55e9596ceecf4f5f318d48ca39604589e0531e25c7f9f6f1b124b70478b80bc7

Analysis

max time kernel
120s
max time network
107s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19/09/2024, 03:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

55e9596ceecf4f5f318d48ca39604589e0531e25c7f9f6f1b124b70478b80bc7N.exe
Size

468KB
MD5

e39704cd58d28e727a81c07e2b4153b0
SHA1

515f5ecad781c9f049df086260e2226f8b270202
SHA256

55e9596ceecf4f5f318d48ca39604589e0531e25c7f9f6f1b124b70478b80bc7
SHA512

10a8b9588c51168c3a42dd1521fce5e4493036303c617dcc7f263d1de4ecfd73990cf5301b920a7168f72f1d6f427282afb46e3e494da8d42343901429f08de1
SSDEEP

3072:08ACog5dPpXUM7YbPzijkx8/9CbCt4pCndHeiVoXnoBJJeG3RXlt:081om5UMIPejkxQEBHno3EG3R

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
640	Unicorn-10304.exe
3208	Unicorn-58016.exe
5088	Unicorn-5094.exe
2380	Unicorn-21408.exe
3992	Unicorn-34022.exe
3824	Unicorn-47758.exe
2700	Unicorn-23815.exe
3328	Unicorn-40640.exe
3324	Unicorn-34317.exe
688	Unicorn-40448.exe
2396	Unicorn-37110.exe
1020	Unicorn-29265.exe
1700	Unicorn-23655.exe
4628	Unicorn-31009.exe
2248	Unicorn-24878.exe
3972	Unicorn-24896.exe
4940	Unicorn-56151.exe
3764	Unicorn-10479.exe
3532	Unicorn-23286.exe
4204	Unicorn-26048.exe
1088	Unicorn-58647.exe
4320	Unicorn-58912.exe
3364	Unicorn-58912.exe
3568	Unicorn-9062.exe
2304	Unicorn-39326.exe
3952	Unicorn-36525.exe
2968	Unicorn-27169.exe
224	Unicorn-10832.exe
4324	Unicorn-51159.exe
4316	Unicorn-21558.exe
1596	Unicorn-21440.exe
3184	Unicorn-34438.exe
4764	Unicorn-35974.exe
2012	Unicorn-55840.exe
2720	Unicorn-46240.exe
4256	Unicorn-12206.exe
636	Unicorn-44247.exe
5004	Unicorn-41646.exe
4748	Unicorn-46624.exe
2608	Unicorn-7702.exe
1084	Unicorn-16448.exe
2460	Unicorn-49312.exe
4280	Unicorn-43182.exe
1468	Unicorn-21409.exe
3188	Unicorn-32784.exe
3712	Unicorn-16064.exe
4868	Unicorn-16064.exe
4640	Unicorn-29062.exe
4752	Unicorn-39998.exe
2172	Unicorn-48663.exe
2208	Unicorn-61543.exe
4808	Unicorn-61543.exe
3560	Unicorn-24336.exe
1044	Unicorn-56816.exe
2872	Unicorn-56816.exe
2224	Unicorn-40480.exe
5012	Unicorn-10495.exe
2252	Unicorn-39638.exe
4368	Unicorn-1373.exe
3428	Unicorn-4173.exe
1624	Unicorn-4173.exe
4020	Unicorn-55975.exe
4008	Unicorn-55975.exe
4072	Unicorn-23302.exe

Program crash 5 IoCs

pid	pid_target	Process	procid_target
8044	6936	WerFault.exe	298
15860	13984	WerFault.exe	679
15868	12492	WerFault.exe	640
15744	7396	WerFault.exe	341
4760	14412	WerFault.exe	690

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40550.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32957.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10832.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29440.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3533.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18628.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29437.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5158.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-831.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34017.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11263.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59432.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9142.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48493.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60030.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40078.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48493.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43703.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56720.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44661.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44625.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45320.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9837.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12678.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15828.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44028.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40448.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3911.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36989.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28461.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12864.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63488.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32928.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52920.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21440.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16896.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24887.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32164.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-639.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57607.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32259.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65316.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16358.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44028.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28295.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39280.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8238.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10499.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48455.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47136.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27430.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27046.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25318.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19028.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65029.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31552.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1830.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4176.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18362.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25783.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8884.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61543.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65029.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48493.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun	OfficeClickToRun.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	OfficeClickToRun.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	OfficeClickToRun.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\FirstSession\officeclicktorun	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\ExternalFeatureOverrides\officeclicktorun	OfficeClickToRun.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun	OfficeClickToRun.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages\en-US = "2"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages\en-US = "1"	OfficeClickToRun.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentEcs\Overrides	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData	OfficeClickToRun.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentEcs\officeclicktorun\Overrides	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentEcs\all\Overrides	OfficeClickToRun.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentEcs\Overrides	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\TrustCenter\Experimentation	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentEcs\all\Overrides	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSCategoriesSeverities = "1329 10,1329 50,1329 15,1329 100,1329 6"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\FirstSession\officeclicktorun	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData	OfficeClickToRun.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages\en-US = "1"	OfficeClickToRun.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	OfficeClickToRun.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	OfficeClickToRun.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\TrustCenter\Experimentation	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\ExternalFeatureOverrides\officeclicktorun	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages\en-US = "2"	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSTagIds0 = "5804129,17110992,7202269,41484365,17110988,7153487,39965824,17962391,508368333,17962392,3462423,3702920,3700754,3965062,4297094,7153421,18716193,7153435,7202265,20502174,6308191,18407617"	OfficeClickToRun.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	12572	dwm.exe
Token: SeChangeNotifyPrivilege	12572	dwm.exe
Token: 33	12572	dwm.exe
Token: SeIncBasePriorityPrivilege	12572	dwm.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
4612	55e9596ceecf4f5f318d48ca39604589e0531e25c7f9f6f1b124b70478b80bc7N.exe
640	Unicorn-10304.exe
3208	Unicorn-58016.exe
5088	Unicorn-5094.exe
3992	Unicorn-34022.exe
2380	Unicorn-21408.exe
3824	Unicorn-47758.exe
2700	Unicorn-23815.exe
3328	Unicorn-40640.exe
688	Unicorn-40448.exe
2396	Unicorn-37110.exe
3324	Unicorn-34317.exe
1700	Unicorn-23655.exe
1020	Unicorn-29265.exe
4628	Unicorn-31009.exe
2248	Unicorn-24878.exe
3972	Unicorn-24896.exe
4940	Unicorn-56151.exe
3764	Unicorn-10479.exe
3532	Unicorn-23286.exe
3952	Unicorn-36525.exe
1088	Unicorn-58647.exe
3568	Unicorn-9062.exe
4320	Unicorn-58912.exe
3364	Unicorn-58912.exe
2304	Unicorn-39326.exe
4204	Unicorn-26048.exe
2968	Unicorn-27169.exe
4324	Unicorn-51159.exe
4316	Unicorn-21558.exe
1596	Unicorn-21440.exe
3184	Unicorn-34438.exe
4764	Unicorn-35974.exe
2012	Unicorn-55840.exe
2720	Unicorn-46240.exe
4256	Unicorn-12206.exe
636	Unicorn-44247.exe
5004	Unicorn-41646.exe
4748	Unicorn-46624.exe
2608	Unicorn-7702.exe
1084	Unicorn-16448.exe
1468	Unicorn-21409.exe
2460	Unicorn-49312.exe
4868	Unicorn-16064.exe
4280	Unicorn-43182.exe
3188	Unicorn-32784.exe
4752	Unicorn-39998.exe
2208	Unicorn-61543.exe
3712	Unicorn-16064.exe
4640	Unicorn-29062.exe
4808	Unicorn-61543.exe
2172	Unicorn-48663.exe
3560	Unicorn-24336.exe
2872	Unicorn-56816.exe
1044	Unicorn-56816.exe
5012	Unicorn-10495.exe
3428	Unicorn-4173.exe
1624	Unicorn-4173.exe
4072	Unicorn-23302.exe
2252	Unicorn-39638.exe
2224	Unicorn-40480.exe
4368	Unicorn-1373.exe
4020	Unicorn-55975.exe
4008	Unicorn-55975.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4612 wrote to memory of 640	4612	55e9596ceecf4f5f318d48ca39604589e0531e25c7f9f6f1b124b70478b80bc7N.exe	86
PID 4612 wrote to memory of 640	4612	55e9596ceecf4f5f318d48ca39604589e0531e25c7f9f6f1b124b70478b80bc7N.exe	86
PID 4612 wrote to memory of 640	4612	55e9596ceecf4f5f318d48ca39604589e0531e25c7f9f6f1b124b70478b80bc7N.exe	86
PID 640 wrote to memory of 3208	640	Unicorn-10304.exe	89
PID 640 wrote to memory of 3208	640	Unicorn-10304.exe	89
PID 640 wrote to memory of 3208	640	Unicorn-10304.exe	89
PID 4612 wrote to memory of 5088	4612	55e9596ceecf4f5f318d48ca39604589e0531e25c7f9f6f1b124b70478b80bc7N.exe	90
PID 4612 wrote to memory of 5088	4612	55e9596ceecf4f5f318d48ca39604589e0531e25c7f9f6f1b124b70478b80bc7N.exe	90
PID 4612 wrote to memory of 5088	4612	55e9596ceecf4f5f318d48ca39604589e0531e25c7f9f6f1b124b70478b80bc7N.exe	90
PID 3208 wrote to memory of 2380	3208	Unicorn-58016.exe	92
PID 3208 wrote to memory of 2380	3208	Unicorn-58016.exe	92
PID 3208 wrote to memory of 2380	3208	Unicorn-58016.exe	92
PID 640 wrote to memory of 3992	640	Unicorn-10304.exe	93
PID 640 wrote to memory of 3992	640	Unicorn-10304.exe	93
PID 640 wrote to memory of 3992	640	Unicorn-10304.exe	93
PID 4612 wrote to memory of 3824	4612	55e9596ceecf4f5f318d48ca39604589e0531e25c7f9f6f1b124b70478b80bc7N.exe	94
PID 4612 wrote to memory of 3824	4612	55e9596ceecf4f5f318d48ca39604589e0531e25c7f9f6f1b124b70478b80bc7N.exe	94
PID 4612 wrote to memory of 3824	4612	55e9596ceecf4f5f318d48ca39604589e0531e25c7f9f6f1b124b70478b80bc7N.exe	94
PID 5088 wrote to memory of 2700	5088	Unicorn-5094.exe	97
PID 5088 wrote to memory of 2700	5088	Unicorn-5094.exe	97
PID 5088 wrote to memory of 2700	5088	Unicorn-5094.exe	97
PID 3992 wrote to memory of 3328	3992	Unicorn-34022.exe	98
PID 3992 wrote to memory of 3328	3992	Unicorn-34022.exe	98
PID 3992 wrote to memory of 3328	3992	Unicorn-34022.exe	98
PID 640 wrote to memory of 3324	640	Unicorn-10304.exe	99
PID 640 wrote to memory of 3324	640	Unicorn-10304.exe	99
PID 640 wrote to memory of 3324	640	Unicorn-10304.exe	99
PID 2380 wrote to memory of 688	2380	Unicorn-21408.exe	100
PID 2380 wrote to memory of 688	2380	Unicorn-21408.exe	100
PID 2380 wrote to memory of 688	2380	Unicorn-21408.exe	100
PID 3208 wrote to memory of 2396	3208	Unicorn-58016.exe	101
PID 3208 wrote to memory of 2396	3208	Unicorn-58016.exe	101
PID 3208 wrote to memory of 2396	3208	Unicorn-58016.exe	101
PID 3824 wrote to memory of 1020	3824	Unicorn-47758.exe	102
PID 3824 wrote to memory of 1020	3824	Unicorn-47758.exe	102
PID 3824 wrote to memory of 1020	3824	Unicorn-47758.exe	102
PID 4612 wrote to memory of 1700	4612	55e9596ceecf4f5f318d48ca39604589e0531e25c7f9f6f1b124b70478b80bc7N.exe	103
PID 4612 wrote to memory of 1700	4612	55e9596ceecf4f5f318d48ca39604589e0531e25c7f9f6f1b124b70478b80bc7N.exe	103
PID 4612 wrote to memory of 1700	4612	55e9596ceecf4f5f318d48ca39604589e0531e25c7f9f6f1b124b70478b80bc7N.exe	103
PID 2700 wrote to memory of 4628	2700	Unicorn-23815.exe	104
PID 2700 wrote to memory of 4628	2700	Unicorn-23815.exe	104
PID 2700 wrote to memory of 4628	2700	Unicorn-23815.exe	104
PID 5088 wrote to memory of 2248	5088	Unicorn-5094.exe	105
PID 5088 wrote to memory of 2248	5088	Unicorn-5094.exe	105
PID 5088 wrote to memory of 2248	5088	Unicorn-5094.exe	105
PID 3328 wrote to memory of 3972	3328	Unicorn-40640.exe	106
PID 3328 wrote to memory of 3972	3328	Unicorn-40640.exe	106
PID 3328 wrote to memory of 3972	3328	Unicorn-40640.exe	106
PID 3992 wrote to memory of 4940	3992	Unicorn-34022.exe	107
PID 3992 wrote to memory of 4940	3992	Unicorn-34022.exe	107
PID 3992 wrote to memory of 4940	3992	Unicorn-34022.exe	107
PID 688 wrote to memory of 3764	688	Unicorn-40448.exe	108
PID 688 wrote to memory of 3764	688	Unicorn-40448.exe	108
PID 688 wrote to memory of 3764	688	Unicorn-40448.exe	108
PID 2380 wrote to memory of 3532	2380	Unicorn-21408.exe	109
PID 2380 wrote to memory of 3532	2380	Unicorn-21408.exe	109
PID 2380 wrote to memory of 3532	2380	Unicorn-21408.exe	109
PID 3324 wrote to memory of 4204	3324	Unicorn-34317.exe	110
PID 3324 wrote to memory of 4204	3324	Unicorn-34317.exe	110
PID 3324 wrote to memory of 4204	3324	Unicorn-34317.exe	110
PID 640 wrote to memory of 1088	640	Unicorn-10304.exe	111
PID 640 wrote to memory of 1088	640	Unicorn-10304.exe	111
PID 640 wrote to memory of 1088	640	Unicorn-10304.exe	111
PID 2396 wrote to memory of 3364	2396	Unicorn-37110.exe	112

C:\Users\Admin\AppData\Local\Temp\55e9596ceecf4f5f318d48ca39604589e0531e25c7f9f6f1b124b70478b80bc7N.exe
"C:\Users\Admin\AppData\Local\Temp\55e9596ceecf4f5f318d48ca39604589e0531e25c7f9f6f1b124b70478b80bc7N.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4612
- C:\Users\Admin\AppData\Local\Temp\Unicorn-10304.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-10304.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:640
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58016.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58016.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21408.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21408.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40448.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10479.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46240.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12031.exe
        8⤵
        
        PID:3284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5231.exe
        9⤵
        
        PID:5336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31392.exe
        10⤵
        
        PID:7844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7332.exe
        11⤵
        
        PID:16296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40071.exe
        10⤵
        
        PID:11388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30619.exe
        10⤵
        
        PID:1664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19028.exe
        10⤵
        
        PID:4456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45320.exe
        9⤵
        
        PID:8892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32909.exe
        9⤵
        
        PID:12700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57387.exe
        9⤵
        
        PID:15540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57726.exe
        9⤵
        
        PID:16540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46206.exe
        8⤵
        
        PID:6940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38364.exe
        9⤵
        
        PID:13752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62360.exe
        8⤵
        
        PID:10300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4211.exe
        8⤵
        
        PID:15940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54645.exe
        8⤵
        
        PID:6140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46520.exe
        7⤵
        
        PID:1612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48656.exe
        8⤵
        
        PID:6072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61345.exe
        9⤵
        
        PID:7564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16564.exe
        10⤵
        
        PID:17176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19926.exe
        9⤵
        
        PID:11644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5639.exe
        8⤵
        
        PID:8556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49691.exe
        8⤵
        
        PID:14752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16358.exe
        8⤵
        
        PID:14896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-637.exe
        7⤵
        
        PID:5692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33696.exe
        8⤵
        
        PID:7392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4893.exe
        9⤵
        
        PID:14636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41607.exe
        8⤵
        
        PID:11580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41035.exe
        8⤵
        
        PID:13344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19028.exe
        8⤵
        
        PID:4812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50839.exe
        7⤵
        
        PID:8484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38335.exe
        7⤵
        
        PID:12472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10972.exe
        7⤵
        
        PID:5976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44247.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11455.exe
        7⤵
        
        PID:2444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31552.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:2096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53457.exe
        9⤵
        
        PID:7764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3206.exe
        9⤵
        
        PID:11824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64830.exe
        9⤵
        
        PID:14196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52920.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:7668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49691.exe
        8⤵
        
        PID:14792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16358.exe
        8⤵
        
        PID:14940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57784.exe
        7⤵
        
        PID:5640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18320.exe
        8⤵
        
        PID:7120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40384.exe
        9⤵
        
        PID:11284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56590.exe
        9⤵
        
        PID:15716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33293.exe
        8⤵
        
        PID:12852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1118.exe
        7⤵
        
        PID:7572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47000.exe
        7⤵
        
        PID:12492
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 12492 -s 456
        8⤵
        Program crash
        
        PID:15868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15974.exe
        7⤵
        
        PID:5172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5133.exe
        6⤵
        
        PID:5080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33959.exe
        7⤵
        
        PID:6704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61729.exe
        8⤵
        
        PID:7456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48209.exe
        9⤵
        
        PID:10820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64756.exe
        9⤵
        
        PID:16028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65029.exe
        9⤵
        
        PID:4396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41607.exe
        8⤵
        
        PID:11548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38164.exe
        8⤵
        
        PID:3964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48493.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19758.exe
        7⤵
        
        PID:8680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36989.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47000.exe
        7⤵
        
        PID:12532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19763.exe
        7⤵
        
        PID:5932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58775.exe
        6⤵
        
        PID:5632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3719.exe
        7⤵
        
        PID:5240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38228.exe
        8⤵
        
        PID:13468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21796.exe
        8⤵
        
        PID:15548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52894.exe
        7⤵
        
        PID:12360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15629.exe
        7⤵
        
        PID:3888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59432.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19229.exe
        7⤵
        
        PID:5016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14451.exe
        6⤵
        
        PID:13812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49849.exe
        6⤵
        
        PID:13716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21627.exe
        6⤵
        
        PID:16360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9837.exe
        6⤵
        
        PID:5900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23286.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23302.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3533.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28816.exe
        8⤵
        
        PID:7212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35850.exe
        8⤵
        
        PID:13700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25627.exe
        8⤵
        
        PID:13260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19035.exe
        8⤵
        
        PID:4356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63304.exe
        7⤵
        
        PID:10412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17393.exe
        7⤵
        
        PID:13452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38693.exe
        7⤵
        
        PID:15408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48302.exe
        6⤵
        
        PID:5280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31392.exe
        7⤵
        
        PID:7856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65149.exe
        8⤵
        
        PID:15832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40071.exe
        7⤵
        
        PID:9580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8126.exe
        6⤵
        
        PID:9168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30250.exe
        6⤵
        
        PID:13672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9228.exe
        6⤵
        
        PID:3228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41646.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11263.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52408.exe
        7⤵
        
        PID:5700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16630.exe
        8⤵
        
        PID:8420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49691.exe
        8⤵
        
        PID:14736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20470.exe
        7⤵
        
        PID:11116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59230.exe
        7⤵
        
        PID:10692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63975.exe
        6⤵
        
        PID:6864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48081.exe
        7⤵
        
        PID:8668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18628.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:2684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30502.exe
        7⤵
        
        PID:11944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13082.exe
        7⤵
        
        PID:15284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4813.exe
        6⤵
        
        PID:9784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37963.exe
        6⤵
        
        PID:13476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8634.exe
        6⤵
        
        PID:16296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45459.exe
        6⤵
        
        PID:2436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60007.exe
        5⤵
        
        PID:3608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64032.exe
        6⤵
        
        PID:5192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51952.exe
        7⤵
        
        PID:5812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32656.exe
        8⤵
        
        PID:9616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34179.exe
        8⤵
        
        PID:14132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59307.exe
        8⤵
        
        PID:13344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62967.exe
        7⤵
        
        PID:10848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12678.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48654.exe
        6⤵
        
        PID:11312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48455.exe
        6⤵
        
        PID:15452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40510.exe
        5⤵
        
        PID:6424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65216.exe
        6⤵
        
        PID:8080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44753.exe
        7⤵
        
        PID:11732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57092.exe
        7⤵
        
        PID:15472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24212.exe
        7⤵
        
        PID:5148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33293.exe
        6⤵
        
        PID:12612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48493.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24870.exe
        5⤵
        
        PID:9068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47168.exe
        5⤵
        
        PID:12736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9837.exe
        5⤵
        
        PID:14504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37110.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37110.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58912.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16064.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9408.exe
        7⤵
        
        PID:4660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13311.exe
        8⤵
        
        PID:6980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3055.exe
        9⤵
        
        PID:9324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56720.exe
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:12452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56590.exe
        10⤵
        
        PID:13340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42674.exe
        9⤵
        
        PID:14900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15629.exe
        9⤵
        
        PID:2272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24103.exe
        8⤵
        
        PID:10128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59572.exe
        8⤵
        
        PID:16344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43487.exe
        7⤵
        
        PID:8784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6678.exe
        7⤵
        
        PID:12508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65495.exe
        6⤵
        
        PID:5360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6352.exe
        7⤵
        
        PID:5528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48081.exe
        8⤵
        
        PID:8608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27046.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:11292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8113.exe
        8⤵
        
        PID:15400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56590.exe
        8⤵
        
        PID:5092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56615.exe
        7⤵
        
        PID:9812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32097.exe
        7⤵
        
        PID:13528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12573.exe
        6⤵
        
        PID:7216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12287.exe
        7⤵
        
        PID:9132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47265.exe
        8⤵
        
        PID:12432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56590.exe
        8⤵
        
        PID:15464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35850.exe
        7⤵
        
        PID:13708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10499.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:15636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65029.exe
        7⤵
        
        PID:5116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8950.exe
        6⤵
        
        PID:10392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64756.exe
        6⤵
        
        PID:15300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21589.exe
        6⤵
        
        PID:5488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61543.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36928.exe
        6⤵
        
        PID:4784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14463.exe
        7⤵
        
        PID:6208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57536.exe
        8⤵
        
        PID:8424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21229.exe
        9⤵
        
        PID:3200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25318.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:12000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19028.exe
        8⤵
        
        PID:13440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1830.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:9496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37073.exe
        8⤵
        
        PID:11924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15491.exe
        8⤵
        
        PID:15560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44229.exe
        8⤵
        
        PID:15524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10190.exe
        7⤵
        
        PID:13420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54183.exe
        6⤵
        
        PID:6972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55808.exe
        7⤵
        
        PID:7624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38993.exe
        8⤵
        
        PID:12348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24494.exe
        8⤵
        
        PID:14208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24887.exe
        7⤵
        
        PID:11752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64830.exe
        7⤵
        
        PID:14672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3911.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33905.exe
        6⤵
        
        PID:13484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14563.exe
        6⤵
        
        PID:14584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30029.exe
        5⤵
        
        PID:5388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3664.exe
        6⤵
        
        PID:516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7951.exe
        7⤵
        
        PID:8488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1167.exe
        8⤵
        
        PID:11936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8157.exe
        8⤵
        
        PID:4552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11094.exe
        7⤵
        
        PID:12188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47925.exe
        7⤵
        
        PID:5508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55608.exe
        6⤵
        
        PID:9624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28993.exe
        7⤵
        
        PID:11664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48635.exe
        7⤵
        
        PID:4936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35563.exe
        7⤵
        
        PID:5128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18685.exe
        6⤵
        
        PID:12992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47416.exe
        5⤵
        
        PID:6924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44088.exe
        6⤵
        
        PID:10332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60827.exe
        6⤵
        
        PID:3740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17197.exe
        5⤵
        
        PID:10312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17194.exe
        5⤵
        
        PID:532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31570.exe
        5⤵
        
        PID:15904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50018.exe
        5⤵
        
        PID:12596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42893.exe
        5⤵
        
        PID:4068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39326.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39326.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21409.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39969.exe
        6⤵
        
        PID:4636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14271.exe
        7⤵
        
        PID:6228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39280.exe
        8⤵
        
        PID:7716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24887.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:11740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9130.exe
        8⤵
        
        PID:16220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32020.exe
        8⤵
        
        PID:15852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32164.exe
        8⤵
        
        PID:3092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6023.exe
        7⤵
        
        PID:8500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49691.exe
        7⤵
        
        PID:14776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26177.exe
        7⤵
        
        PID:14572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55143.exe
        6⤵
        
        PID:6720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-720.exe
        7⤵
        
        PID:9052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12881.exe
        7⤵
        
        PID:15224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2893.exe
        6⤵
        
        PID:10460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26059.exe
        6⤵
        
        PID:15368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59300.exe
        6⤵
        
        PID:3960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31094.exe
        5⤵
        
        PID:1004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4432.exe
        6⤵
        
        PID:1240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26400.exe
        7⤵
        
        PID:8656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36989.exe
        8⤵
        
        PID:15836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61447.exe
        7⤵
        
        PID:10984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5123.exe
        7⤵
        
        PID:15528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65029.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23942.exe
        6⤵
        
        PID:9856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32097.exe
        6⤵
        
        PID:13520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48493.exe
        6⤵
        
        PID:1464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52350.exe
        5⤵
        
        PID:6596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57344.exe
        6⤵
        
        PID:8412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47265.exe
        7⤵
        
        PID:12424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8157.exe
        7⤵
        
        PID:1368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25318.exe
        6⤵
        
        PID:11992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13889.exe
        6⤵
        
        PID:16320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27684.exe
        6⤵
        
        PID:17284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6983.exe
        5⤵
        
        PID:7632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26308.exe
        6⤵
        
        PID:14412
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 14412 -s 460
        7⤵
        Program crash
        
        PID:4760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8157.exe
        6⤵
        
        PID:1536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38335.exe
        5⤵
        
        PID:13976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3363.exe
        5⤵
        
        PID:2908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62804.exe
        5⤵
        
        PID:5800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48663.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48663.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53264.exe
        5⤵
        
        PID:5176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63856.exe
        6⤵
        
        PID:6160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44625.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24887.exe
        7⤵
        
        PID:11776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48493.exe
        7⤵
        
        PID:9196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35623.exe
        6⤵
        
        PID:9028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49438.exe
        6⤵
        
        PID:12724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62580.exe
        6⤵
        
        PID:16228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12112.exe
        5⤵
        
        PID:6060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3024.exe
        6⤵
        
        PID:9276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32259.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:13868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6970.exe
        6⤵
        
        PID:6696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64830.exe
        6⤵
        
        PID:2752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8861.exe
        5⤵
        
        PID:10648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44028.exe
        5⤵
        
        PID:6696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10893.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10893.exe
      4⤵
      PID:5344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2512.exe
        5⤵
        
        PID:6676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31120.exe
        6⤵
        
        PID:9076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65316.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:13784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25627.exe
        6⤵
        
        PID:15792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54853.exe
        6⤵
        
        PID:16556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61431.exe
        5⤵
        
        PID:10596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48455.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27223.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27223.exe
      4⤵
      PID:7744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54478.exe
        5⤵
        
        PID:16328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51537.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51537.exe
      4⤵
      PID:11068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63590.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63590.exe
      4⤵
      PID:9980
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34022.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34022.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40640.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40640.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24896.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21440.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40480.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33441.exe
        8⤵
        
        PID:5904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46529.exe
        9⤵
        
        PID:6988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19392.exe
        10⤵
        
        PID:9380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42674.exe
        10⤵
        
        PID:14908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28948.exe
        10⤵
        
        PID:4092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64830.exe
        10⤵
        
        PID:14632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24103.exe
        9⤵
        
        PID:9232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44004.exe
        9⤵
        
        PID:16364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47847.exe
        8⤵
        
        PID:7196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4176.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:10200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53604.exe
        9⤵
        
        PID:11356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28461.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:10996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11319.exe
        8⤵
        
        PID:13492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2910.exe
        7⤵
        
        PID:6252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65136.exe
        8⤵
        
        PID:10020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38538.exe
        8⤵
        
        PID:14392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15828.exe
        8⤵
        
        PID:10116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64072.exe
        7⤵
        
        PID:10628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33729.exe
        7⤵
        
        PID:15144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55975.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35361.exe
        7⤵
        
        PID:5964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13311.exe
        8⤵
        
        PID:6224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60912.exe
        9⤵
        
        PID:8832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65316.exe
        9⤵
        
        PID:13780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35563.exe
        9⤵
        
        PID:7108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37974.exe
        8⤵
        
        PID:10560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48455.exe
        8⤵
        
        PID:1972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32823.exe
        7⤵
        
        PID:7792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21067.exe
        8⤵
        
        PID:5500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53807.exe
        7⤵
        
        PID:10256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60030.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54456.exe
        7⤵
        
        PID:9240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19393.exe
        8⤵
        
        PID:10448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64795.exe
        8⤵
        
        PID:11356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49691.exe
        7⤵
        
        PID:14744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18797.exe
        7⤵
        
        PID:16344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17590.exe
        6⤵
        
        PID:8476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38335.exe
        6⤵
        
        PID:12584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10780.exe
        6⤵
        
        PID:5844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34438.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10495.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3533.exe
        7⤵
        
        PID:7140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3792.exe
        8⤵
        
        PID:8516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53931.exe
        8⤵
        
        PID:15344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25252.exe
        8⤵
        
        PID:16852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34327.exe
        7⤵
        
        PID:10988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38693.exe
        7⤵
        
        PID:3300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58952.exe
        6⤵
        
        PID:7300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-720.exe
        7⤵
        
        PID:9296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12881.exe
        7⤵
        
        PID:15216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60340.exe
        7⤵
        
        PID:16300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16358.exe
        7⤵
        
        PID:14712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48910.exe
        6⤵
        
        PID:10552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-858.exe
        6⤵
        
        PID:15288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15234.exe
        6⤵
        
        PID:15420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9837.exe
        6⤵
        
        PID:6004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4173.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61344.exe
        6⤵
        
        PID:5880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2128.exe
        7⤵
        
        PID:7248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65136.exe
        8⤵
        
        PID:8984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36099.exe
        8⤵
        
        PID:14376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57099.exe
        8⤵
        
        PID:13808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65029.exe
        8⤵
        
        PID:4964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56142.exe
        7⤵
        
        PID:11232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43622.exe
        6⤵
        
        PID:7876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46912.exe
        7⤵
        
        PID:10120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57476.exe
        7⤵
        
        PID:15808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8157.exe
        7⤵
        
        PID:3580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44312.exe
        6⤵
        
        PID:12564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16358.exe
        6⤵
        
        PID:14692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59320.exe
        5⤵
        
        PID:5252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32928.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34416.exe
        7⤵
        
        PID:11628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26933.exe
        7⤵
        
        PID:5540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33293.exe
        6⤵
        
        PID:12588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18797.exe
        6⤵
        
        PID:15864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59432.exe
        5⤵
        
        PID:8212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14451.exe
        5⤵
        
        PID:13820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56162.exe
        5⤵
        
        PID:15736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42893.exe
        5⤵
        
        PID:1788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56151.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56151.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55840.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25872.exe
        6⤵
        
        PID:4772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20561.exe
        7⤵
        
        PID:6132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59648.exe
        8⤵
        
        PID:8548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45868.exe
        9⤵
        
        PID:17224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27430.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:12196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59307.exe
        8⤵
        
        PID:13732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1830.exe
        7⤵
        
        PID:9488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12467.exe
        7⤵
        
        PID:15012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49336.exe
        6⤵
        
        PID:5184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37648.exe
        7⤵
        
        PID:9684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18362.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:13512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48493.exe
        7⤵
        
        PID:7116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16925.exe
        6⤵
        
        PID:9464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43547.exe
        6⤵
        
        PID:12632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25783.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:16664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8694.exe
        5⤵
        
        PID:5008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48656.exe
        6⤵
        
        PID:6092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63488.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56603.exe
        7⤵
        
        PID:14168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44028.exe
        7⤵
        
        PID:2688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45320.exe
        6⤵
        
        PID:8900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32909.exe
        6⤵
        
        PID:12808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48493.exe
        6⤵
        
        PID:2820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18893.exe
        5⤵
        
        PID:5780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-639.exe
        6⤵
        
        PID:7552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41607.exe
        6⤵
        
        PID:11556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2202.exe
        6⤵
        
        PID:13452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48493.exe
        6⤵
        
        PID:1584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6983.exe
        5⤵
        
        PID:7516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38335.exe
        5⤵
        
        PID:13984
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 13984 -s 436
        6⤵
        Program crash
        
        PID:15860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11164.exe
        5⤵
        
        PID:2084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12206.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12206.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47169.exe
        5⤵
        
        PID:3996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21329.exe
        6⤵
        
        PID:6012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16896.exe
        7⤵
        
        PID:9124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35702.exe
        7⤵
        
        PID:12796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58251.exe
        7⤵
        
        PID:14980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5460.exe
        7⤵
        
        PID:6112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56760.exe
        6⤵
        
        PID:9444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63805.exe
        7⤵
        
        PID:15412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33322.exe
        7⤵
        
        PID:16216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21373.exe
        6⤵
        
        PID:13356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18797.exe
        6⤵
        
        PID:15892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52439.exe
        5⤵
        
        PID:5704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18320.exe
        6⤵
        
        PID:7068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49822.exe
        6⤵
        
        PID:12624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11201.exe
        6⤵
        
        PID:12292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20470.exe
        5⤵
        
        PID:10108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48861.exe
        5⤵
        
        PID:6108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28295.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28295.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33959.exe
        5⤵
        
        PID:6712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-639.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28993.exe
        7⤵
        
        PID:11604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57019.exe
        7⤵
        
        PID:15876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54795.exe
        7⤵
        
        PID:15876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41607.exe
        6⤵
        
        PID:11564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48493.exe
        6⤵
        
        PID:4028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40078.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:10800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59230.exe
        5⤵
        
        PID:14204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60271.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60271.exe
      4⤵
      PID:5272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-102.exe
        5⤵
        
        PID:9056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36989.exe
        6⤵
        
        PID:15948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41135.exe
        5⤵
        
        PID:12524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19028.exe
        5⤵
        
        PID:15904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47319.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47319.exe
      4⤵
      PID:7768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38865.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38865.exe
      4⤵
      PID:12516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9837.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9837.exe
      4⤵
      PID:5852
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34317.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34317.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26048.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26048.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49312.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12454.exe
        6⤵
        
        PID:6032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14479.exe
        7⤵
        
        PID:7912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19393.exe
        8⤵
        
        PID:11276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64795.exe
        8⤵
        
        PID:15716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8157.exe
        8⤵
        
        PID:3484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40071.exe
        7⤵
        
        PID:11396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48493.exe
        7⤵
        
        PID:3596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59055.exe
        6⤵
        
        PID:8972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38775.exe
        6⤵
        
        PID:12756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48455.exe
        6⤵
        
        PID:4012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20103.exe
        5⤵
        
        PID:4252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63856.exe
        6⤵
        
        PID:6176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50032.exe
        7⤵
        
        PID:6184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30161.exe
        8⤵
        
        PID:12960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5345.exe
        8⤵
        
        PID:15308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8157.exe
        8⤵
        
        PID:1572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41607.exe
        7⤵
        
        PID:11700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48493.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63911.exe
        6⤵
        
        PID:8220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41135.exe
        6⤵
        
        PID:12972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36094.exe
        6⤵
        
        PID:5156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3341.exe
        5⤵
        
        PID:6548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52256.exe
        6⤵
        
        PID:9420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7638.exe
        6⤵
        
        PID:13372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5123.exe
        6⤵
        
        PID:15460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43704.exe
        5⤵
        
        PID:9556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64539.exe
        5⤵
        
        PID:13628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29062.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29062.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36544.exe
        5⤵
        
        PID:5208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14463.exe
        6⤵
        
        PID:6200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43424.exe
        7⤵
        
        PID:9984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54094.exe
        8⤵
        
        PID:17480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33930.exe
        7⤵
        
        PID:13564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4465.exe
        7⤵
        
        PID:15424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24103.exe
        6⤵
        
        PID:9868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1802.exe
        6⤵
        
        PID:15568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60296.exe
        5⤵
        
        PID:6564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16896.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19174.exe
        6⤵
        
        PID:12820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-515.exe
        6⤵
        
        PID:15072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21412.exe
        6⤵
        
        PID:15900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7693.exe
        5⤵
        
        PID:9368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18803.exe
        5⤵
        
        PID:13884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48455.exe
        5⤵
        
        PID:4988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13693.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13693.exe
      4⤵
      PID:5352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47904.exe
        5⤵
        
        PID:6040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24096.exe
        6⤵
        
        PID:8596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10710.exe
        6⤵
        
        PID:3272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59307.exe
        6⤵
        
        PID:14256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48638.exe
        5⤵
        
        PID:9892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40340.exe
        5⤵
        
        PID:14364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14563.exe
        5⤵
        
        PID:4852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58215.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58215.exe
      4⤵
      PID:6888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60912.exe
        5⤵
        
        PID:8520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19514.exe
        5⤵
        
        PID:13756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2500.exe
        5⤵
        
        PID:1168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32957.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32957.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:10492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9837.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9837.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5600
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58647.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58647.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32784.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32784.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17027.exe
        5⤵
        
        PID:3856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64193.exe
        6⤵
        
        PID:5776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65216.exe
        7⤵
        
        PID:8072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33293.exe
        7⤵
        
        PID:12604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35092.exe
        7⤵
        
        PID:15856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45320.exe
        6⤵
        
        PID:8876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32909.exe
        6⤵
        
        PID:12864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19028.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38614.exe
        5⤵
        
        PID:6616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58880.exe
        6⤵
        
        PID:8712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30502.exe
        6⤵
        
        PID:12064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37678.exe
        5⤵
        
        PID:9848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9697.exe
        5⤵
        
        PID:14988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44028.exe
        5⤵
        
        PID:1608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16678.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16678.exe
      4⤵
      PID:5196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31978.exe
        5⤵
        
        PID:6396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29200.exe
        6⤵
        
        PID:10144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17210.exe
        6⤵
        
        PID:13584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6262.exe
        5⤵
        
        PID:10304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7965.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7965.exe
      4⤵
      PID:7964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64400.exe
        5⤵
        
        PID:12108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64795.exe
        5⤵
        
        PID:16028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24494.exe
        5⤵
        
        PID:14700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35646.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35646.exe
      4⤵
      PID:12544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59980.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59980.exe
      4⤵
      PID:16676
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39998.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39998.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39969.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39969.exe
      4⤵
      PID:1148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12927.exe
        5⤵
        
        PID:5840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60113.exe
        6⤵
        
        PID:9872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53707.exe
        6⤵
        
        PID:16324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13574.exe
        5⤵
        
        PID:10776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50696.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50696.exe
      4⤵
      PID:8032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52452.exe
        5⤵
        
        PID:15264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21786.exe
        5⤵
        
        PID:15268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48654.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48654.exe
      4⤵
      PID:10656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27419.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27419.exe
      4⤵
      PID:13732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16358.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16358.exe
      4⤵
      PID:14824
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44326.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44326.exe
    3⤵
    PID:5136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15392.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15392.exe
      4⤵
      PID:7124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29200.exe
        5⤵
        
        PID:10136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17210.exe
        5⤵
        
        PID:13592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32298.exe
        5⤵
        
        PID:16360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65029.exe
        5⤵
        
        PID:3056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4637.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4637.exe
      4⤵
      PID:7616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53908.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53908.exe
      4⤵
      PID:16320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44028.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44028.exe
      4⤵
      PID:4000
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3920.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3920.exe
    3⤵
    PID:7652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60113.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60113.exe
      4⤵
      PID:8512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53707.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53707.exe
      4⤵
      PID:16352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31389.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31389.exe
      4⤵
      PID:16600
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35605.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35605.exe
    3⤵
    PID:10744
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7394.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7394.exe
    3⤵
    PID:14960
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38862.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38862.exe
    3⤵
    PID:17188
- C:\Users\Admin\AppData\Local\Temp\Unicorn-5094.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-5094.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5088
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23815.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23815.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31009.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31009.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27169.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24336.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44432.exe
        7⤵
        
        PID:5708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5968.exe
        8⤵
        
        PID:6288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26400.exe
        9⤵
        
        PID:8640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36989.exe
        10⤵
        
        PID:1752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61447.exe
        9⤵
        
        PID:11048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38923.exe
        9⤵
        
        PID:15720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32164.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:1604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23942.exe
        8⤵
        
        PID:9840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18362.exe
        8⤵
        
        PID:14972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52955.exe
        8⤵
        
        PID:15488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23430.exe
        7⤵
        
        PID:7076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60113.exe
        8⤵
        
        PID:10092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53707.exe
        8⤵
        
        PID:16332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64830.exe
        8⤵
        
        PID:10704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32078.exe
        7⤵
        
        PID:10832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26924.exe
        7⤵
        
        PID:15644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9574.exe
        6⤵
        
        PID:5784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18304.exe
        7⤵
        
        PID:6872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5792.exe
        8⤵
        
        PID:7352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40576.exe
        9⤵
        
        PID:13272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14125.exe
        9⤵
        
        PID:864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41607.exe
        8⤵
        
        PID:11588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2202.exe
        8⤵
        
        PID:15824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48493.exe
        8⤵
        
        PID:3292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52920.exe
        7⤵
        
        PID:7684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49691.exe
        7⤵
        
        PID:14800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16358.exe
        7⤵
        
        PID:10296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23325.exe
        6⤵
        
        PID:7260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60224.exe
        7⤵
        
        PID:8856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51387.exe
        8⤵
        
        PID:13996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34017.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:13764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20417.exe
        7⤵
        
        PID:2436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48493.exe
        7⤵
        
        PID:3740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10678.exe
        6⤵
        
        PID:9776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41152.exe
        7⤵
        
        PID:13020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11210.exe
        7⤵
        
        PID:1808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32164.exe
        7⤵
        
        PID:3488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29297.exe
        6⤵
        
        PID:13456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44028.exe
        6⤵
        
        PID:15600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39638.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13679.exe
        6⤵
        
        PID:5980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30816.exe
        7⤵
        
        PID:7944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54094.exe
        8⤵
        
        PID:17488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40071.exe
        7⤵
        
        PID:11240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47020.exe
        8⤵
        
        PID:17244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45320.exe
        6⤵
        
        PID:8908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13395.exe
        7⤵
        
        PID:15964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4893.exe
        7⤵
        
        PID:14612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32909.exe
        6⤵
        
        PID:12976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48493.exe
        6⤵
        
        PID:1860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8525.exe
        5⤵
        
        PID:6168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-831.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41607.exe
        6⤵
        
        PID:11572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64830.exe
        6⤵
        
        PID:1040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17974.exe
        5⤵
        
        PID:8592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38335.exe
        5⤵
        
        PID:13968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51159.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51159.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1110.exe
        5⤵
        
        PID:5664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18081.exe
        6⤵
        
        PID:5144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20752.exe
        7⤵
        
        PID:8852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53931.exe
        7⤵
        
        PID:15336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13101.exe
        6⤵
        
        PID:10472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29633.exe
        6⤵
        
        PID:15480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16627.exe
        6⤵
        
        PID:16228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18797.exe
        6⤵
        
        PID:16356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46559.exe
        5⤵
        
        PID:7748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46720.exe
        6⤵
        
        PID:11748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18698.exe
        6⤵
        
        PID:15616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56590.exe
        6⤵
        
        PID:2584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59672.exe
        5⤵
        
        PID:8928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44028.exe
        5⤵
        
        PID:3672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4173.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4173.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5158.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48880.exe
        6⤵
        
        PID:8056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7332.exe
        7⤵
        
        PID:4568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33293.exe
        6⤵
        
        PID:12596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16791.exe
        5⤵
        
        PID:7864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46786.exe
        5⤵
        
        PID:13660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9574.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9574.exe
      4⤵
      PID:5384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61729.exe
        5⤵
        
        PID:7468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23664.exe
        6⤵
        
        PID:12652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18267.exe
        6⤵
        
        PID:5512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19926.exe
        5⤵
        
        PID:11656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64446.exe
        5⤵
        
        PID:6124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41790.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41790.exe
      4⤵
      PID:8636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4893.exe
        5⤵
        
        PID:14604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21799.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21799.exe
      4⤵
      PID:12644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5637.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5637.exe
      4⤵
      PID:5168
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24878.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24878.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10832.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10832.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56816.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29440.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51521.exe
        7⤵
        
        PID:6216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60113.exe
        8⤵
        
        PID:9880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20739.exe
        8⤵
        
        PID:6236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5450.exe
        8⤵
        
        PID:12972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13101.exe
        7⤵
        
        PID:10752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54478.exe
        6⤵
        
        PID:8796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38775.exe
        6⤵
        
        PID:12788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17654.exe
        5⤵
        
        PID:5412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31392.exe
        6⤵
        
        PID:7900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8884.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:17544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38447.exe
        6⤵
        
        PID:12556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59055.exe
        5⤵
        
        PID:8964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55303.exe
        5⤵
        
        PID:12780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11427.exe
        5⤵
        
        PID:14372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14563.exe
        5⤵
        
        PID:1140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55975.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55975.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61344.exe
        5⤵
        
        PID:5872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51521.exe
        6⤵
        
        PID:6420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52417.exe
        7⤵
        
        PID:8868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24628.exe
        8⤵
        
        PID:15480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65124.exe
        7⤵
        
        PID:13848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58194.exe
        7⤵
        
        PID:12292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65029.exe
        7⤵
        
        PID:14688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60663.exe
        6⤵
        
        PID:10916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36989.exe
        7⤵
        
        PID:15660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16358.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:14916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43815.exe
        5⤵
        
        PID:7828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12864.exe
        6⤵
        
        PID:12324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24494.exe
        6⤵
        
        PID:10700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53807.exe
        5⤵
        
        PID:11248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16358.exe
        5⤵
        
        PID:12488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19630.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19630.exe
      4⤵
      PID:5276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40550.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32909.exe
        5⤵
        
        PID:12888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12803.exe
        5⤵
        
        PID:3016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48493.exe
        5⤵
        
        PID:2756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64920.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64920.exe
      4⤵
      PID:8952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30109.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30109.exe
      4⤵
      PID:12708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31875.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31875.exe
      4⤵
      PID:15888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44661.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44661.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:14944
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21558.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21558.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56816.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56816.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29440.exe
        5⤵
        
        PID:5792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2512.exe
        6⤵
        
        PID:6516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17057.exe
        7⤵
        
        PID:8380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16781.exe
        8⤵
        
        PID:15908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19514.exe
        7⤵
        
        PID:13748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54503.exe
        6⤵
        
        PID:10512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28436.exe
        6⤵
        
        PID:13880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14122.exe
        6⤵
        
        PID:15260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43487.exe
        5⤵
        
        PID:8776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57607.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10972.exe
        5⤵
        
        PID:17136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28790.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28790.exe
      4⤵
      PID:6080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24096.exe
        5⤵
        
        PID:8572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14223.exe
        6⤵
        
        PID:11056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18698.exe
        6⤵
        
        PID:15624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56590.exe
        6⤵
        
        PID:4928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44535.exe
        5⤵
        
        PID:12116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12586.exe
        5⤵
        
        PID:14428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4958.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4958.exe
      4⤵
      PID:9452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27239.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27239.exe
      4⤵
      PID:13348
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1373.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1373.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19025.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19025.exe
      4⤵
      PID:5996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49648.exe
        5⤵
        
        PID:7396
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7396 -s 648
        6⤵
        Program crash
        
        PID:15744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25271.exe
        5⤵
        
        PID:11632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64830.exe
        5⤵
        
        PID:14728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63527.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63527.exe
      4⤵
      PID:8432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21229.exe
        5⤵
        
        PID:1328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49691.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49691.exe
      4⤵
      PID:14808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48455.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48455.exe
      4⤵
      PID:15376
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43735.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43735.exe
    3⤵
    PID:5368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19392.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19392.exe
      4⤵
      PID:9404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52766.exe
        5⤵
        
        PID:17384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12497.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12497.exe
      4⤵
      PID:15000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48493.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48493.exe
      4⤵
      PID:2264
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35569.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35569.exe
    3⤵
    PID:8792
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43538.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43538.exe
    3⤵
    PID:13340
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29437.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29437.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:16716
- C:\Users\Admin\AppData\Local\Temp\Unicorn-47758.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-47758.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3824
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29265.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29265.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35974.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35974.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25872.exe
        5⤵
        
        PID:1152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32128.exe
        6⤵
        
        PID:6052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14479.exe
        7⤵
        
        PID:7924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7332.exe
        8⤵
        
        PID:880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18803.exe
        7⤵
        
        PID:16308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44834.exe
        7⤵
        
        PID:16224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45320.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32909.exe
        6⤵
        
        PID:12896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28038.exe
        5⤵
        
        PID:6024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5712.exe
        6⤵
        
        PID:9152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38006.exe
        6⤵
        
        PID:12924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19035.exe
        6⤵
        
        PID:15008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62047.exe
        5⤵
        
        PID:9412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38347.exe
        5⤵
        
        PID:13904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44028.exe
        5⤵
        
        PID:2312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5901.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5901.exe
      4⤵
      PID:3068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3648.exe
        5⤵
        
        PID:556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63296.exe
        6⤵
        
        PID:7980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46631.exe
        7⤵
        
        PID:11120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51579.exe
        7⤵
        
        PID:15724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16020.exe
        7⤵
        
        PID:13880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14726.exe
        6⤵
        
        PID:11016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20193.exe
        6⤵
        
        PID:15280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55924.exe
        6⤵
        
        PID:15376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16358.exe
        6⤵
        
        PID:14608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45320.exe
        5⤵
        
        PID:8916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32909.exe
        5⤵
        
        PID:12904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15629.exe
        5⤵
        
        PID:1128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20887.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20887.exe
      4⤵
      PID:6532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39280.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12864.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56590.exe
        6⤵
        
        PID:15852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24887.exe
        5⤵
        
        PID:11768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41406.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41406.exe
      4⤵
      PID:9060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13574.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13574.exe
      4⤵
      PID:12672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15234.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15234.exe
      4⤵
      PID:15448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9837.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9837.exe
      4⤵
      PID:2136
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9062.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9062.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16448.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16448.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35392.exe
        5⤵
        
        PID:4788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2512.exe
        6⤵
        
        PID:7048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64752.exe
        7⤵
        
        PID:9916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20174.exe
        8⤵
        
        PID:15972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22970.exe
        7⤵
        
        PID:13544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1732.exe
        7⤵
        
        PID:5544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29526.exe
        6⤵
        
        PID:10760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36530.exe
        6⤵
        
        PID:13732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18797.exe
        6⤵
        
        PID:15996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32823.exe
        5⤵
        
        PID:7784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16544.exe
        6⤵
        
        PID:11808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48548.exe
        6⤵
        
        PID:15464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24494.exe
        6⤵
        
        PID:14624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47938.exe
        5⤵
        
        PID:14160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44028.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55080.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55080.exe
      4⤵
      PID:2316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28967.exe
        5⤵
        
        PID:7004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32656.exe
        6⤵
        
        PID:9596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28993.exe
        7⤵
        
        PID:11612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4950.exe
        6⤵
        
        PID:13012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15828.exe
        6⤵
        
        PID:14708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62007.exe
        5⤵
        
        PID:11220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44028.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62334.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62334.exe
      4⤵
      PID:5220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65136.exe
        5⤵
        
        PID:9772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22586.exe
        5⤵
        
        PID:12832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65029.exe
        5⤵
        
        PID:1408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64072.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64072.exe
      4⤵
      PID:10616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5637.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5637.exe
      4⤵
      PID:4856
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43182.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43182.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36928.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36928.exe
      4⤵
      PID:3836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2512.exe
        5⤵
        
        PID:6100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28816.exe
        6⤵
        
        PID:7268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49364.exe
        6⤵
        
        PID:13636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65029.exe
        6⤵
        
        PID:3592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43703.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:10424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32823.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32823.exe
      4⤵
      PID:7800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53807.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53807.exe
      4⤵
      PID:9584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39396.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39396.exe
      4⤵
      PID:15424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48455.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48455.exe
      4⤵
      PID:15964
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36087.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36087.exe
    3⤵
    PID:5300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5968.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5968.exe
      4⤵
      PID:6280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39280.exe
        5⤵
        
        PID:7732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36989.exe
        6⤵
        
        PID:3600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24887.exe
        5⤵
        
        PID:11784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9130.exe
        5⤵
        
        PID:16232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32020.exe
        5⤵
        
        PID:15612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32164.exe
        5⤵
        
        PID:12360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35623.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35623.exe
      4⤵
      PID:6964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34445.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34445.exe
      4⤵
      PID:13280
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49550.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49550.exe
    3⤵
    PID:6608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19584.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19584.exe
      4⤵
      PID:9508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61992.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61992.exe
      4⤵
      PID:13412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17633.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17633.exe
      4⤵
      PID:1784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15828.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15828.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3588
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60823.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60823.exe
    3⤵
    PID:7952
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-65396.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-65396.exe
    3⤵
    PID:13900
- C:\Users\Admin\AppData\Local\Temp\Unicorn-23655.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-23655.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1700
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58912.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58912.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16064.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16064.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9024.exe
        5⤵
        
        PID:5224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2159.exe
        6⤵
        
        PID:6816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19584.exe
        7⤵
        
        PID:9300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42674.exe
        7⤵
        
        PID:14920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31389.exe
        7⤵
        
        PID:5944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-886.exe
        6⤵
        
        PID:10216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2129.exe
        6⤵
        
        PID:13832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25627.exe
        6⤵
        
        PID:15632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48184.exe
        5⤵
        
        PID:6936
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6936 -s 248
        6⤵
        Program crash
        
        PID:8044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41679.exe
        5⤵
        
        PID:10276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42395.exe
        5⤵
        
        PID:15380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45786.exe
        5⤵
        
        PID:3028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16294.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16294.exe
      4⤵
      PID:5396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52289.exe
        5⤵
        
        PID:6244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6799.exe
        6⤵
        
        PID:6120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46631.exe
        7⤵
        
        PID:11128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2570.exe
        7⤵
        
        PID:15712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13101.exe
        6⤵
        
        PID:10456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48455.exe
        6⤵
        
        PID:15944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9037.exe
        5⤵
        
        PID:9932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26043.exe
        5⤵
        
        PID:13572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22.exe
        5⤵
        
        PID:7148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37166.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37166.exe
      4⤵
      PID:7064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45505.exe
        5⤵
        
        PID:9388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22794.exe
        5⤵
        
        PID:15064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49127.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49127.exe
      4⤵
      PID:10768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5637.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5637.exe
      4⤵
      PID:13628
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61543.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61543.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36352.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36352.exe
      4⤵
      PID:5288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47136.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6176.exe
        6⤵
        
        PID:7136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53751.exe
        6⤵
        
        PID:11464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60660.exe
        6⤵
        
        PID:15968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15094.exe
        5⤵
        
        PID:7224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41135.exe
        5⤵
        
        PID:12836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32695.exe
        5⤵
        
        PID:15372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61064.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61064.exe
      4⤵
      PID:7088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45344.exe
        5⤵
        
        PID:10232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24494.exe
        6⤵
        
        PID:14188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-355.exe
        5⤵
        
        PID:13620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15629.exe
        5⤵
        
        PID:4216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8238.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8238.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:10376
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30029.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30029.exe
    3⤵
    PID:5376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31376.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31376.exe
      4⤵
      PID:4404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59072.exe
        5⤵
        
        PID:8624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41152.exe
        6⤵
        
        PID:13028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24494.exe
        6⤵
        
        PID:10404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45687.exe
        5⤵
        
        PID:12168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10033.exe
        5⤵
        
        PID:15752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34605.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34605.exe
      4⤵
      PID:7464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14563.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14563.exe
      4⤵
      PID:2716
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14359.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14359.exe
    3⤵
    PID:6368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6799.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6799.exe
      4⤵
      PID:7676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36989.exe
        5⤵
        
        PID:15516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24887.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24887.exe
      4⤵
      PID:11724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1732.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1732.exe
      4⤵
      PID:5456
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46559.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46559.exe
    3⤵
    PID:9020
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30102.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30102.exe
    3⤵
    PID:12768
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42893.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42893.exe
    3⤵
    PID:4444
- C:\Users\Admin\AppData\Local\Temp\Unicorn-36525.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-36525.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3952
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46624.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46624.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5952.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5952.exe
      4⤵
      PID:3548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37520.exe
        5⤵
        
        PID:5724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59072.exe
        6⤵
        
        PID:8704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30502.exe
        6⤵
        
        PID:12204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15828.exe
        6⤵
        
        PID:14680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34605.exe
        5⤵
        
        PID:9376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9914.exe
        5⤵
        
        PID:15228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60364.exe
        5⤵
        
        PID:9548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47831.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47831.exe
      4⤵
      PID:6812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38465.exe
        5⤵
        
        PID:7408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34637.exe
        5⤵
        
        PID:13252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18797.exe
        5⤵
        
        PID:5732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11725.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11725.exe
      4⤵
      PID:8440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47000.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47000.exe
      4⤵
      PID:12664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52435.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52435.exe
      4⤵
      PID:17144
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20487.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20487.exe
    3⤵
    PID:540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59040.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59040.exe
      4⤵
      PID:5824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58688.exe
        5⤵
        
        PID:8684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19229.exe
        6⤵
        
        PID:1984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30502.exe
        5⤵
        
        PID:11956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7414.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7414.exe
      4⤵
      PID:9884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18362.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18362.exe
      4⤵
      PID:14964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16358.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16358.exe
      4⤵
      PID:9316
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8494.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8494.exe
    3⤵
    PID:6540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50113.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50113.exe
      4⤵
      PID:8120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35850.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35850.exe
      4⤵
      PID:13692
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32020.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32020.exe
      4⤵
      PID:15836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65029.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65029.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:8360
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9142.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9142.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:10356
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5637.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5637.exe
    3⤵
    PID:15688
- C:\Users\Admin\AppData\Local\Temp\Unicorn-7702.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-7702.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2608
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5952.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5952.exe
    3⤵
    PID:4312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21568.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21568.exe
      4⤵
      PID:5244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53457.exe
        5⤵
        
        PID:6996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21229.exe
        6⤵
        
        PID:15672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35878.exe
        5⤵
        
        PID:11800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48493.exe
        5⤵
        
        PID:3924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52920.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52920.exe
      4⤵
      PID:7448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49691.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49691.exe
      4⤵
      PID:14768
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43991.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43991.exe
    3⤵
    PID:5592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52256.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52256.exe
      4⤵
      PID:9468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6602.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6602.exe
      4⤵
      PID:15020
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37839.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37839.exe
    3⤵
    PID:5408
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7667.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7667.exe
    3⤵
    PID:14384
- C:\Users\Admin\AppData\Local\Temp\Unicorn-26992.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-26992.exe
  2⤵
  PID:4416
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12112.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12112.exe
    3⤵
    PID:5616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53457.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53457.exe
      4⤵
      PID:7760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27073.exe
        5⤵
        
        PID:11328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24887.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24887.exe
      4⤵
      PID:11760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48493.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48493.exe
      4⤵
      PID:1568
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52920.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52920.exe
    3⤵
    PID:7388
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49691.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49691.exe
    3⤵
    PID:14784
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20282.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20282.exe
    3⤵
    PID:15584
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32503.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32503.exe
    3⤵
    PID:17552
- C:\Users\Admin\AppData\Local\Temp\Unicorn-34693.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-34693.exe
  2⤵
  PID:5896
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48112.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48112.exe
    3⤵
    PID:6736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49216.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49216.exe
      4⤵
      PID:12128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55122.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55122.exe
      4⤵
      PID:15408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56590.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56590.exe
      4⤵
      PID:1184
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34918.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34918.exe
    3⤵
    PID:11296
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64830.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64830.exe
    3⤵
    PID:1588
- C:\Users\Admin\AppData\Local\Temp\Unicorn-29919.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-29919.exe
  2⤵
  PID:8936
- C:\Users\Admin\AppData\Local\Temp\Unicorn-7974.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-7974.exe
  2⤵
  PID:12680
- C:\Users\Admin\AppData\Local\Temp\Unicorn-4237.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-4237.exe
  2⤵
  PID:16724

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 6936 -ip 6936
1⤵
PID:7636

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
- Modifies data under HKEY_USERS
PID:15708

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
- Modifies data under HKEY_USERS
PID:15948

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:12572

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-10304.exe

Filesize
468KB

MD5
dc1ee5e5e18778317140f9c1aae92da7

SHA1
280f9739f6a1c2bc45639f6923aacbc254bc8112

SHA256
02107db8fe9f0992c21fc05a4eba67ceaac9ee1f77efc40a42b0327ba9d8e252

SHA512
149cb92f4cbd3c12c49482f2b5ec304f96684c0210b6b4cf875032c2328796c5015690ff01d7753fa4dc323d2a45cd15d28c4ca931f4248e7b49cdbd824a1d19

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-10479.exe

Filesize
468KB

MD5
5ecffadc5d6ae4c78ca4118b6a3771da

SHA1
c6ba20bee8c1a4d6b45109f4805cd92b2deeb517

SHA256
2769dd5675615e7a06c6a437c2c68e1850272f27094214c2e485c37abade3dcf

SHA512
0c8a097eede25fa6eebbcbfda8b2ccd0a1223b90c0f3ab6cddf320233e5fdb8bb3d3d5fd21af006a9bf1336f8be13fcbf7b2055bf38b49f06bc8e100958c8a94

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-10832.exe

Filesize
468KB

MD5
74a73cfe90909254e376b005b09b605b

SHA1
732d65d1a0f896e565b480f697dd2f975566e344

SHA256
10486bcae8c31c65c9e3485e53a8a33232e6b0eca063145b23d75a03126243b2

SHA512
88702268b9b13647eb124084a7cfd5aea76f4e0e263ff983274019f824cac7a4486b6521f274b03fc225f20593e6c7abae8002bce9b74b5b69a2da117d1bba2d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-14125.exe

Filesize
468KB

MD5
4d0f21c7e72c60dfd826c26765898692

SHA1
d8ad5c7ec25f846745bf66b10d92e97a0731cfc8

SHA256
668ee38c5727494c95bf7fb56b6faa05d5ea13767bf193828b3bce6a829b1ca8

SHA512
20fb811258fb42f73ec965ea1eaba37f9b71bac19e3d700e73f5b21c2c3162f36cfc3d0619f4607aa145d09a40b9e6165c47378d9fd8096fc0cf8d66768a2e49

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-21408.exe

Filesize
468KB

MD5
406f5583a344acfbfd14a8b954ff7943

SHA1
66d3fc9e5c703f83c462c4430e908edc9d8b5c2b

SHA256
7607e53e0de813ea6caac9c0b2ad684cdfc80ddef02d7a0c003c8126243e5655

SHA512
5023aa6f716f684ee537b76d74bf5a6e98d1f5b22ac0b5a55ae8404f81a59ab43b6f225d74379b586ea7525a699ff7f3710cbbe16560842bc3efb46d2fe30ff0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-21440.exe

Filesize
468KB

MD5
ed6f84dc706941b3283c3ede957a0e37

SHA1
801aac330cd69ac9c4926de6d2f7fde7aaf993f5

SHA256
bdc8dab69e9f3184f70a71b77808401b5db99e38e88ceddebcf4fe8b6dd1c7a8

SHA512
5a9ff33674e75b97f4473ba0ab167cafa3230b9ef83cea45e3c77224249837c0842574dce715f3b47691af982e067375638e4874231085ad4c0f90842fa440b7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-21558.exe

Filesize
468KB

MD5
67673afd44965bc312ddca5a2da562a7

SHA1
0ed5f23ff08b374eae8acb4eedf22965da8dc877

SHA256
309d967114ca1a7f79128fdbb31c76fa4632a14f1132568e6a43f67a9c72f08b

SHA512
186fcd3b4dec278abed202eac80d02254e81ccd66c21106265365ce8c7f9b5a6c11c80473a71fc0ad685825b98abc8997b93ae165a4f926321538255539f2b5e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-21568.exe

Filesize
468KB

MD5
ac2a238eb304a823c18019e3132c73c5

SHA1
e64e6d518b1ce520f94105b538bfb81fb48cb272

SHA256
632196d32bcb4cdee1b628c05632b4dcb7d53d1cb58edb8ee74e4d24cbf0fd44

SHA512
704d1b9e5c103bc7ff7909a9c9c530f7f03e61ac41c711ad200e499f7a4ef9b69d053ba267bcedf34f1db700b62c38700c37d0e3168453a9a299f388c00b38ec

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-23286.exe

Filesize
468KB

MD5
e7c31ef7c4dcbaa2fe539ab5f5783fd0

SHA1
fdb219b10fa763c3fba0ec362c6675c899401350

SHA256
2a1ed932ab6d78b288cc1818a92c2d9290bf9d0abb9d02d6cef0a89767d81ee9

SHA512
6d6a381007201e834f239a11128a5e294c70d3f3666c3d729f071ca9a225698a078f7f1186ea02c6c1f3d4679a76e02cc4f47fa6102c5b93f89c6f2a77717943

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-23655.exe

Filesize
468KB

MD5
e2466de0afff83bc5aa8919ff7b55a48

SHA1
c0ed519f06af9cdbd89b9ac0e78e134cbca98a6a

SHA256
13528627cf5a316220187395b2a7883182a7f4a729f363fc53212b05197964d7

SHA512
4273136ddcfb4c6364ecc028296734295110320c8e63d7a0f7a7b9e3050c4451a60e0b342c8bf3c51c5937e931e81a09d37971ea363c5d3a2d33c6b6b2371e0e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-23815.exe

Filesize
468KB

MD5
fbe5eda1b7e2e4d733ca787ede6b9f19

SHA1
62326c49e1896cef0b52c9322928e3ed48a7b08e

SHA256
ccdf1833d02d790d0414d87d827a79b1d7c76889a9069b5fb669e7e3a5b50ef1

SHA512
2261c38af217e1524bc79d09f88ec41ca4646788b7b13fff091a8b50977b61b397df5ced988bfbff5f3f341dd857aee5f19f040a1177d3de53494152f2213ee8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-24878.exe

Filesize
468KB

MD5
87d7f9b516a4628a0ad9b45bd9491c8b

SHA1
0f12a68ddecb5da9507accefccee0c166348b9f8

SHA256
65c5bfb4ed80f330661c671b3240d104d7d859d1fb87218be7b18f2fcbd7cdcd

SHA512
49eb79a0491069e0c0f09b8db2711a1148407db338bca3283bed63db5692d631eec5c50ea20505e5a286663cf93a65698239791198acbab25162d1c300ae5516

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-24896.exe

Filesize
468KB

MD5
4c14a6f15d968ac50c4a0748d3dd9f7f

SHA1
cbaca906f523378b5c459da4f4b8fce416c9286a

SHA256
a68d366419e523ece4189651dd7b028ccaff0181891eb6b43b32225f646271fa

SHA512
4aafa1e7f9205c21e14df7431a62ca6e1a0bc048e686069aff13f126eef666128d26047af8b675d918e875088f2b4f28ed079b42ce2f928be11d4e806920ba1c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-26048.exe

Filesize
468KB

MD5
550d371df3297fb37742a00d1c21abcf

SHA1
8a90b7d3bae8c86a263a8cc6efd63f911c5f4a2f

SHA256
17fc9a7d7187d9f362b6132e19275dbf6c6abed646c9655686a804ffce074f60

SHA512
918154a8324342def58a9ab200128b1bb6e63cbcc4c42a2ccbf4eaaeb5881bab35e047d32e41794f2efb4a05ac78be2aaa8cec44811cde7cd1aafcd4af17aea0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-27169.exe

Filesize
468KB

MD5
bcedb2029dcc9920564cf84b67e3c6cd

SHA1
f25f92bc4a0d8e21b32eb71d0243abe72afc0579

SHA256
632f2a7bbab38fe888686d6a095b60a0ec341025e3a5996212bcf88ab91f1ef9

SHA512
1e24bcbfda51f1045124858de71205a284c7458d2f46c695d60419c63ef47aefe338175365d211f63dff9ad3b2661d763e77dfb0220f8fee870b307290a9db27

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-29265.exe

Filesize
468KB

MD5
61a5fdcd3e4c215bea75c2281c994841

SHA1
c1b0fb9f9cf5d07c0e677c8a60a2ab03251c8396

SHA256
a10b76fa23539a2621c3c2af68e617ef2ff2c3d2b1a02a6bf4c84114da20e0f1

SHA512
981801807dc0a5fa3bb36e587ef48c5ad4b857135e211a972945bfcbc69cad0da0c523646dcc7e9ed856aa8b9bdbeaa61eb6bd7d4e6b1fe8f3b7b598fba695f4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-30816.exe

Filesize
468KB

MD5
fc3efd85d0999355a589f35c06312805

SHA1
f21512a79e121cd249c388010542c503cdaa84a2

SHA256
73002f95fa28f904959d95eec0e76349ffc9244af4711b7d7f0f8dbd262cc123

SHA512
e2b214958fc63d267e87e31b9039b266d976dec4a808311c1fd23dd7a7987dbabe185d9dcbf0fe500b5a46b8b8acc1b593e24c65bf1cd7b3fe6746f8699f31a9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-31009.exe

Filesize
468KB

MD5
a130f9b6f85b1b5758b35f8d355c4f41

SHA1
c00ccd1b396336d3d0db5dd0ab2b3137421fc18c

SHA256
491d040f39310eafe9d329be2941c950e745c77fc56bfb62fc17c2d2088641da

SHA512
4bcf206d31e4973f41bc241ccbd26c75f2204aeffbd6924a7e3ac625c45bcd4af1f169b4c2bf67d8e9c862a424bfc049644baca6e9005bb420c1a141ac9e2c7b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-34022.exe

Filesize
468KB

MD5
5bb24babd3794d33ca90cebf48456a00

SHA1
4065184f7ea2c8444ecd6e5377e4278173a7ec7c

SHA256
fdae601e0aa96e7a97ae8de4abe3d81c1b77fb1703b7bc98c4dd3c31b9ac50d9

SHA512
8c5ef2733ceea2481033a3136720d263237b8f6c77320220ea5809cd0f079852ede60a1901bb09e7fd3b8811af64421dbd2b3ff0e6001e54cf19549ebcbcf545

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-34317.exe

Filesize
468KB

MD5
b88074cbf9b03315515779d7cfc78a19

SHA1
7458e6ce59cd63b19691b42a9180a82573fcc1cd

SHA256
a9ac90ab3879b5ba0ac4d972ededdb54025bfda1c857eb1a7ee9945848b446c9

SHA512
e00d99009d4a38996fb8e249e2ee7f1d00e1fae09d472c0d063692e2e9db38a5432e7e0cb3953649b76a342c0b17b4b408a45b0e1ff9d10667130a534f1ea566

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-34438.exe

Filesize
468KB

MD5
88a75c60b208004d4ec28baeef0b3d9d

SHA1
e8e366c195b0c8eb1a4cb020aaed7c1f67f8cdc2

SHA256
42ac66904d2a1dff3d6fe21f777472d9646d34fafbdde7c9c96b6ec4b877d8c4

SHA512
a4bfdf0db9104696fa0c372faf9f56214ede4cbdb96a6abde6f1de17128374b42dc5e9b735ca37eeeacf571d043d56e1bf29b736a4767060058bbe09faf5a4c0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-36525.exe

Filesize
468KB

MD5
36f9dc26fd4286d59ac3d3fa8c73d8c3

SHA1
84b3df0d2e3342f586eb512d38a4efc840206b4b

SHA256
0d25182ca1a98c72fa2a347bd429d517dc58c83d5229858c138c481f9ea37806

SHA512
819627bc59b804d6f0d090a6ba43fc709dc62a98abf808f32db5640b1d6b705977e0ae57cfda3bc40c60756b6484911238c302f47f4f5a7f5ff4e2b9500fd41b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-37110.exe

Filesize
468KB

MD5
3b1fe37016313e0153b74451272dd3f8

SHA1
79231b21ec3cfab8f5b2058a2bf3803e01818d78

SHA256
ab33dd745e84a10ab4bd76571ada997d3a2d65c80dba1055c662872b31c8cd89

SHA512
a6a5d9d19c429aa25c6f4e074f2c4ebe204d28228c214d2f624022b2debab941e6606734ecee239a564428f557834a97cdf893826a27512e65235e048719f54e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-38923.exe

Filesize
468KB

MD5
2876c37bbc4fcd8fba42e7188e15ca64

SHA1
e9bc54ad527c6c0ecb8b476d976163a56745353a

SHA256
8d677b50740598fba8a49aa96b3e2e4257622667935f259c59b0ea7a05bc3320

SHA512
4854680006f677c3b1b7e33a1ca5d37bf97fe426c0c4fe75439b4fc56a8bb8f23e27939bf9a875b51b7ab0666e4896b889d4b5dcff0bb073bad5051ed8d7df24

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39326.exe

Filesize
468KB

MD5
cfcd3cfc4951290e2caa9dccfb9d887c

SHA1
72d3546679ab2366b5cb5c1d10b230abd63115a2

SHA256
c9b57164a326c8baf545eb8c49423ed63d6600df03c24619b3f0476845e7208e

SHA512
95b7ed2c30bcb39eb2fb40558be668a1ebce0707df106188920f9459bbe4b3662e0cdbd6325eb28ab59a76dd7fbc0ef3455499f5f47e9af965bb3c831b115531

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-40071.exe

Filesize
468KB

MD5
48f04282cde71b4031fe5dc3026114e0

SHA1
70df47d387ce8b42bf1287d95687f75c180bef57

SHA256
b8f5b010f222cfc7eca9e139fe2f2b79292564d5c9715aaba011433b3076ef50

SHA512
7b027166fc69fe2213ce8726334592ef600e2956eebada0109d3a0b5e7314de04f6e010699247fad208afd9d29861ad62ce7f0bb704ea43770e65958e7404c74

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-40448.exe

Filesize
468KB

MD5
6649a834cd51aaff577d5c99c2bb677e

SHA1
25cc8b666ebe84dd435e4501fd84b3db3f7d6f84

SHA256
a40195d86a38416255fd82aff47795b27b2b90c9825519c282b8cfb0da7a08b7

SHA512
dc49ca6da70601f1ce1b0cc1e2febb7a41539c172fff64c848f338931dc5a6658011cb3a1e442e6505d42eed68ac4a0aef5d75c04a36190d13a4e5dc955b379a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-40640.exe

Filesize
468KB

MD5
44d21573acac181fb486c6a861e8a5ea

SHA1
db0b6e73e726fa9e086dc1697edbb436d6b7c04f

SHA256
751db52c90222422e10ece30ab04df38251603a29f6c3df751829764542754ab

SHA512
4de604ba2679abc655c48302c0210ba7e5a505f6f632fe987cc671123e0899ab576b41b1844a9cb49e42189020cc36823325f50a53a0662bc8934c4c2294d347

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-47758.exe

Filesize
468KB

MD5
ffeac5b9238ab5751138510b19875ef7

SHA1
d7c9dc6121b7383859cb6a79ff7df28c362ea824

SHA256
57aa6c8109321b33e7c5d5254a910dd2bc84c89db90042530900d14916d81256

SHA512
11a396cdfb05705c545335ee98d174063ec0b7eccf679e5c0bb225998e76c343e564e6fb73799e2978245dd2afff4f8d4eb9e744c6db5a67833bdb47d2d8f443

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5094.exe

Filesize
468KB

MD5
d33ef078290aabbae2412912ea2b619e

SHA1
9e55488ae574962cdfa5c643f8e6adb7c28bbbf2

SHA256
a28b23f230bb0ac054679af637dc0c9d96962237d148dfebb83cc87daa7d971c

SHA512
ba98864a98fda1a0b6f14fc5db39af0ffb332081f86435b2444d10076cd7f22185a03f88aae86ac20a2b4ad420a21dae27f7cd8e152f38b92a9e5194fab340c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-51159.exe

Filesize
468KB

MD5
f87b8ddc2709098f7d04686b2b721aa4

SHA1
ecd86f6b54fce38d66279259087490e5f9f95ef7

SHA256
0eb55a563b7b5bed68b1b3279552cb6d52e8f2cb77ae6eb3f7a1acdda5b0aa24

SHA512
0b117f638de5d45c900ad5a31dce543cedf59897f8b48e6e2dc1158cda42c886cfe7d3254f4096527d041c688e736da3a1697ac7fb60f8495a146d1e42a1a6ad

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-56151.exe

Filesize
468KB

MD5
57bc93ffd6e8b46166518fde50ffbfec

SHA1
2d97cce6e54f1e23cd5cda3bdbcc3d9844ce2f71

SHA256
b0a7aa12ccd4d5a5d77b24d1509a31e991058f7a738b8b0a8feeac5f3daac9ba

SHA512
e83b2611c67c59f3648c7a61b7ae18189acdaf601a1928021f053fb7b0be0ed40167b63c9dae9da18a6355651aad75b1c98c1e5bc4c7dd2dd2e8ce56f135adc6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-58016.exe

Filesize
468KB

MD5
ec80cd1bc8a0116a4bdaf4eee189a700

SHA1
b5c8bd09851098a6607a4dd576bfec259da63160

SHA256
1dbe0e1da448cb0182ed06996e3208e2ab177a41b3dfc35f7ebb95d73b2d9626

SHA512
7cd7606237ad9b4e2272c4675836450b64a41156befcbd70e3df96e712904c09de0afa95da8924c56837d108ed09f11b264210e29da5f02e5721b64f0552ca41

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-58647.exe

Filesize
468KB

MD5
80a397c1bab3972e6edd893130ce9eb9

SHA1
8e5cfea4c2e86e71368f0fe6cd77ec9abfec9099

SHA256
a4d39c99763d8ebd4fe206729e0acfeecc2b4f0e1069896b21df92a440d1a28e

SHA512
6e87765d726f076af47cd309f14a647990d9c8f3d954d03eeae846893f0fda4395ae6ce3de05d2625bdff9dcd117d3721e5ba70f6bb93a794e5dc7cbbe37a792

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-58912.exe

Filesize
468KB

MD5
218cc51ebb9a18b373e4b7f528260bcc

SHA1
205cf542a144c3cc6e9b38fe9083d3fee4afba06

SHA256
f00f1edb1f98702584fb80255e253cb32d25471af186de3db4b20502fce6e1d3

SHA512
5249545b5410932250dd34d21fbb3c5c13cba1165b104304238db191d04761edc1cf83bbdbbdd3aae14f0c7063cff1739c0eff22660bb0659d98f7bed7c9848e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-59055.exe

Filesize
468KB

MD5
3979f03eef5a2736ec01d3db43c4e4c4

SHA1
63c13ebc5397b297aea5ac6d917869bd15bbd211

SHA256
df09cc8ec369334b530096ed9ceb12c35949752d132ec5760c97726ac6805efe

SHA512
aaa4d60620464b65c1dbdb96c894e289726362b22cdf8b383bd6d663e6807d4311eeb5d937118f4cda8492aef246b299f4389f1410c66229238957673e0265dc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-9062.exe

Filesize
468KB

MD5
1a3949c130f7ff6aabf1bb870a0fe751

SHA1
ad9124656598636c103e41c8028dcddaaf469678

SHA256
b0ed2288951a6ef7f533d08f61ce86b52f03281dc9517df5a953170486b5e3fa

SHA512
54c52a8b1dbcaed90027acb7356ac5ff798e5773909e7bb44be08834a99f95ec43b5c67e49ffe4c6774fb3fc22f9c5aaabce486a8146dd9d066a521d0b21c9df

Download Submit
memory/224-201-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/540-450-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/636-249-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/640-7-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/688-78-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1004-487-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1020-90-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1044-329-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1084-277-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1088-168-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1152-382-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1468-281-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1596-219-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1612-411-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1700-91-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2012-235-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2172-297-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2208-298-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2224-336-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2248-105-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2252-346-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2304-171-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2316-489-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2380-34-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2396-79-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2444-422-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2460-278-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2500-405-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2608-264-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2700-51-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2720-244-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2968-191-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3068-391-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3184-223-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3188-291-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3208-13-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3284-392-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3324-77-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3328-57-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3364-169-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3388-428-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3428-348-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3532-135-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3548-429-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3560-321-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3568-170-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3608-415-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3712-296-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3764-128-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3824-40-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3836-488-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3856-482-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3952-172-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3972-114-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3992-39-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3996-389-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4020-350-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4072-358-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4204-158-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4252-451-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4256-246-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4280-279-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4316-208-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4324-202-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4368-347-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4416-448-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4612-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4628-102-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4636-464-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4640-299-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4660-500-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4748-259-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4752-300-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4764-232-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4788-449-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4940-125-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5004-254-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5008-395-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5012-345-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5080-414-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5088-19-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5136-501-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5176-502-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5196-503-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5208-504-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5224-515-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5288-516-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5300-517-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5344-544-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5352-526-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5360-527-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5376-530-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5388-531-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5396-532-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5664-545-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5708-546-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/13880-2600-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/15308-3290-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/15412-3064-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/15528-3131-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/16300-2590-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/16320-3038-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/16344-2593-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads