188	1776	Unicorn-2833.exe	95
PID 2840 wrote to memory of 2940	2840	Unicorn-41000.exe	96
PID 2840 wrote to memory of 2940	2840	Unicorn-41000.exe	96
PID 2840 wrote to memory of 2940	2840	Unicorn-41000.exe	96
PID 4936 wrote to memory of 1176	4936	Unicorn-48505.exe	97
PID 4936 wrote to memory of 1176	4936	Unicorn-48505.exe	97
PID 4936 wrote to memory of 1176	4936	Unicorn-48505.exe	97
PID 4016 wrote to memory of 5008	4016	b49817dc59940bea9e99c5c064130b50N.exe	98
PID 4016 wrote to memory of 5008	4016	b49817dc59940bea9e99c5c064130b50N.exe	98
PID 4016 wrote to memory of 5008	4016	b49817dc59940bea9e99c5c064130b50N.exe	98
PID 5024 wrote to memory of 3744	5024	Unicorn-4871.exe	99
PID 5024 wrote to memory of 3744	5024	Unicorn-4871.exe	99
PID 5024 wrote to memory of 3744	5024	Unicorn-4871.exe	99
PID 4388 wrote to memory of 5096	4388	Unicorn-21614.exe	100
PID 4388 wrote to memory of 5096	4388	Unicorn-21614.exe	100
PID 4388 wrote to memory of 5096	4388	Unicorn-21614.exe	100
PID 1508 wrote to memory of 364	1508	Unicorn-46170.exe	101
PID 1508 wrote to memory of 364	1508	Unicorn-46170.exe	101
PID 1508 wrote to memory of 364	1508	Unicorn-46170.exe	101
PID 2008 wrote to memory of 4316	2008	Unicorn-50690.exe	102
PID 2008 wrote to memory of 4316	2008	Unicorn-50690.exe	102
PID 2008 wrote to memory of 4316	2008	Unicorn-50690.exe	102
PID 4596 wrote to memory of 452	4596	Unicorn-60866.exe	103
PID 4596 wrote to memory of 452	4596	Unicorn-60866.exe	103
PID 4596 wrote to memory of 452	4596	Unicorn-60866.exe	103
PID 3684 wrote to memory of 5072	3684	Unicorn-58785.exe	104
PID 3684 wrote to memory of 5072	3684	Unicorn-58785.exe	104
PID 3684 wrote to memory of 5072	3684	Unicorn-58785.exe	104
PID 3188 wrote to memory of 376	3188	Unicorn-12921.exe	105
PID 3188 wrote to memory of 376	3188	Unicorn-12921.exe	105
PID 3188 wrote to memory of 376	3188	Unicorn-12921.exe	105
PID 1776 wrote to memory of 1368	1776	Unicorn-2833.exe	106
PID 1776 wrote to memory of 1368	1776	Unicorn-2833.exe	106
PID 1776 wrote to memory of 1368	1776	Unicorn-2833.exe	106
PID 1176 wrote to memory of 4064	1176	Unicorn-25366.exe	107

C:\Users\Admin\AppData\Local\Temp\b49817dc59940bea9e99c5c064130b50N.exe
"C:\Users\Admin\AppData\Local\Temp\b49817dc59940bea9e99c5c064130b50N.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4016
- C:\Users\Admin\AppData\Local\Temp\Unicorn-21614.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-21614.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4388
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60866.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60866.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50690.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50690.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46170.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35021.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5420.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52805.exe
        8⤵
        
        PID:2420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11144.exe
        9⤵
        
        PID:5588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5000.exe
        10⤵
        
        PID:5992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4196.exe
        11⤵
        
        PID:3488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3807.exe
        11⤵
        
        PID:13160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47408.exe
        11⤵
        
        PID:11260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5327.exe
        10⤵
        
        PID:10080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42763.exe
        10⤵
        
        PID:3412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48809.exe
        10⤵
        
        PID:2096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44772.exe
        9⤵
        
        PID:7836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16707.exe
        10⤵
        
        PID:9004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8154.exe
        9⤵
        
        PID:10424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8555.exe
        9⤵
        
        PID:14056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37734.exe
        9⤵
        
        PID:1604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53500.exe
        8⤵
        
        PID:6088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51653.exe
        9⤵
        
        PID:7408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20414.exe
        10⤵
        
        PID:12928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50208.exe
        10⤵
        
        PID:11048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54720.exe
        9⤵
        
        PID:10256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50547.exe
        9⤵
        
        PID:14128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44533.exe
        9⤵
        
        PID:10336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31454.exe
        8⤵
        
        PID:7288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10463.exe
        9⤵
        
        PID:1324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33584.exe
        8⤵
        
        PID:6656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16714.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:14980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32939.exe
        7⤵
        Executes dropped EXE
        
        PID:5012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45737.exe
        8⤵
        
        PID:796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60553.exe
        9⤵
        
        PID:7880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58125.exe
        10⤵
        
        PID:15552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18792.exe
        10⤵
        
        PID:10268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15908.exe
        9⤵
        
        PID:10484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2690.exe
        9⤵
        
        PID:14064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46400.exe
        9⤵
        
        PID:4488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26463.exe
        8⤵
        
        PID:8420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40547.exe
        8⤵
        
        PID:11644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13127.exe
        8⤵
        
        PID:12220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46151.exe
        7⤵
        
        PID:6644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33449.exe
        8⤵
        
        PID:8764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61404.exe
        8⤵
        
        PID:12236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32150.exe
        8⤵
        
        PID:15940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38393.exe
        8⤵
        
        PID:10116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42660.exe
        7⤵
        
        PID:8988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26221.exe
        8⤵
        
        PID:15860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14498.exe
        7⤵
        
        PID:13120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26587.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11580.exe
        7⤵
        
        PID:2192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7444.exe
        8⤵
        
        PID:5460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5000.exe
        9⤵
        
        PID:6996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-356.exe
        10⤵
        
        PID:12088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48732.exe
        10⤵
        
        PID:16312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50252.exe
        9⤵
        
        PID:10024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34594.exe
        9⤵
        
        PID:12396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50484.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:3732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64895.exe
        8⤵
        
        PID:8252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15260.exe
        9⤵
        
        PID:12804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30883.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:4112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46412.exe
        8⤵
        
        PID:11868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4462.exe
        8⤵
        
        PID:15432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53500.exe
        7⤵
        
        PID:6100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30865.exe
        8⤵
        
        PID:9044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60932.exe
        8⤵
        
        PID:12216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11354.exe
        8⤵
        
        PID:8348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5362.exe
        7⤵
        
        PID:8904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26677.exe
        7⤵
        
        PID:12012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5400.exe
        7⤵
        
        PID:6812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21978.exe
        6⤵
        
        PID:3148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27865.exe
        7⤵
        
        PID:5560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44689.exe
        8⤵
        
        PID:7064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29365.exe
        9⤵
        
        PID:1844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34773.exe
        10⤵
        
        PID:15856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26912.exe
        10⤵
        
        PID:11152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60828.exe
        9⤵
        
        PID:11376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44211.exe
        9⤵
        
        PID:16028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6531.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:9152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34581.exe
        9⤵
        
        PID:15572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49780.exe
        8⤵
        
        PID:13196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14683.exe
        7⤵
        
        PID:6576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-948.exe
        8⤵
        
        PID:15320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63604.exe
        7⤵
        
        PID:11028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4934.exe
        7⤵
        
        PID:14952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57507.exe
        7⤵
        
        PID:6844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7563.exe
        6⤵
        
        PID:6056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27881.exe
        7⤵
        
        PID:8060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49469.exe
        8⤵
        
        PID:4248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2395.exe
        7⤵
        
        PID:10988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48575.exe
        7⤵
        
        PID:14624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62095.exe
        6⤵
        
        PID:8260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43133.exe
        7⤵
        
        PID:12712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21211.exe
        6⤵
        
        PID:11568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4992.exe
        6⤵
        
        PID:15228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31491.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34009.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60589.exe
        7⤵
        
        PID:5116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7252.exe
        8⤵
        
        PID:5536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32821.exe
        9⤵
        
        PID:6528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54357.exe
        10⤵
        
        PID:10040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-439.exe
        10⤵
        
        PID:13392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20306.exe
        10⤵
        
        PID:6132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12535.exe
        9⤵
        
        PID:9804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21190.exe
        9⤵
        
        PID:13232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19343.exe
        8⤵
        
        PID:7448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37113.exe
        9⤵
        
        PID:12404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9619.exe
        9⤵
        
        PID:16036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60095.exe
        8⤵
        
        PID:9280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56412.exe
        8⤵
        
        PID:13612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51891.exe
        8⤵
        
        PID:15956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53500.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60553.exe
        8⤵
        
        PID:7900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27321.exe
        9⤵
        
        PID:12784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60955.exe
        9⤵
        
        PID:5828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10755.exe
        8⤵
        
        PID:10564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19026.exe
        8⤵
        
        PID:14116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65145.exe
        8⤵
        
        PID:8016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60811.exe
        7⤵
        
        PID:6916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47412.exe
        8⤵
        
        PID:12576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54580.exe
        7⤵
        
        PID:11616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53231.exe
        7⤵
        
        PID:10228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52976.exe
        6⤵
        
        PID:4336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11528.exe
        7⤵
        
        PID:5476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43537.exe
        8⤵
        
        PID:6956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1264.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:5312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8607.exe
        9⤵
        
        PID:12356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57282.exe
        9⤵
        
        PID:10892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43287.exe
        8⤵
        
        PID:8824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54933.exe
        8⤵
        
        PID:13516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40833.exe
        8⤵
        
        PID:7936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30059.exe
        7⤵
        
        PID:6256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33081.exe
        8⤵
        
        PID:10780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24855.exe
        8⤵
        
        PID:14684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51351.exe
        7⤵
        
        PID:5528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48628.exe
        7⤵
        
        PID:3876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27162.exe
        6⤵
        
        PID:5456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54357.exe
        7⤵
        
        PID:10676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10527.exe
        7⤵
        
        PID:14516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10576.exe
        7⤵
        
        PID:15212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48752.exe
        6⤵
        
        PID:9124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37873.exe
        7⤵
        
        PID:10672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18011.exe
        6⤵
        
        PID:12004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18972.exe
        6⤵
        
        PID:16368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23916.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53260.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16241.exe
        6⤵
        
        PID:1216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20081.exe
        7⤵
        
        PID:6120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60553.exe
        8⤵
        
        PID:7868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15613.exe
        9⤵
        
        PID:15372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59956.exe
        8⤵
        
        PID:10432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43340.exe
        8⤵
        
        PID:14944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2814.exe
        7⤵
        
        PID:8208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16619.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:12348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63559.exe
        7⤵
        
        PID:15500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13192.exe
        7⤵
        
        PID:10704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55768.exe
        6⤵
        
        PID:6504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57097.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:9644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43915.exe
        7⤵
        
        PID:13220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26172.exe
        7⤵
        
        PID:5780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24542.exe
        6⤵
        
        PID:6128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27056.exe
        6⤵
        
        PID:13036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25482.exe
        6⤵
        
        PID:5772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53692.exe
        5⤵
        
        PID:2696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5000.exe
        6⤵
        
        PID:6756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5156.exe
        7⤵
        
        PID:10324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33604.exe
        7⤵
        
        PID:13696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54691.exe
        7⤵
        
        PID:15848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57739.exe
        6⤵
        
        PID:11240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2691.exe
        6⤵
        
        PID:14868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25482.exe
        6⤵
        
        PID:720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59599.exe
        5⤵
        
        PID:8000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13392.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:15188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5155.exe
        5⤵
        
        PID:10572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16756.exe
        5⤵
        
        PID:14104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58785.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58785.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14216.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50153.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40937.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60921.exe
        8⤵
        
        PID:5196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18789.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:7332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5608.exe
        10⤵
        
        PID:16016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19851.exe
        9⤵
        
        PID:3480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3807.exe
        9⤵
        
        PID:13116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54476.exe
        8⤵
        
        PID:7228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5954.exe
        8⤵
        
        PID:10452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3807.exe
        8⤵
        
        PID:5088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2675.exe
        7⤵
        
        PID:6552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42686.exe
        8⤵
        
        PID:8452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11294.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:12676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12691.exe
        8⤵
        
        PID:16236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-724.exe
        7⤵
        
        PID:2012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39963.exe
        7⤵
        
        PID:12684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8947.exe
        7⤵
        
        PID:12656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10547.exe
        6⤵
        
        PID:864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21721.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27653.exe
        8⤵
        
        PID:9292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20771.exe
        8⤵
        
        PID:14800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21663.exe
        7⤵
        
        PID:9992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33043.exe
        8⤵
        
        PID:5440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37527.exe
        7⤵
        
        PID:13136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13727.exe
        7⤵
        
        PID:5128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18050.exe
        6⤵
        
        PID:7564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11176.exe
        7⤵
        
        PID:13308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2408.exe
        7⤵
        
        PID:8360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55052.exe
        6⤵
        
        PID:10308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44540.exe
        6⤵
        
        PID:13708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60862.exe
        6⤵
        
        PID:8868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27355.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13308.exe
        6⤵
        
        PID:3164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25125.exe
        7⤵
        
        PID:5400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46521.exe
        8⤵
        
        PID:8308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19013.exe
        9⤵
        
        PID:16292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26811.exe
        8⤵
        
        PID:11636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15924.exe
        8⤵
        
        PID:7036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12482.exe
        7⤵
        
        PID:9016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23429.exe
        8⤵
        
        PID:13440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6571.exe
        8⤵
        
        PID:11024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23164.exe
        7⤵
        
        PID:12948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58148.exe
        7⤵
        
        PID:5364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3443.exe
        6⤵
        
        PID:6732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18997.exe
        7⤵
        
        PID:9516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7455.exe
        7⤵
        
        PID:13060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13727.exe
        7⤵
        
        PID:5208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24542.exe
        6⤵
        
        PID:9172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27056.exe
        6⤵
        
        PID:13756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7577.exe
        6⤵
        
        PID:10684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15730.exe
        5⤵
        
        PID:4600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31285.exe
        6⤵
        
        PID:6920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58332.exe
        7⤵
        
        PID:10528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63479.exe
        7⤵
        
        PID:13112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60396.exe
        6⤵
        
        PID:9236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7595.exe
        6⤵
        
        PID:13564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37734.exe
        6⤵
        
        PID:2016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49660.exe
        5⤵
        
        PID:1536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49417.exe
        6⤵
        
        PID:10516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49744.exe
        6⤵
        
        PID:12380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48551.exe
        5⤵
        
        PID:8520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23427.exe
        5⤵
        
        PID:11624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12390.exe
        5⤵
        
        PID:16128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4002.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4002.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59390.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8072.exe
        6⤵
        
        PID:1900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20273.exe
        7⤵
        
        PID:5908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2068.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47076.exe
        8⤵
        
        PID:8200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40547.exe
        8⤵
        
        PID:11692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13127.exe
        8⤵
        
        PID:12740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15991.exe
        7⤵
        
        PID:8076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16130.exe
        7⤵
        
        PID:10956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54440.exe
        7⤵
        
        PID:14652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56453.exe
        6⤵
        
        PID:5788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57429.exe
        7⤵
        
        PID:7088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48472.exe
        7⤵
        
        PID:11008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3650.exe
        7⤵
        
        PID:14960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57495.exe
        6⤵
        
        PID:8748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46412.exe
        6⤵
        
        PID:11684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51108.exe
        6⤵
        
        PID:14344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21736.exe
        6⤵
        
        PID:6684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63640.exe
        5⤵
        
        PID:2808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53713.exe
        6⤵
        
        PID:5548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29365.exe
        7⤵
        
        PID:8504
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5548 -s 624
        7⤵
        Program crash
        
        PID:12024
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2808 -s 624
        6⤵
        Program crash
        
        PID:7540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65419.exe
        5⤵
        
        PID:6484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-797.exe
        6⤵
        
        PID:9576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3563.exe
        6⤵
        
        PID:13188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31477.exe
        5⤵
        
        PID:9176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18390.exe
        5⤵
        
        PID:13224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-138.exe
        5⤵
        
        PID:9476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17983.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17983.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38005.exe
        5⤵
        
        PID:4308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20273.exe
        6⤵
        
        PID:5920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58773.exe
        7⤵
        
        PID:8388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26811.exe
        7⤵
        
        PID:11876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37734.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43759.exe
        6⤵
        
        PID:8732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40547.exe
        6⤵
        
        PID:11700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13127.exe
        6⤵
        
        PID:676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46484.exe
        5⤵
        
        PID:1940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29365.exe
        6⤵
        
        PID:8792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61404.exe
        6⤵
        
        PID:12244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49831.exe
        6⤵
        
        PID:16112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38393.exe
        6⤵
        
        PID:10868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2046.exe
        5⤵
        
        PID:9104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15260.exe
        6⤵
        
        PID:13408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10463.exe
        6⤵
        
        PID:4852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26677.exe
        5⤵
        
        PID:12032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51108.exe
        5⤵
        
        PID:15180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21928.exe
        5⤵
        
        PID:15204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21482.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21482.exe
      4⤵
      PID:4536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31285.exe
        5⤵
        
        PID:6932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41337.exe
        6⤵
        
        PID:10132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3807.exe
        6⤵
        
        PID:13128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64092.exe
        5⤵
        
        PID:9156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33442.exe
        5⤵
        
        PID:13096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22087.exe
        5⤵
        
        PID:16068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24459.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24459.exe
      4⤵
      PID:6280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11176.exe
        5⤵
        
        PID:13288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6300.exe
        5⤵
        
        PID:11128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49081.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49081.exe
      4⤵
      PID:10232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64079.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64079.exe
      4⤵
      PID:12340
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27543.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27543.exe
      4⤵
      PID:6928
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48505.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48505.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25366.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25366.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15176.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21181.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36853.exe
        7⤵
        
        PID:4952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32525.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36241.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:7736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39765.exe
        10⤵
        
        PID:12900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51609.exe
        10⤵
        
        PID:11120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35259.exe
        9⤵
        
        PID:10376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47615.exe
        9⤵
        
        PID:13992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46400.exe
        9⤵
        
        PID:2160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38907.exe
        8⤵
        
        PID:8216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40547.exe
        8⤵
        
        PID:11628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13127.exe
        8⤵
        
        PID:13072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2675.exe
        7⤵
        
        PID:6544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10252.exe
        8⤵
        
        PID:9184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43915.exe
        8⤵
        
        PID:13264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26172.exe
        8⤵
        
        PID:4356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24542.exe
        7⤵
        
        PID:3612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39308.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:13088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58347.exe
        7⤵
        
        PID:1920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34754.exe
        6⤵
        
        PID:5972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48301.exe
        7⤵
        
        PID:7780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47793.exe
        8⤵
        
        PID:16088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19115.exe
        7⤵
        
        PID:10348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27194.exe
        7⤵
        
        PID:13916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30064.exe
        7⤵
        
        PID:6136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58508.exe
        6⤵
        
        PID:6212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37746.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18972.exe
        6⤵
        
        PID:15256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27163.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54149.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13412.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46521.exe
        8⤵
        
        PID:8372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26811.exe
        8⤵
        
        PID:11844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15924.exe
        8⤵
        
        PID:16108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29727.exe
        8⤵
        
        PID:984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28959.exe
        7⤵
        
        PID:7932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53567.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:12124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45416.exe
        7⤵
        
        PID:15376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57304.exe
        6⤵
        
        PID:7096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8472.exe
        7⤵
        
        PID:2288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40127.exe
        7⤵
        
        PID:7204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37947.exe
        6⤵
        
        PID:8068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23164.exe
        6⤵
        
        PID:13208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57563.exe
        6⤵
        
        PID:4984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7754.exe
        5⤵
        
        PID:2428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13796.exe
        6⤵
        
        PID:5372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14704.exe
        7⤵
        
        PID:7372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21877.exe
        8⤵
        
        PID:9876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1627.exe
        7⤵
        
        PID:10008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16707.exe
        8⤵
        
        PID:8760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18066.exe
        7⤵
        
        PID:13536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18003.exe
        7⤵
        
        PID:2864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50392.exe
        6⤵
        
        PID:7192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27718.exe
        6⤵
        
        PID:10912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25380.exe
        6⤵
        
        PID:14976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1663.exe
        5⤵
        
        PID:6444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29365.exe
        6⤵
        
        PID:8544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37475.exe
        6⤵
        
        PID:11400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37387.exe
        6⤵
        
        PID:16060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21742.exe
        5⤵
        
        PID:7684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63500.exe
        5⤵
        
        PID:12976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7563.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7563.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:4692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28446.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53957.exe
        6⤵
        
        PID:2388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-236.exe
        7⤵
        
        PID:5684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23081.exe
        8⤵
        
        PID:9504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11242.exe
        8⤵
        
        PID:12328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22820.exe
        7⤵
        
        PID:8472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4648.exe
        8⤵
        
        PID:15728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50059.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15732.exe
        7⤵
        
        PID:16212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51684.exe
        6⤵
        
        PID:6472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46189.exe
        7⤵
        
        PID:9908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1508.exe
        7⤵
        
        PID:13820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44619.exe
        7⤵
        
        PID:5700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32520.exe
        6⤵
        
        PID:9316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39963.exe
        6⤵
        
        PID:13964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29367.exe
        6⤵
        
        PID:3260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7423.exe
        5⤵
        
        PID:5136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10096.exe
        6⤵
        
        PID:6516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9624.exe
        7⤵
        
        PID:9760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45067.exe
        7⤵
        
        PID:12360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10807.exe
        6⤵
        
        PID:7956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21191.exe
        6⤵
        
        PID:12768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51891.exe
        6⤵
        
        PID:16184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32746.exe
        5⤵
        
        PID:6580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32593.exe
        6⤵
        
        PID:9700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20113.exe
        7⤵
        
        PID:13556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10463.exe
        7⤵
        
        PID:16024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33028.exe
        6⤵
        
        PID:13044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30408.exe
        5⤵
        
        PID:7652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58125.exe
        6⤵
        
        PID:15444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14498.exe
        5⤵
        
        PID:13176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61591.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33690.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33690.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51518.exe
        5⤵
        
        PID:4752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22541.exe
        6⤵
        
        PID:6560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25961.exe
        7⤵
        
        PID:9956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1508.exe
        7⤵
        
        PID:13340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15838.exe
        7⤵
        
        PID:12544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35311.exe
        6⤵
        
        PID:9080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17298.exe
        6⤵
        
        PID:13080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28523.exe
        5⤵
        
        PID:2756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34129.exe
        6⤵
        
        PID:9860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1508.exe
        6⤵
        
        PID:13836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43633.exe
        6⤵
        
        PID:3700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20266.exe
        5⤵
        
        PID:8664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27056.exe
        5⤵
        
        PID:13740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33650.exe
        5⤵
        
        PID:1040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52981.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52981.exe
      4⤵
      PID:5640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5000.exe
        5⤵
        
        PID:6984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7896.exe
        6⤵
        
        PID:9764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43915.exe
        6⤵
        
        PID:13204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57666.exe
        6⤵
        
        PID:6232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46168.exe
        5⤵
        
        PID:10016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34594.exe
        5⤵
        
        PID:12416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30064.exe
        5⤵
        
        PID:6140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55707.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55707.exe
      4⤵
      PID:7828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54814.exe
        5⤵
        
        PID:13952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29897.exe
        5⤵
        
        PID:3660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45995.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45995.exe
      4⤵
      PID:10392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45345.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45345.exe
      4⤵
      PID:13984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16542.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16542.exe
      4⤵
      PID:6716
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35572.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35572.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:5096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24222.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24222.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:4648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2680.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17585.exe
        6⤵
        
        PID:4884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1108.exe
        7⤵
        
        PID:748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25961.exe
        8⤵
        
        PID:9920
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 748 -s 616
        8⤵
        Program crash
        
        PID:12760
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4884 -s 648
        7⤵
        Program crash
        
        PID:9344
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4616 -s 660
        6⤵
        Program crash
        
        PID:7384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51964.exe
        5⤵
        
        PID:5232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26765.exe
        6⤵
        
        PID:6596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18997.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:9492
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5232 -s 740
        6⤵
        Program crash
        
        PID:9732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7319.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7319.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38965.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5000.exe
        6⤵
        
        PID:6848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30045.exe
        7⤵
        
        PID:9972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1508.exe
        7⤵
        
        PID:13324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20306.exe
        7⤵
        
        PID:852
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2012 -s 708
        5⤵
        Program crash
        
        PID:7396
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5096 -s 764
      4⤵
      Program crash
      PID:5584
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14719.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14719.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31461.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31461.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21669.exe
        5⤵
        
        PID:1576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34933.exe
        6⤵
        
        PID:6496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18997.exe
        7⤵
        
        PID:9484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11242.exe
        7⤵
        
        PID:12164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32778.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:10692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54144.exe
        6⤵
        
        PID:9224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22342.exe
        6⤵
        
        PID:12332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54568.exe
        6⤵
        
        PID:3228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5083.exe
        5⤵
        
        PID:8136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64461.exe
        6⤵
        
        PID:13360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26799.exe
        6⤵
        
        PID:2596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24072.exe
        5⤵
        
        PID:10556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16714.exe
        5⤵
        
        PID:12028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33380.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33380.exe
      4⤵
      PID:5628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21337.exe
        5⤵
        
        PID:4872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37165.exe
        6⤵
        
        PID:9072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24855.exe
        6⤵
        
        PID:14816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61788.exe
        5⤵
        
        PID:1632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51108.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:13260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9306.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9306.exe
      4⤵
      PID:8028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46500.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46500.exe
      4⤵
      PID:10936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45775.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45775.exe
      4⤵
      PID:14632
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55395.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55395.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22629.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22629.exe
      4⤵
      PID:5268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10236.exe
        5⤵
        
        PID:4484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29661.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18643.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27108.exe
        6⤵
        
        PID:16348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57739.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:11016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55509.exe
        5⤵
        
        PID:14568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45903.exe
        5⤵
        
        PID:12580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15991.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15991.exe
      4⤵
      PID:8084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30341.exe
        5⤵
        
        PID:11808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59064.exe
        5⤵
        
        PID:15296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12011.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12011.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:9524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35790.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35790.exe
      4⤵
      PID:9688
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60344.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60344.exe
    3⤵
    PID:5944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51461.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51461.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54041.exe
        5⤵
        
        PID:15416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18792.exe
        5⤵
        
        PID:4276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14756.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14756.exe
      4⤵
      PID:10276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50547.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50547.exe
      4⤵
      PID:13592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1475.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1475.exe
      4⤵
      PID:5600
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37161.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37161.exe
    3⤵
    PID:7456
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59942.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59942.exe
    3⤵
    PID:9732
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55915.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55915.exe
    3⤵
    PID:14584
- C:\Users\Admin\AppData\Local\Temp\Unicorn-41000.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-41000.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2840
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2833.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2833.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12921.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12921.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63225.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59390.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12156.exe
        7⤵
        
        PID:4920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15805.exe
        8⤵
        
        PID:5336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60553.exe
        9⤵
        
        PID:7896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52140.exe
        9⤵
        
        PID:3924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40372.exe
        9⤵
        
        PID:14576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47076.exe
        8⤵
        
        PID:8228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25261.exe
        9⤵
        
        PID:12996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40547.exe
        8⤵
        
        PID:11576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13127.exe
        8⤵
        
        PID:7156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35155.exe
        7⤵
        
        PID:6604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54357.exe
        8⤵
        
        PID:9976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1508.exe
        8⤵
        
        PID:13808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16222.exe
        8⤵
        
        PID:408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25611.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51560.exe
        7⤵
        
        PID:13144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58980.exe
        6⤵
        
        PID:4228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45737.exe
        7⤵
        
        PID:5520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46521.exe
        8⤵
        
        PID:8332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55577.exe
        9⤵
        
        PID:16056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40132.exe
        8⤵
        
        PID:11528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15924.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:16040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9499.exe
        7⤵
        
        PID:8284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13686.exe
        7⤵
        
        PID:12260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38016.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:15932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17178.exe
        6⤵
        
        PID:6740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58654.exe
        7⤵
        
        PID:10824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24855.exe
        7⤵
        
        PID:14676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30408.exe
        6⤵
        
        PID:8536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63556.exe
        7⤵
        
        PID:6524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61528.exe
        6⤵
        
        PID:5200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49339.exe
        6⤵
        
        PID:8892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63920.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38005.exe
        6⤵
        
        PID:4640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32525.exe
        7⤵
        
        PID:5324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42686.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:8924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48768.exe
        8⤵
        
        PID:10560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44211.exe
        8⤵
        
        PID:16044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53848.exe
        7⤵
        
        PID:9096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20811.exe
        7⤵
        
        PID:12040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13127.exe
        7⤵
        
        PID:14600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51195.exe
        6⤵
        
        PID:6272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29661.exe
        7⤵
        
        PID:10044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42851.exe
        7⤵
        
        PID:11448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2219.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63848.exe
        6⤵
        
        PID:9296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14498.exe
        6⤵
        
        PID:12964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5592.exe
        6⤵
        
        PID:5224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24282.exe
        5⤵
        
        PID:1196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13168.exe
        6⤵
        
        PID:7156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60797.exe
        7⤵
        
        PID:9892
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7156 -s 648
        7⤵
        Program crash
        
        PID:12512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21663.exe
        6⤵
        
        PID:9984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22342.exe
        6⤵
        
        PID:12304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46016.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7003.exe
        5⤵
        
        PID:7844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33081.exe
        6⤵
        
        PID:10776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24855.exe
        6⤵
        
        PID:4860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5354.exe
        5⤵
        
        PID:10416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48891.exe
        5⤵
        
        PID:14048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4222.exe
        5⤵
        
        PID:3536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39275.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39275.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59390.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40937.exe
        6⤵
        
        PID:3580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49821.exe
        7⤵
        
        PID:5620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42629.exe
        8⤵
        
        PID:3504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21177.exe
        9⤵
        
        PID:12736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26811.exe
        8⤵
        
        PID:11592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15924.exe
        8⤵
        
        PID:828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37734.exe
        8⤵
        
        PID:4580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1523.exe
        7⤵
        
        PID:7644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1434.exe
        7⤵
        
        PID:12208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9427.exe
        7⤵
        
        PID:15960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32415.exe
        6⤵
        
        PID:6632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58441.exe
        7⤵
        
        PID:4832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4331.exe
        7⤵
        
        PID:13888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61147.exe
        7⤵
        
        PID:5580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24542.exe
        6⤵
        
        PID:8268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1612.exe
        7⤵
        
        PID:14688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23164.exe
        6⤵
        
        PID:13732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-786.exe
        6⤵
        
        PID:6192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18715.exe
        5⤵
        
        PID:1068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12976.exe
        6⤵
        
        PID:5488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57585.exe
        7⤵
        
        PID:10460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49744.exe
        7⤵
        
        PID:13164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61823.exe
        6⤵
        
        PID:11036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4454.exe
        7⤵
        
        PID:8804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54440.exe
        6⤵
        
        PID:14660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38965.exe
        5⤵
        
        PID:8488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37746.exe
        5⤵
        
        PID:11652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53464.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12118.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12118.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50257.exe
        5⤵
        
        PID:4904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20273.exe
        6⤵
        
        PID:5928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15629.exe
        7⤵
        
        PID:7924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52140.exe
        7⤵
        
        PID:10800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40372.exe
        7⤵
        
        PID:592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48617.exe
        7⤵
        
        PID:9980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19556.exe
        6⤵
        
        PID:8340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40547.exe
        6⤵
        
        PID:11708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13127.exe
        6⤵
        
        PID:12764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37931.exe
        5⤵
        
        PID:5572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51653.exe
        6⤵
        
        PID:7912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31597.exe
        7⤵
        
        PID:12888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52140.exe
        6⤵
        
        PID:10368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40372.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:15092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6950.exe
        5⤵
        
        PID:7112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6376.exe
        6⤵
        
        PID:16076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51609.exe
        6⤵
        
        PID:924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31306.exe
        5⤵
        
        PID:12192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-947.exe
        5⤵
        
        PID:15528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51637.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51637.exe
      4⤵
      PID:3044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13796.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44217.exe
        6⤵
        
        PID:7760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48509.exe
        7⤵
        
        PID:13648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30883.exe
        7⤵
        
        PID:4940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19115.exe
        6⤵
        
        PID:10356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27194.exe
        6⤵
        
        PID:13908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46400.exe
        6⤵
        
        PID:4808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47739.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15467.exe
        5⤵
        
        PID:12228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29350.exe
        5⤵
        
        PID:15908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58535.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58535.exe
      4⤵
      PID:6452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6168.exe
        5⤵
        
        PID:4232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19707.exe
        5⤵
        
        PID:13000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26912.exe
        5⤵
        
        PID:11124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5207.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5207.exe
      4⤵
      PID:7216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18920.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18920.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:13052
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5500.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5500.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24222.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24222.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2872.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6484.exe
        6⤵
        
        PID:5188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63381.exe
        7⤵
        
        PID:6424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9624.exe
        8⤵
        
        PID:9788
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1584 -s 656
        6⤵
        Program crash
        
        PID:6656
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3120 -s 728
        5⤵
        Program crash
        
        PID:5348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19955.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19955.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18545.exe
        5⤵
        
        PID:5252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55021.exe
        6⤵
        
        PID:6612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46521.exe
        7⤵
        
        PID:8320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26811.exe
        7⤵
        
        PID:11676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15924.exe
        7⤵
        
        PID:16100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20983.exe
        6⤵
        
        PID:7860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53567.exe
        6⤵
        
        PID:12116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45416.exe
        6⤵
        
        PID:15384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28523.exe
        5⤵
        
        PID:5636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5348.exe
        6⤵
        
        PID:5432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49151.exe
        6⤵
        
        PID:12500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20266.exe
        5⤵
        
        PID:8184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27056.exe
        5⤵
        
        PID:13748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44917.exe
        5⤵
        
        PID:6628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46047.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46047.exe
      4⤵
      PID:5672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46521.exe
        5⤵
        
        PID:8292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5032.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:12756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26811.exe
        5⤵
        
        PID:11668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25482.exe
        5⤵
        
        PID:4960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10267.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10267.exe
      4⤵
      PID:8612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37746.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37746.exe
      4⤵
      PID:11816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18972.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18972.exe
      4⤵
      PID:15336
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17022.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17022.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6764.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6764.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38965.exe
        5⤵
        
        PID:5440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44689.exe
        6⤵
        
        PID:7076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46521.exe
        7⤵
        
        PID:8364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26811.exe
        7⤵
        
        PID:11884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21398.exe
        7⤵
        
        PID:5776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14683.exe
        5⤵
        
        PID:6748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38213.exe
        6⤵
        
        PID:10972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34839.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:14612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60671.exe
        5⤵
        
        PID:9616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28208.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13038.exe
        5⤵
        
        PID:6804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4107.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4107.exe
      4⤵
      PID:3076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44217.exe
        5⤵
        
        PID:7772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53278.exe
        6⤵
        
        PID:12864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51417.exe
        6⤵
        
        PID:8692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52332.exe
        5⤵
        
        PID:9528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40372.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52643.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52643.exe
      4⤵
      PID:7260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49957.exe
        5⤵
        
        PID:15244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46412.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46412.exe
      4⤵
      PID:11660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56261.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56261.exe
      4⤵
      PID:15268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45447.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45447.exe
      4⤵
      PID:7444
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26920.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26920.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15612.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15612.exe
      4⤵
      PID:5496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46417.exe
        5⤵
        
        PID:6864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41721.exe
        6⤵
        
        PID:10212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29498.exe
        6⤵
        
        PID:14792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21663.exe
        5⤵
        
        PID:10048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34594.exe
        5⤵
        
        PID:12384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46400.exe
        5⤵
        
        PID:3860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16567.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16567.exe
      4⤵
      PID:7592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4454.exe
        5⤵
        
        PID:4644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49187.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49187.exe
      4⤵
      PID:10300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53205.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53205.exe
      4⤵
      PID:13688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13422.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13422.exe
      4⤵
      PID:5760
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64435.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64435.exe
    3⤵
    PID:6044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60937.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60937.exe
      4⤵
      PID:7520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17093.exe
        5⤵
        
        PID:15468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31034.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31034.exe
      4⤵
      PID:10812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40372.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40372.exe
      4⤵
      PID:15052
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44791.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44791.exe
    3⤵
    PID:6228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21177.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21177.exe
      4⤵
      PID:13600
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3684.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3684.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:9740
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39678.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39678.exe
    3⤵
    PID:13716
- C:\Users\Admin\AppData\Local\Temp\Unicorn-4871.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-4871.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5024
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37618.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37618.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24222.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24222.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59966.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50942.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13168.exe
        7⤵
        
        PID:7052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41337.exe
        8⤵
        
        PID:10140
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3668 -s 728
        7⤵
        Program crash
        
        PID:9336
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2152 -s 708
        5⤵
        Program crash
        
        PID:4448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7511.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7511.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31757.exe
        5⤵
        
        PID:5608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12976.exe
        6⤵
        
        PID:6944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13708.exe
        7⤵
        
        PID:5524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29027.exe
        7⤵
        
        PID:12704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40535.exe
        7⤵
        
        PID:5248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61788.exe
        6⤵
        
        PID:3264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-378.exe
        6⤵
        
        PID:15260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61108.exe
        5⤵
        
        PID:8044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48478.exe
        6⤵
        
        PID:16332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52852.exe
        5⤵
        
        PID:4836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31706.exe
        5⤵
        
        PID:14932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39223.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39223.exe
      4⤵
      PID:5940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60553.exe
        5⤵
        
        PID:7888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15908.exe
        5⤵
        
        PID:10476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2690.exe
        5⤵
        
        PID:13276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21703.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1139.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1139.exe
      4⤵
      PID:7292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37746.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37746.exe
      4⤵
      PID:11604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2636.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2636.exe
      4⤵
      PID:12812
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3287.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3287.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:4200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21949.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21949.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50942.exe
        5⤵
        
        PID:4836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48254.exe
        6⤵
        
        PID:6432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15400.exe
        7⤵
        
        PID:5692
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6432 -s 636
        7⤵
        Program crash
        
        PID:15136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48664.exe
        5⤵
        
        PID:7992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51301.exe
        6⤵
        
        PID:15464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36036.exe
        6⤵
        
        PID:5228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40635.exe
        5⤵
        
        PID:10924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21959.exe
        5⤵
        
        PID:14544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-786.exe
        5⤵
        
        PID:1280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64709.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64709.exe
      4⤵
      PID:1396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10236.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30045.exe
        6⤵
        
        PID:4956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1508.exe
        6⤵
        
        PID:13348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9411.exe
        5⤵
        
        PID:10104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42763.exe
        5⤵
        
        PID:4884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64812.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64812.exe
      4⤵
      PID:8112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45873.exe
        5⤵
        
        PID:15356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26080.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26080.exe
      4⤵
      PID:10980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8347.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8347.exe
      4⤵
      PID:15164
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56851.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56851.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:4376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17585.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17585.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4979.exe
        5⤵
        
        PID:6152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31249.exe
        6⤵
        
        PID:9544
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6152 -s 664
        6⤵
        Program crash
        
        PID:12484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16271.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16271.exe
      4⤵
      PID:2268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30045.exe
        5⤵
        
        PID:9832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1508.exe
        5⤵
        
        PID:13316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49772.exe
        5⤵
        
        PID:6328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20266.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20266.exe
      4⤵
      PID:9092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27056.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27056.exe
      4⤵
      PID:13248
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51912.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51912.exe
    3⤵
    PID:5668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17061.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17061.exe
      4⤵
      PID:6296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30045.exe
        5⤵
        
        PID:9848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1508.exe
        5⤵
        
        PID:13332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40535.exe
        5⤵
        
        PID:4028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37615.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37615.exe
      4⤵
      PID:7396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22342.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22342.exe
      4⤵
      PID:12432
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21703.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21703.exe
      4⤵
      PID:6768
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18950.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18950.exe
    3⤵
    PID:7944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33081.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33081.exe
      4⤵
      PID:10792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20771.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20771.exe
      4⤵
      PID:14564
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5155.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5155.exe
    3⤵
    PID:10532
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16756.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16756.exe
    3⤵
    PID:14096
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40060.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40060.exe
    3⤵
    PID:6724
- C:\Users\Admin\AppData\Local\Temp\Unicorn-37353.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-37353.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:5008
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14984.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14984.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26033.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26033.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50942.exe
        5⤵
        
        PID:2284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7828.exe
        6⤵
        
        PID:6064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14704.exe
        7⤵
        
        PID:7348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-356.exe
        8⤵
        
        PID:11408
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2284 -s 636
        6⤵
        Program crash
        
        PID:8352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9151.exe
        5⤵
        
        PID:5820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60553.exe
        6⤵
        
        PID:7968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15260.exe
        7⤵
        
        PID:12292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2487.exe
        7⤵
        
        PID:4712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30650.exe
        6⤵
        
        PID:9720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40372.exe
        6⤵
        
        PID:14700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60811.exe
        5⤵
        
        PID:7748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27217.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:12156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21539.exe
        6⤵
        
        PID:15544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32527.exe
        6⤵
        
        PID:4792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46412.exe
        5⤵
        
        PID:11792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56261.exe
        5⤵
        
        PID:15352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41363.exe
        5⤵
        
        PID:14032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22415.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22415.exe
      4⤵
      PID:4328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54009.exe
        5⤵
        
        PID:5884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21877.exe
        6⤵
        
        PID:9828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49151.exe
        6⤵
        
        PID:12480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57282.exe
        6⤵
        
        PID:11104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61788.exe
        5⤵
        
        PID:9536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41363.exe
        5⤵
        
        PID:1388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9306.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9306.exe
      4⤵
      PID:8036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8605.exe
        5⤵
        
        PID:15744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44187.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44187.exe
      4⤵
      PID:9464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15171.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15171.exe
      4⤵
      PID:14512
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34947.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34947.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26329.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26329.exe
      4⤵
      PID:4932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5000.exe
        5⤵
        
        PID:7020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46189.exe
        6⤵
        
        PID:9948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1508.exe
        6⤵
        
        PID:12884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44619.exe
        6⤵
        
        PID:4972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14564.exe
        5⤵
        
        PID:10060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22342.exe
        5⤵
        
        PID:12492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26172.exe
        5⤵
        
        PID:5748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3442.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3442.exe
      4⤵
      PID:8240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46412.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46412.exe
      4⤵
      PID:11584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51108.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51108.exe
      4⤵
      PID:15440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38073.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38073.exe
      4⤵
      PID:1244
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45663.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45663.exe
    3⤵
    PID:5172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5000.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5000.exe
      4⤵
      PID:7032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5348.exe
        5⤵
        
        PID:9820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53235.exe
        5⤵
        
        PID:12752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16441.exe
        5⤵
        
        PID:8840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5327.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5327.exe
      4⤵
      PID:10088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42763.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42763.exe
      4⤵
      PID:12464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60556.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60556.exe
      4⤵
      PID:3284
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64372.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64372.exe
    3⤵
    PID:7816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46558.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46558.exe
      4⤵
      PID:15772
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21690.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21690.exe
    3⤵
    PID:10544
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15835.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15835.exe
    3⤵
    PID:7052
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57507.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57507.exe
    3⤵
    PID:4236
- C:\Users\Admin\AppData\Local\Temp\Unicorn-22582.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-22582.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2148
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27377.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27377.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43625.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43625.exe
      4⤵
      PID:5152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9167.exe
        5⤵
        
        PID:8152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12240.exe
        6⤵
        
        PID:14824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7770.exe
        5⤵
        
        PID:10996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54440.exe
        5⤵
        
        PID:14592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29587.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29587.exe
      4⤵
      PID:8096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21369.exe
        5⤵
        
        PID:15276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12011.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12011.exe
      4⤵
      PID:1144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31706.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31706.exe
      4⤵
      PID:14812
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8767.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8767.exe
    3⤵
    PID:5952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42629.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42629.exe
      4⤵
      PID:6324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40132.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40132.exe
      4⤵
      PID:11536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7262.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7262.exe
      4⤵
      PID:5916
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57495.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57495.exe
    3⤵
    PID:8740
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46412.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46412.exe
    3⤵
    PID:11860
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51108.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51108.exe
    3⤵
    PID:15568
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42157.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42157.exe
    3⤵
    PID:1348
- C:\Users\Admin\AppData\Local\Temp\Unicorn-59088.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-59088.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1140
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51300.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51300.exe
    3⤵
    PID:6036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14704.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14704.exe
      4⤵
      PID:7364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26950.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26950.exe
      4⤵
      PID:10148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40372.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40372.exe
      4⤵
      PID:14708
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64127.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64127.exe
    3⤵
    PID:7264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20791.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20791.exe
      4⤵
      PID:15848
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33584.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33584.exe
    3⤵
    PID:11064
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16714.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16714.exe
    3⤵
    PID:14580
- C:\Users\Admin\AppData\Local\Temp\Unicorn-64965.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-64965.exe
  2⤵
  PID:6072
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26293.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26293.exe
    3⤵
    PID:6492
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40132.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40132.exe
    3⤵
    PID:11520
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21398.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21398.exe
    3⤵
    PID:5740
- C:\Users\Admin\AppData\Local\Temp\Unicorn-47098.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-47098.exe
  2⤵
  PID:8912
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2484.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2484.exe
    3⤵
    PID:15240
- C:\Users\Admin\AppData\Local\Temp\Unicorn-57212.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-57212.exe
  2⤵
  PID:11996
- C:\Users\Admin\AppData\Local\Temp\Unicorn-47863.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-47863.exe
  2⤵
  PID:15200

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2152 -ip 2152
1⤵
PID:5784

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 3120 -ip 3120
1⤵
PID:5836

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 5096 -ip 5096
1⤵
PID:5864

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 1584 -ip 1584
1⤵
PID:2612

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 4616 -ip 4616
1⤵
PID:2976

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 2012 -ip 2012
1⤵
PID:7112

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 4648 -ip 4648
1⤵
PID:7644

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1844 -ip 1844
1⤵
PID:7652

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 2284 -ip 2284
1⤵
PID:2852

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 2808 -ip 2808
1⤵
PID:8668

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 5440 -ip 5440
1⤵
PID:8756

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 712 -p 4884 -ip 4884
1⤵
PID:9072

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 692 -p 988 -ip 988
1⤵
PID:4984

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 724 -p 5188 -ip 5188
1⤵
PID:3360

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 744 -p 3668 -ip 3668
1⤵
PID:7792

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 756 -p 5432 -ip 5432
1⤵
PID:1908

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 768 -p 4836 -ip 4836
1⤵
PID:7388

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 716 -p 5232 -ip 5232
1⤵
PID:9376

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 6064 -ip 6064
1⤵
PID:9716

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 720 -p 5548 -ip 5548
1⤵
PID:11428

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 6152 -ip 6152
1⤵
PID:12304

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 7156 -ip 7156
1⤵
PID:12464

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 660 -p 748 -ip 748
1⤵
PID:12704

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 752 -p 7372 -ip 7372
1⤵
PID:12728

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 660 -p 6596 -ip 6596
1⤵
PID:12740

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 668 -p 6424 -ip 6424
1⤵
PID:12768

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 7052 -ip 7052
1⤵
PID:12776

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 756 -p 6432 -ip 6432
1⤵
PID:15076

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:14344

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-12921.exe

Filesize
468KB

MD5
b40ddb72e09c42b7e0da7d418bf978b5

SHA1
98bf6bd3f4cd13ab92e00646619fef552038e5ed

SHA256
49c3a6c4a1e8f139bc4aef4b93984b8a542b215027a85a55c6b07e6add6d0d39

SHA512
97ec0cd7ef62f143c4065b7489b3c43e8ab9c3a86f5d592cd78ffdb83d7c8aab8f541437ac2ddaa1d5d74f7037ba940dd312daefb00a0cc09cbd0f6773bfa723

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-14216.exe

Filesize
468KB

MD5
d9962796bb1456584bfb8ed7b4c5ddde

SHA1
0d69ec3b9dbbf2f2490c7319a076fda205d079b1

SHA256
dc046af9ccd0e56c8b7ea33997ef7b2065d0e1242e1447aa9b3e446742a3532d

SHA512
863ec94fa94b4996b198d570617b50ca8f804527adfcaa51f70bacf6d04701d8e47ed2a1f5c46c6620194cfbc1fdca9aa72008890c4dbea1980ec8fd9c7b7ea5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-14719.exe

Filesize
468KB

MD5
56cab036f35d772244748bf8e4c61ccc

SHA1
2c9bcddbb702ac7f969edfb101931dd77be80eeb

SHA256
bcaaf222519f473c2c7e92b298b4f54fed296ab4cf212ef8436701478231a916

SHA512
8cbadb902400b835065e6a4ed50704a101bd2654ef4ba4864796d2f5112d4485f0185f4b0bc066991279f0df40b582d040dbe8a0f3a2ba4a827cba11b8edbacb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-14984.exe

Filesize
468KB

MD5
3db82be90e50cdd708d19f8db5d54853

SHA1
5748b545ac311636d522afbe9bfd7508a0ac10ab

SHA256
0149abcceeb5170d1b1b2af1e20387d5eca3dcfb63f6782e80808854fe613a65

SHA512
6668c2199328f20751c9e06de7efc72e40fc10399eb2eef4d0e99cdd1f4e43e389968c67789d34748a134c53ed182eb436d42b2da8d2bc234958b4176b2a944a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-15176.exe

Filesize
468KB

MD5
8fc15e7c3f00448bb8aa77de3c2538db

SHA1
3475c64aa4ed8e9b7b2f047649f565903017ffe9

SHA256
64f80c7f755f673b5ab35ef62ffca7a9b7d5bbf5752a56adba893b0aa5aa05df

SHA512
c92256197259528db96e768ae582256c29bfbb76a7130a06f9d8a359f34fcd50d8dd1aebc733bd7fd4653b22ef1e13bab2e1b2fb5cc5a92e131869b0fa534562

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-17022.exe

Filesize
468KB

MD5
34e49ad25270347b1778daf72f95e3bd

SHA1
b281dec1fe38ea664878b87bbdff9417352168ac

SHA256
58a02da7cf2bcfa43f65f9dc6c9f104b4f33455d15fd3c4bf2a7f6a8f9ae5b11

SHA512
c44f27abd4ffbc3c00eb2e93675991b63cccd950f14671a8142b235c250413936499cf2925cc24096f12487d846de9cf10c3be2be68aab14db0640eeffafdc1c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-21614.exe

Filesize
468KB

MD5
77258df81d89422c61bae8629f6dc956

SHA1
63a1d0380214d19865118b1da481021dc25e95d9

SHA256
2cf6ce703586523bd06ae89cdfd8e48ac0f4dc07d0fcdf0eb3c41c322f15d80c

SHA512
ee2ebafc1ce5714f4df955e29bee70f5616877548262ab2c47bfd1d3ce5e4b42ac8e88a2a9bd3f5ff4c4bc75d818553069f35f000fb0b2637681e858d0c60fb7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-22582.exe

Filesize
468KB

MD5
d0bf2d97cce03557d3c19b425be4bb85

SHA1
9e37510b32fdf9d8d7e5eac98b37dd0c8b63ea03

SHA256
8d327d666a9a19230fb9f38e2dff2aeba2bd8cf10a24757890a62f377b267158

SHA512
2ac62e156624646b58727708ab1614e65e93cc1d7381d7bf92ba5d86e9476a4a415c980d95d1af2b2f02cd9534b68e7f276307bc94ccf6ac85a2cefce61bedb5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-24222.exe

Filesize
468KB

MD5
264ea0f8b37ca85003e7db9be9af4c9e

SHA1
15c18854c96e7ecc0db529dfd2414fa3189c0326

SHA256
22bb28ab2605ecf4e5c87140d5b8f9d03e5aded19ccc66f601ba3e8c43312666

SHA512
06af08b135a2f5117d4d8c25407452b1f4ec5408125a84b12c25f205d58bc13afce8c768f4bb3251f35b513b229005de2a50011c94e71bff6a48e19a100e2657

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-25366.exe

Filesize
468KB

MD5
74ce1b36c4ad0059343d378328b1914a

SHA1
45a4b59000eecf5d2a1ee7227022c015ddf2d8e4

SHA256
b0aded16b1e0928d023c03f295bef506cbd1133a950561c29d89f629129921e7

SHA512
75f9d454e51f050c239a9bce7ba14a399c4e7bd3da255a833feec87d61a171638d6fddb0c2587274bd8849483ecac4d8643a3f6e29a748f374cadde6a52e346a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-26587.exe

Filesize
468KB

MD5
8792be988eb226f42544d2c7fa0a9475

SHA1
0d4521e4db0568766180c7be2c9815f682a3fb5c

SHA256
76049ad9e86141be205c1dd0128a45d935b6d16d78443e31f8e9d53478099f19

SHA512
1ba84614feb2f1f273f69be2cfa2cfba1952ad13b4352e18bff876e71e1a3eeeb103bceed1eca72c719d02b0eaa96a548ede495669580c8754ae1110d63f282e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-2833.exe

Filesize
468KB

MD5
558851f9af19b0d441b08a117703a7d6

SHA1
cfd1105e63c4beec5d3f49fe19dcff81b2d432ff

SHA256
7a54d40bbf7d2ac552af5413110bb2e408b4e16fce1e92d3b9122004a0ed72c9

SHA512
8d2735a778118b4575957a9e06505385ed709a4c5ef8a34507a49493ca6447b9f7c6f9948656fe96f061adb5d15abf678fc8e1b61368c577315a539035069a63

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-30064.exe

Filesize
468KB

MD5
8b048b3ff516e7049d6dd7e6e6b9ec0a

SHA1
89fbaca1eaf26c1148418981df94c830c6af5eec

SHA256
e35bb74501f760ed88005b27a6c283058e6abe52f04f35ff68ba44c6688bea44

SHA512
4a6f0d4e2575863a26be4c51615e8813b5d0bba0df4fa667ff4b563c60d1c7158d70bc4315d5089d040683a00835487f7998d2bee3793a0427c1390960b3bfeb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-31491.exe

Filesize
468KB

MD5
c5aa7fd23e1b7d65d512c059bc4c7cf1

SHA1
9389a5ea48a6ac5ea610472391bcdfdbf4329911

SHA256
61fe45cb1000be8279abc4b035a5e3b97fe519717dceb0ac12bd8926183a6a06

SHA512
cb08e263138df97e9b70ddf16eba2ab41d15a1c5c0bec46323b37dc57a8cd6f96201e50f904cfc62fd731217e484164ae1f188fab482d862b8c8b332e1f5891d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-3287.exe

Filesize
468KB

MD5
8b57abdc55db6e154e80a63ecfc1e833

SHA1
deed26e54f21afdab76c4990caed3b9da7648d43

SHA256
9767a268a666000708382074788a257bc8bcb964e0ab34553349807af9fb6666

SHA512
e44ba6f8e970f3fece6ae80ef31e497086345746378324a8498d5486628fc52158587acfcc3c52c881fd2e519d1ba9fd5ff80818d4f5e17ba289420179f6ea63

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-35021.exe

Filesize
468KB

MD5
5ab9a551e9a47caaaa58281ec41adf3c

SHA1
f1beb437f97f3190e7291082722696cd4c5f63a3

SHA256
8663f800dc90d261c2717e0e6758a9885c51ee008bd76e514eabbc1617b7e4a1

SHA512
5a6b7a60d09fd01d92df6654260fb576fddda477fd0575a5ad2f34141783562a2b1b3e820d3101aeb98c7cf9badb402cbe9811dca22f020516ac8d76ade3a41c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-35572.exe

Filesize
468KB

MD5
2b0460fc1b2f219f2a9aef5cc39c3f00

SHA1
b20a5e5d2b324c88bafcad04a13bb2b75bb321a5

SHA256
8d28da0278c126e9d5e4991f87df3485c3b623dba1d43891fa0b3d84ba305c8a

SHA512
9e602156f92324e9d134b770ecc5dbf41525a500eecf646223b83e33a317b612fa74cf66f300a6980389d0c9557e6d80d904977ff036a542dbe5897a19a1ca64

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-37353.exe

Filesize
468KB

MD5
dbdbc510dc926c618856761d7123baf3

SHA1
4174d2cc1998e2e13a41b05d25a1c6afdb42279d

SHA256
6ec5347972666774e43bc2f46927e240cea6cb243b60097fa3cbf7a2c6a60841

SHA512
b66db9b5b25afe3b79bc93ede059271845a6c496bd3a6b282c3a7c0f27f131d54b627dfe9442a61f4ca13b568bd322691495e455a16fd390afdaded6a19df117

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-37618.exe

Filesize
468KB

MD5
6e7e076eb3febb6f07435c12abc0fe30

SHA1
84cbc6269b3b2341b4854d060bbe378053e73d6a

SHA256
dddc4df413254b043c21ccffab1407e16c55a2e4f73cac054f75f68571740488

SHA512
772924a30751b933eac37224bf9abe5bd0504551fc830a0cf833530ccb2dea4d11e26f9baf9bab5f96206350ede4366bca3b894feb1d52def60e4706db3327b8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-37931.exe

Filesize
468KB

MD5
e4d269f53c0dec5b095a7830fcbdc89c

SHA1
7e30449b84f71aa0efcc864af9d41f752dfe9b26

SHA256
3aa33c137803c7b1836fb8c4ebdf8a359bfc920bf7eeeecd7a24613efb052472

SHA512
e708a0aa985256364d5857e5eaa6bd02d4bc89ba4955d6c3b8bc472ac6627607ff8f63e1ed2e90765fe4effc6bba430148e3b89cae1815de682dff22d591131d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39275.exe

Filesize
468KB

MD5
875280c9c441838cb24511199d177840

SHA1
7508a98c3aa63450af1e97b1b665a116983e67ae

SHA256
edf69b320857dcebbb693ed732427ca687ed55b19d3f11533bf3743720b10f0c

SHA512
b1fd915d0142a6fd269a9e00cf25628db9f1c8bf66d038fd4a39a233069c508586125f50d2eee9546d9b1b7be680dbdf6c137ff56bbfde00738aecd69db7b9b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-4002.exe

Filesize
468KB

MD5
b150cc772fe35573b7450ce27932d709

SHA1
f37dde8d10be4aa3f87017574fa78d666125d536

SHA256
0cc7cbf832667a91a00dd969b46b8a20528c105f6a6f35b6756e6395bc7b0f2d

SHA512
e14d940dc485bae5d5b09b0ce1fd90b7dbd3e8cfbafff9f8e73860a6a8022c54cba06f6e33a9e1ca6af41d6c489076fd422f907c9a9883bf5a93534a9d69549b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-41000.exe

Filesize
468KB

MD5
c06d2c03cbf2ecee12acd4e45760182e

SHA1
4b4389c72f26dc3040155347909bd6c22a6ca957

SHA256
1a78c2727b5a07c2365b7d8c1f5f5a8b7cecf18edb5a490e4ec9135f3aa3de08

SHA512
0a9a52cb15d46f7147aef3562ac31ca470b6c5dfd90f784de5e48b8702d09a07d24a2b25f29201cda3d45105f0aca2754148cd8d2df415996841cca1b54a11df

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-46170.exe

Filesize
468KB

MD5
88fa98b9551ad0372dac121ee2e4ebf4

SHA1
ecccb42fc9db544be2e39fdca15df0a68ab76f85

SHA256
b334a0efe85e1a0fbb98b08f60eb0d5947b865c6e0cc21ac462c5f4c4964bbd1

SHA512
1f3ac266c86d4466f251beebf27c7eaa25a5eb2417987eb7bcd6a0a3cd605a2c6bb6df05a0d712d4d2de4801b7c345d543b1843f8d6bb67230f02b4334cc624f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-48505.exe

Filesize
468KB

MD5
6fa7dd611a3295bfed7115d197f06314

SHA1
c55c87291ddd1e3c3ac6f5986f5440a9368dce87

SHA256
d587e7a2c23b109cdccc9bbc37c898c5a60b470a8a7ae4805cba171f6e66343d

SHA512
2065d6083d3a83d64bb8897e620b653b38dd47c4a9fa07b967511cb64aabacb0ef7885d49685d081b05d2e3075341627c66feab72d64288148ab8e20d3085cc1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-4871.exe

Filesize
468KB

MD5
326b4f5be0a5f8e34f2d381b3b0544e8

SHA1
fbb3de4cc89f2ffadec0fc309e7a5e2e3ad77429

SHA256
7638b6edf9df8f25a8a4cbce5f7e10f156fd804f7441aee2e3b96a287583c33e

SHA512
997d3e82d3a359b42d86fb71d9201aac86b2c2b61e9d5ffe960e11e8e77e45becf4dd2254ab1773ddacc6926eed5050ca580eb7507a82880d4359730ed1618e7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-50690.exe

Filesize
468KB

MD5
a88f03f1329d562d18c08721bfe3e3d7

SHA1
8fbd31f41b8fd26a2332021cb23d9dc50ad40c7e

SHA256
c09be316d8d69e9a5bc4b1f5aea89e11eb9bb2338f258108e962c35921ad0949

SHA512
9a9e698c97fb4af9a32f51e9e9275cbfb0419f3ec708fe62aa294a63e299968c9fd5861cac4d3306869a4ffcea28687449d987d041f6cb54f03e79f75899878b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5420.exe

Filesize
468KB

MD5
eccb625f4df9a8e2ef21f70f6d9d52f5

SHA1
c5840be9a9c166e4942c2495fbc7a7b09fb45027

SHA256
de4bcfa21dfea7237140d9e53c1dd343fe056d091749d100f8917c3d0e484203

SHA512
493cc3979c3ad9f149775fd52a9d202aa33ff22813f30de454fe40661b9fe97bf997e2f06ee0ab6ad4ddf8fa10984f3447f3fb14414e7a2c349d95892e0120d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5500.exe

Filesize
468KB

MD5
c7c560cd5ec6a36a3a42d15f8c14b888

SHA1
aee92725d9e7866e1849a6b30c4a3ac399884e8a

SHA256
ec5fe307df4667c1fd156f58872a1409707b69c31e59113e7b8476f1fbe6750d

SHA512
d73fef0df4af1f53877b866a7e619c6c7f37653e7eadb41926da7bedcb8553275339d9472a7bc20f7b2850d2d0bc1d97bca79be3579e84a5804050e64175e148

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-58785.exe

Filesize
468KB

MD5
c1489656e7506dc73dbd9c47c2189203

SHA1
33a35983619b00b3f55ff372093b835204f3a633

SHA256
0797a8e11ee8a794dc615d829d41d193fafcf25c62bfeaf7e5a7568ea9384e13

SHA512
f7b9d1879aa9755047c1df1b02f8cc4f9d05a9a1451334ef250332c305b9f11a320c79d61e6701235d2f878bc1c42afe860218dffd1899feeb9b79118f480300

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-60866.exe

Filesize
468KB

MD5
d0a5c2bc417dc315afef01b996619687

SHA1
50edbc3a8a65f21a5076fef770c0161600cc60c0

SHA256
cb88d36385b16d1d1f1ac0a7e5a3b649ab644f1046e5d8f5617204706fb43cb3

SHA512
e733c1edc2a5682bab41a6db4087ab802a89fadff57b522fca706bb5b7603642c4b0d48760ff064e7ec84dba79df26b1e76e9ec980db289c2cfdc3743760d8bc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-63225.exe

Filesize
468KB

MD5
462d872012152a69d36d55e1e7cb2521

SHA1
cedb29042eef7e1a535569372c6a681f19f77084

SHA256
a6279f31589d9a5c85a1acf9a7ae3b2dfacc093b93d47c4812311289b79ecac1

SHA512
af82fc441daf849d8cfbdb24bc54c2da390399057919a41e700704b2bd551a9aee49f642f9ff176938b7ee6128fba6ae72f3e18f55dd43d9007c56d1488673c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-7563.exe

Filesize
468KB

MD5
242c2177b96d7af96ec279a419bc86b2

SHA1
9f535bb9c8887d3c95cf038cd633ba0c74d979d0

SHA256
6298f808f8056c60ae3313e52ad27a2249dd2b6bfdb3dca350b1f57e14753d02

SHA512
41ae082380adf4534476853851e2fff418bca3ee83037e04636fc7901536e74e2f83a27d763f1104a53ff9c84bb3179f310d8a32d19b07ba75a2075311dd792a

Download Submit
memory/228-275-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/364-111-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/376-140-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/452-130-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/460-341-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/716-228-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/864-810-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/988-830-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1064-310-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1068-825-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1120-336-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1140-339-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1176-86-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1180-268-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1196-808-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1216-414-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1248-239-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1368-147-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1368-2745-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1396-802-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1508-55-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1576-831-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1584-314-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1668-415-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1776-41-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1796-326-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1844-302-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1900-412-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2008-27-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2012-340-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2072-258-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2076-301-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2148-192-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2152-196-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2172-270-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2192-392-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2204-294-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2240-328-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2284-459-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2388-464-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2420-391-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2428-805-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2440-355-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2456-319-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2492-191-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2696-463-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2808-806-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2840-18-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2936-307-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2940-85-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3044-824-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3140-181-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3148-394-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3164-436-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3188-69-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3196-235-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3216-193-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3424-447-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3684-63-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3744-96-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3896-223-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4016-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4064-154-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4200-195-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4228-437-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4268-283-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4308-438-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4316-119-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4328-833-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4336-397-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4352-238-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4376-342-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4388-7-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4512-338-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4536-809-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4596-19-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4600-828-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4616-337-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4648-180-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4692-159-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4752-832-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4784-335-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4884-829-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4904-444-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4920-413-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4932-807-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4936-42-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4948-252-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4952-416-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5008-95-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5012-388-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5024-45-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5072-131-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5096-97-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5100-237-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5116-396-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5136-836-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/15568-2751-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/16056-2704-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads