67582367eca2c19a9e27a136e12963f0f9af0898e3621c7520d6c775eb2ed3c8

Analysis

max time kernel
120s
max time network
108s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19-09-2024 17:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

67582367eca2c19a9e27a136e12963f0f9af0898e3621c7520d6c775eb2ed3c8N.exe
Size

468KB
MD5

5ee68e1702b93d999fac8f4115434650
SHA1

1283eb3bcaaac53b7cf8dc62787e2906c1057091
SHA256

67582367eca2c19a9e27a136e12963f0f9af0898e3621c7520d6c775eb2ed3c8
SHA512

0c9c0af4cb6fb05330c3e96626217939e4ad1366b3979c5a8c83b070b7348fbb8350cd50c779c8f698d381e8326f3c7cd9adbee7ae2c4b021c237f17515be122
SSDEEP

3072:HbAaogMdI95UtbYIPz+jdf8/kCtkPIp3hmHepVm4tej8h8wu3ZlW:HbBo87UtvPijdfh0bfteQWwu3

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2988	Unicorn-59813.exe
2432	Unicorn-21277.exe
3308	Unicorn-22023.exe
2716	Unicorn-15568.exe
4968	Unicorn-30818.exe
1644	Unicorn-49201.exe
1764	Unicorn-29335.exe
4876	Unicorn-59481.exe
2408	Unicorn-64120.exe
2876	Unicorn-49267.exe
4912	Unicorn-55397.exe
4852	Unicorn-51313.exe
540	Unicorn-43145.exe
3436	Unicorn-52060.exe
2904	Unicorn-63492.exe
3944	Unicorn-9808.exe
1804	Unicorn-63072.exe
2868	Unicorn-50265.exe
1608	Unicorn-25761.exe
2776	Unicorn-40051.exe
928	Unicorn-46181.exe
1344	Unicorn-18147.exe
2976	Unicorn-34675.exe
3792	Unicorn-54541.exe
1972	Unicorn-21874.exe
4924	Unicorn-18553.exe
3304	Unicorn-46757.exe
2092	Unicorn-17903.exe
3184	Unicorn-63840.exe
4436	Unicorn-12038.exe
32	Unicorn-19897.exe
2000	Unicorn-33109.exe
3352	Unicorn-13243.exe
4836	Unicorn-24941.exe
2024	Unicorn-29195.exe
2128	Unicorn-8967.exe
4948	Unicorn-39039.exe
2824	Unicorn-13072.exe
4272	Unicorn-29336.exe
4044	Unicorn-50021.exe
3740	Unicorn-17349.exe
3252	Unicorn-50768.exe
1976	Unicorn-5096.exe
1836	Unicorn-43559.exe
4020	Unicorn-57295.exe
2256	Unicorn-63425.exe
3604	Unicorn-53211.exe
2284	Unicorn-55257.exe
2172	Unicorn-55257.exe
4828	Unicorn-6056.exe
5096	Unicorn-21822.exe
3404	Unicorn-2719.exe
3068	Unicorn-22585.exe
2840	Unicorn-46824.exe
3972	Unicorn-21623.exe
3556	Unicorn-27223.exe
4468	Unicorn-32790.exe
4408	Unicorn-47836.exe
4464	Unicorn-14032.exe
3288	Unicorn-55620.exe
2992	Unicorn-64385.exe
1576	Unicorn-56217.exe
3372	Unicorn-28898.exe
768	Unicorn-15163.exe

Program crash 6 IoCs

pid	pid_target	Process	procid_target
6848	932	WerFault.exe	171
9440	8260	WerFault.exe	401
9432	8540	WerFault.exe	403
9472	8676	WerFault.exe	404
14412	15040	WerFault.exe	715
15636	15308	WerFault.exe	851

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61308.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6373.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45044.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21975.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14032.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50893.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22502.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27837.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4810.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58929.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24941.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24189.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55361.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26838.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16110.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50379.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60445.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10457.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52703.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4147.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51523.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37644.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20822.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62533.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31811.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18625.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35576.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5164.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4128.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19263.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14508.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6373.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49201.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9455.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27276.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40629.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62284.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50379.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22172.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21822.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49437.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60805.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37971.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10457.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45251.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49705.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42616.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-395.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15416.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9927.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31551.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55620.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24277.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46544.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60805.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64260.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1303.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25802.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16575.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62024.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38723.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9927.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32790.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5843.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	17308	dwm.exe
Token: SeChangeNotifyPrivilege	17308	dwm.exe
Token: 33	17308	dwm.exe
Token: SeIncBasePriorityPrivilege	17308	dwm.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
4200	67582367eca2c19a9e27a136e12963f0f9af0898e3621c7520d6c775eb2ed3c8N.exe
2988	Unicorn-59813.exe
3308	Unicorn-22023.exe
2432	Unicorn-21277.exe
2716	Unicorn-15568.exe
1764	Unicorn-29335.exe
1644	Unicorn-49201.exe
4968	Unicorn-30818.exe
4876	Unicorn-59481.exe
2408	Unicorn-64120.exe
4852	Unicorn-51313.exe
2876	Unicorn-49267.exe
3436	Unicorn-52060.exe
4912	Unicorn-55397.exe
2904	Unicorn-63492.exe
540	Unicorn-43145.exe
3944	Unicorn-9808.exe
1804	Unicorn-63072.exe
2868	Unicorn-50265.exe
2976	Unicorn-34675.exe
928	Unicorn-46181.exe
1972	Unicorn-21874.exe
1608	Unicorn-25761.exe
3792	Unicorn-54541.exe
1344	Unicorn-18147.exe
2776	Unicorn-40051.exe
4436	Unicorn-12038.exe
2092	Unicorn-17903.exe
3184	Unicorn-63840.exe
4924	Unicorn-18553.exe
3304	Unicorn-46757.exe
32	Unicorn-19897.exe
3352	Unicorn-13243.exe
2000	Unicorn-33109.exe
4836	Unicorn-24941.exe
2024	Unicorn-29195.exe
2128	Unicorn-8967.exe
4948	Unicorn-39039.exe
2824	Unicorn-13072.exe
4272	Unicorn-29336.exe
4044	Unicorn-50021.exe
3740	Unicorn-17349.exe
1976	Unicorn-5096.exe
1836	Unicorn-43559.exe
4020	Unicorn-57295.exe
3252	Unicorn-50768.exe
3604	Unicorn-53211.exe
4828	Unicorn-6056.exe
2256	Unicorn-63425.exe
3068	Unicorn-22585.exe
3404	Unicorn-2719.exe
2840	Unicorn-46824.exe
2172	Unicorn-55257.exe
3556	Unicorn-27223.exe
2284	Unicorn-55257.exe
5096	Unicorn-21822.exe
4408	Unicorn-47836.exe
4468	Unicorn-32790.exe
3972	Unicorn-21623.exe
4464	Unicorn-14032.exe
3288	Unicorn-55620.exe
2992	Unicorn-64385.exe
2064	Unicorn-6995.exe
768	Unicorn-15163.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4200 wrote to memory of 2988	4200	67582367eca2c19a9e27a136e12963f0f9af0898e3621c7520d6c775eb2ed3c8N.exe	82
PID 4200 wrote to memory of 2988	4200	67582367eca2c19a9e27a136e12963f0f9af0898e3621c7520d6c775eb2ed3c8N.exe	82
PID 4200 wrote to memory of 2988	4200	67582367eca2c19a9e27a136e12963f0f9af0898e3621c7520d6c775eb2ed3c8N.exe	82
PID 2988 wrote to memory of 2432	2988	Unicorn-59813.exe	87
PID 2988 wrote to memory of 2432	2988	Unicorn-59813.exe	87
PID 2988 wrote to memory of 2432	2988	Unicorn-59813.exe	87
PID 4200 wrote to memory of 3308	4200	67582367eca2c19a9e27a136e12963f0f9af0898e3621c7520d6c775eb2ed3c8N.exe	88
PID 4200 wrote to memory of 3308	4200	67582367eca2c19a9e27a136e12963f0f9af0898e3621c7520d6c775eb2ed3c8N.exe	88
PID 4200 wrote to memory of 3308	4200	67582367eca2c19a9e27a136e12963f0f9af0898e3621c7520d6c775eb2ed3c8N.exe	88
PID 3308 wrote to memory of 2716	3308	Unicorn-22023.exe	90
PID 3308 wrote to memory of 2716	3308	Unicorn-22023.exe	90
PID 3308 wrote to memory of 2716	3308	Unicorn-22023.exe	90
PID 4200 wrote to memory of 4968	4200	67582367eca2c19a9e27a136e12963f0f9af0898e3621c7520d6c775eb2ed3c8N.exe	91
PID 4200 wrote to memory of 4968	4200	67582367eca2c19a9e27a136e12963f0f9af0898e3621c7520d6c775eb2ed3c8N.exe	91
PID 4200 wrote to memory of 4968	4200	67582367eca2c19a9e27a136e12963f0f9af0898e3621c7520d6c775eb2ed3c8N.exe	91
PID 2432 wrote to memory of 1644	2432	Unicorn-21277.exe	92
PID 2432 wrote to memory of 1644	2432	Unicorn-21277.exe	92
PID 2432 wrote to memory of 1644	2432	Unicorn-21277.exe	92
PID 2988 wrote to memory of 1764	2988	Unicorn-59813.exe	93
PID 2988 wrote to memory of 1764	2988	Unicorn-59813.exe	93
PID 2988 wrote to memory of 1764	2988	Unicorn-59813.exe	93
PID 2716 wrote to memory of 4876	2716	Unicorn-15568.exe	95
PID 2716 wrote to memory of 4876	2716	Unicorn-15568.exe	95
PID 2716 wrote to memory of 4876	2716	Unicorn-15568.exe	95
PID 3308 wrote to memory of 2408	3308	Unicorn-22023.exe	96
PID 3308 wrote to memory of 2408	3308	Unicorn-22023.exe	96
PID 3308 wrote to memory of 2408	3308	Unicorn-22023.exe	96
PID 2988 wrote to memory of 2876	2988	Unicorn-59813.exe	97
PID 2988 wrote to memory of 2876	2988	Unicorn-59813.exe	97
PID 2988 wrote to memory of 2876	2988	Unicorn-59813.exe	97
PID 1764 wrote to memory of 4912	1764	Unicorn-29335.exe	98
PID 1764 wrote to memory of 4912	1764	Unicorn-29335.exe	98
PID 1764 wrote to memory of 4912	1764	Unicorn-29335.exe	98
PID 4968 wrote to memory of 4852	4968	Unicorn-30818.exe	99
PID 4968 wrote to memory of 4852	4968	Unicorn-30818.exe	99
PID 4968 wrote to memory of 4852	4968	Unicorn-30818.exe	99
PID 1644 wrote to memory of 540	1644	Unicorn-49201.exe	100
PID 1644 wrote to memory of 540	1644	Unicorn-49201.exe	100
PID 1644 wrote to memory of 540	1644	Unicorn-49201.exe	100
PID 2432 wrote to memory of 3436	2432	Unicorn-21277.exe	101
PID 2432 wrote to memory of 3436	2432	Unicorn-21277.exe	101
PID 2432 wrote to memory of 3436	2432	Unicorn-21277.exe	101
PID 4200 wrote to memory of 2904	4200	67582367eca2c19a9e27a136e12963f0f9af0898e3621c7520d6c775eb2ed3c8N.exe	102
PID 4200 wrote to memory of 2904	4200	67582367eca2c19a9e27a136e12963f0f9af0898e3621c7520d6c775eb2ed3c8N.exe	102
PID 4200 wrote to memory of 2904	4200	67582367eca2c19a9e27a136e12963f0f9af0898e3621c7520d6c775eb2ed3c8N.exe	102
PID 4876 wrote to memory of 3944	4876	Unicorn-59481.exe	104
PID 4876 wrote to memory of 3944	4876	Unicorn-59481.exe	104
PID 4876 wrote to memory of 3944	4876	Unicorn-59481.exe	104
PID 2716 wrote to memory of 1804	2716	Unicorn-15568.exe	105
PID 2716 wrote to memory of 1804	2716	Unicorn-15568.exe	105
PID 2716 wrote to memory of 1804	2716	Unicorn-15568.exe	105
PID 4912 wrote to memory of 2868	4912	Unicorn-55397.exe	106
PID 4912 wrote to memory of 2868	4912	Unicorn-55397.exe	106
PID 4912 wrote to memory of 2868	4912	Unicorn-55397.exe	106
PID 2408 wrote to memory of 1608	2408	Unicorn-64120.exe	107
PID 2408 wrote to memory of 1608	2408	Unicorn-64120.exe	107
PID 2408 wrote to memory of 1608	2408	Unicorn-64120.exe	107
PID 3308 wrote to memory of 2776	3308	Unicorn-22023.exe	108
PID 3308 wrote to memory of 2776	3308	Unicorn-22023.exe	108
PID 3308 wrote to memory of 2776	3308	Unicorn-22023.exe	108
PID 4852 wrote to memory of 928	4852	Unicorn-51313.exe	109
PID 4852 wrote to memory of 928	4852	Unicorn-51313.exe	109
PID 4852 wrote to memory of 928	4852	Unicorn-51313.exe	109
PID 1764 wrote to memory of 1344	1764	Unicorn-29335.exe	110

C:\Users\Admin\AppData\Local\Temp\67582367eca2c19a9e27a136e12963f0f9af0898e3621c7520d6c775eb2ed3c8N.exe
"C:\Users\Admin\AppData\Local\Temp\67582367eca2c19a9e27a136e12963f0f9af0898e3621c7520d6c775eb2ed3c8N.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4200
- C:\Users\Admin\AppData\Local\Temp\Unicorn-59813.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-59813.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2988
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21277.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21277.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2432
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49201.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49201.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43145.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29195.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10524.exe
        7⤵
        
        PID:2124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21463.exe
        8⤵
        
        PID:6196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51817.exe
        9⤵
        
        PID:9116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15387.exe
        9⤵
        
        PID:12692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9927.exe
        9⤵
        
        PID:4216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50155.exe
        8⤵
        
        PID:9196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2891.exe
        8⤵
        
        PID:13904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16580.exe
        8⤵
        
        PID:15984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44043.exe
        8⤵
        
        PID:5912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41307.exe
        7⤵
        
        PID:5496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32025.exe
        8⤵
        
        PID:8156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57217.exe
        9⤵
        
        PID:14564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60445.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:3256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26767.exe
        8⤵
        
        PID:9616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47195.exe
        8⤵
        
        PID:15544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6373.exe
        8⤵
        
        PID:5016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52703.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53488.exe
        7⤵
        
        PID:13012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27027.exe
        7⤵
        
        PID:5168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29090.exe
        6⤵
        
        PID:2384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48537.exe
        7⤵
        
        PID:5716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8288.exe
        8⤵
        
        PID:6800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51464.exe
        8⤵
        
        PID:10792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6373.exe
        8⤵
        
        PID:1428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63664.exe
        7⤵
        
        PID:7768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37919.exe
        7⤵
        
        PID:11936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44043.exe
        7⤵
        
        PID:18424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-607.exe
        6⤵
        
        PID:5588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47541.exe
        7⤵
        
        PID:9104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42055.exe
        7⤵
        
        PID:12540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59551.exe
        7⤵
        
        PID:14748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34424.exe
        7⤵
        
        PID:6236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51631.exe
        6⤵
        
        PID:9676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5703.exe
        6⤵
        
        PID:3744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51842.exe
        6⤵
        
        PID:16188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42908.exe
        6⤵
        
        PID:15592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63840.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58272.exe
        6⤵
        
        PID:4932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60405.exe
        7⤵
        
        PID:5928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47437.exe
        8⤵
        
        PID:7696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50636.exe
        9⤵
        
        PID:15172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58864.exe
        8⤵
        
        PID:11160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42343.exe
        8⤵
        
        PID:14916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10457.exe
        8⤵
        
        PID:4576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42091.exe
        7⤵
        
        PID:5348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54831.exe
        7⤵
        
        PID:11776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6373.exe
        7⤵
        
        PID:14800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32232.exe
        6⤵
        
        PID:6744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20925.exe
        7⤵
        
        PID:6408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4147.exe
        7⤵
        
        PID:11732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54845.exe
        7⤵
        
        PID:1724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30634.exe
        6⤵
        
        PID:7864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32371.exe
        6⤵
        
        PID:13020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32969.exe
        6⤵
        
        PID:15440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26186.exe
        6⤵
        
        PID:15380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12372.exe
        6⤵
        
        PID:16204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32790.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55361.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48449.exe
        7⤵
        
        PID:7088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28273.exe
        8⤵
        
        PID:9496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48828.exe
        8⤵
        
        PID:13956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5843.exe
        8⤵
        
        PID:16332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24847.exe
        7⤵
        
        PID:11140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16110.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:15256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47828.exe
        7⤵
        
        PID:5596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30887.exe
        6⤵
        
        PID:7464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58989.exe
        7⤵
        
        PID:13180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14508.exe
        7⤵
        
        PID:6308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7062.exe
        6⤵
        
        PID:11092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-395.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:12832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27027.exe
        6⤵
        
        PID:5816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60908.exe
        5⤵
        
        PID:5356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63877.exe
        6⤵
        
        PID:9176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58392.exe
        6⤵
        
        PID:13068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18327.exe
        6⤵
        
        PID:15780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5843.exe
        6⤵
        
        PID:14164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58839.exe
        5⤵
        
        PID:9000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60969.exe
        6⤵
        
        PID:14584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60445.exe
        6⤵
        
        PID:15588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5703.exe
        5⤵
        
        PID:13196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61381.exe
        5⤵
        
        PID:6484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52060.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52060.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18553.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22585.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37489.exe
        7⤵
        
        PID:1600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40561.exe
        8⤵
        
        PID:5264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60805.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:7884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2455.exe
        9⤵
        
        PID:9432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26006.exe
        9⤵
        
        PID:14412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25038.exe
        9⤵
        
        PID:16224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6373.exe
        9⤵
        
        PID:4116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9890.exe
        8⤵
        
        PID:9352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2891.exe
        8⤵
        
        PID:13976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6373.exe
        8⤵
        
        PID:3664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43087.exe
        7⤵
        
        PID:4976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36545.exe
        8⤵
        
        PID:10992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2375.exe
        8⤵
        
        PID:15244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14508.exe
        8⤵
        
        PID:4720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54152.exe
        7⤵
        
        PID:9724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40119.exe
        7⤵
        
        PID:7652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49128.exe
        7⤵
        
        PID:4228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35495.exe
        6⤵
        
        PID:5404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11500.exe
        7⤵
        
        PID:7024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11848.exe
        8⤵
        
        PID:11044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39323.exe
        8⤵
        
        PID:13592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14766.exe
        8⤵
        
        PID:464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24405.exe
        8⤵
        
        PID:6228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20763.exe
        7⤵
        
        PID:11020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57719.exe
        7⤵
        
        PID:15232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57388.exe
        7⤵
        
        PID:16004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17083.exe
        7⤵
        
        PID:16576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19926.exe
        6⤵
        
        PID:7428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12927.exe
        6⤵
        
        PID:10924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39543.exe
        6⤵
        
        PID:14820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45044.exe
        6⤵
        
        PID:15800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47836.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15288.exe
        6⤵
        
        PID:5880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12372.exe
        7⤵
        
        PID:6952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6347.exe
        7⤵
        
        PID:10988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47195.exe
        7⤵
        
        PID:15552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18022.exe
        7⤵
        
        PID:5576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19969.exe
        7⤵
        
        PID:6568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63280.exe
        6⤵
        
        PID:8656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9927.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:15572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47623.exe
        6⤵
        
        PID:12684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57494.exe
        6⤵
        
        PID:6428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55043.exe
        5⤵
        
        PID:5512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32025.exe
        6⤵
        
        PID:8164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13880.exe
        7⤵
        
        PID:14812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8643.exe
        7⤵
        
        PID:4324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26767.exe
        6⤵
        
        PID:8828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47195.exe
        6⤵
        
        PID:15520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46803.exe
        6⤵
        
        PID:3920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13532.exe
        6⤵
        
        PID:17024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36254.exe
        5⤵
        
        PID:8972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43227.exe
        5⤵
        
        PID:13928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12372.exe
        5⤵
        
        PID:3952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12038.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12038.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6056.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18413.exe
        6⤵
        
        PID:5376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27837.exe
        7⤵
        
        PID:6888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24189.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:9912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48828.exe
        8⤵
        
        PID:13936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61280.exe
        8⤵
        
        PID:16352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5843.exe
        8⤵
        
        PID:15644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8511.exe
        7⤵
        
        PID:11032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12026.exe
        7⤵
        
        PID:15208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9927.exe
        7⤵
        
        PID:1044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6191.exe
        6⤵
        
        PID:7396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48885.exe
        7⤵
        
        PID:9708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48828.exe
        7⤵
        
        PID:14004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5843.exe
        7⤵
        
        PID:396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1826.exe
        6⤵
        
        PID:11180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21975.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:15268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48723.exe
        6⤵
        
        PID:15840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35192.exe
        6⤵
        
        PID:6060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50628.exe
        5⤵
        
        PID:5208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40503.exe
        6⤵
        
        PID:5848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62563.exe
        6⤵
        
        PID:13860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30598.exe
        6⤵
        
        PID:16908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13398.exe
        5⤵
        
        PID:9512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30904.exe
        5⤵
        
        PID:12388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5955.exe
        5⤵
        
        PID:16052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6373.exe
        5⤵
        
        PID:3036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46824.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46824.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33331.exe
        5⤵
        
        PID:6032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30909.exe
        6⤵
        
        PID:7668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58864.exe
        6⤵
        
        PID:8248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10457.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22962.exe
        5⤵
        
        PID:8056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23748.exe
        5⤵
        
        PID:11716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50379.exe
        5⤵
        
        PID:15600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22502.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22502.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60805.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44773.exe
        6⤵
        
        PID:14396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60445.exe
        6⤵
        
        PID:15856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63908.exe
        5⤵
        
        PID:9228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54011.exe
        5⤵
        
        PID:4860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23861.exe
        5⤵
        
        PID:5184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21499.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21499.exe
      4⤵
      PID:8308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20464.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20464.exe
      4⤵
      PID:12148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23399.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23399.exe
      4⤵
      PID:16360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41929.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41929.exe
      4⤵
      PID:12436
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29335.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29335.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55397.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55397.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50265.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24941.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56217.exe
        7⤵
        Executes dropped EXE
        
        PID:1576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36861.exe
        8⤵
        
        PID:6084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39159.exe
        9⤵
        
        PID:8252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30873.exe
        10⤵
        
        PID:9364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14627.exe
        10⤵
        
        PID:15564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44512.exe
        10⤵
        
        PID:16272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46279.exe
        9⤵
        
        PID:12000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6373.exe
        9⤵
        
        PID:15944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1687.exe
        8⤵
        
        PID:10436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52939.exe
        8⤵
        
        PID:14624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26761.exe
        9⤵
        
        PID:15840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60445.exe
        9⤵
        
        PID:6904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44043.exe
        8⤵
        
        PID:18400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26855.exe
        7⤵
        
        PID:6440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20925.exe
        8⤵
        
        PID:8400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62284.exe
        8⤵
        
        PID:12252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58400.exe
        8⤵
        
        PID:16192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54845.exe
        8⤵
        
        PID:3824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54431.exe
        7⤵
        
        PID:9668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34988.exe
        7⤵
        
        PID:12536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41375.exe
        7⤵
        
        PID:15860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39238.exe
        7⤵
        
        PID:2372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15163.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21463.exe
        7⤵
        
        PID:6316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59793.exe
        8⤵
        
        PID:9200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42055.exe
        8⤵
        
        PID:12548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59551.exe
        8⤵
        
        PID:15384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38508.exe
        8⤵
        
        PID:736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1722.exe
        7⤵
        
        PID:9328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2891.exe
        7⤵
        
        PID:13816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13362.exe
        7⤵
        
        PID:16056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9067.exe
        7⤵
        
        PID:16988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46683.exe
        6⤵
        
        PID:3328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63559.exe
        7⤵
        
        PID:8856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2891.exe
        7⤵
        
        PID:13848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13362.exe
        7⤵
        
        PID:16012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6373.exe
        7⤵
        
        PID:16208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62844.exe
        6⤵
        
        PID:8268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43479.exe
        6⤵
        
        PID:11988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65465.exe
        6⤵
        
        PID:14592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8967.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55833.exe
        6⤵
        
        PID:448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23649.exe
        7⤵
        
        PID:5524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51957.exe
        8⤵
        
        PID:6580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35097.exe
        9⤵
        
        PID:9288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44744.exe
        9⤵
        
        PID:13308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5843.exe
        9⤵
        
        PID:16132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42231.exe
        8⤵
        
        PID:9844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58095.exe
        8⤵
        
        PID:13028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54845.exe
        8⤵
        
        PID:6688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5615.exe
        7⤵
        
        PID:7228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48287.exe
        7⤵
        
        PID:10140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48784.exe
        7⤵
        
        PID:14608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18472.exe
        7⤵
        
        PID:6068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-851.exe
        6⤵
        
        PID:60
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37837.exe
        7⤵
        
        PID:7604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31811.exe
        7⤵
        
        PID:11612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54845.exe
        7⤵
        
        PID:14584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54431.exe
        6⤵
        
        PID:9660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17381.exe
        7⤵
        
        PID:12404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10106.exe
        7⤵
        
        PID:14748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14508.exe
        7⤵
        
        PID:7136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30904.exe
        6⤵
        
        PID:13348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39238.exe
        6⤵
        
        PID:1220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-502.exe
        5⤵
        
        PID:1400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31433.exe
        6⤵
        
        PID:5800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12372.exe
        7⤵
        
        PID:7156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6347.exe
        7⤵
        
        PID:10964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6373.exe
        7⤵
        
        PID:1616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18931.exe
        6⤵
        
        PID:8364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10482.exe
        6⤵
        
        PID:11000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6373.exe
        6⤵
        
        PID:3692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20451.exe
        5⤵
        
        PID:4340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9248.exe
        6⤵
        
        PID:3004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27727.exe
        6⤵
        
        PID:11624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54845.exe
        6⤵
        
        PID:14916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6706.exe
        5⤵
        
        PID:9804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34645.exe
        5⤵
        
        PID:15020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50690.exe
        5⤵
        
        PID:3648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7932.exe
        5⤵
        
        PID:16952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18147.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18147.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5096.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24277.exe
        6⤵
        
        PID:3916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40561.exe
        7⤵
        
        PID:5240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63559.exe
        8⤵
        
        PID:8872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2891.exe
        8⤵
        
        PID:13788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13362.exe
        8⤵
        
        PID:15944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6373.exe
        8⤵
        
        PID:14684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43243.exe
        7⤵
        
        PID:8544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13488.exe
        8⤵
        
        PID:12324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14508.exe
        8⤵
        
        PID:3836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51707.exe
        7⤵
        
        PID:12604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27370.exe
        7⤵
        
        PID:6072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27047.exe
        6⤵
        
        PID:7064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43649.exe
        7⤵
        
        PID:7872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37971.exe
        7⤵
        
        PID:12660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9967.exe
        7⤵
        
        PID:4380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31492.exe
        7⤵
        
        PID:5216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56159.exe
        6⤵
        
        PID:10052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10675.exe
        6⤵
        
        PID:14300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25230.exe
        6⤵
        
        PID:15188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6373.exe
        6⤵
        
        PID:3880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46404.exe
        5⤵
        
        PID:4144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4956.exe
        6⤵
        
        PID:5832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62917.exe
        7⤵
        
        PID:8920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33887.exe
        7⤵
        
        PID:12776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43744.exe
        7⤵
        
        PID:5696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32527.exe
        6⤵
        
        PID:9768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25038.exe
        6⤵
        
        PID:13332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54845.exe
        6⤵
        
        PID:6768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16086.exe
        5⤵
        
        PID:7016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51817.exe
        6⤵
        
        PID:9020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15387.exe
        6⤵
        
        PID:13224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10735.exe
        6⤵
        
        PID:1788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5843.exe
        6⤵
        
        PID:14792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62024.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:10096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17579.exe
        5⤵
        
        PID:15032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17707.exe
        5⤵
        
        PID:1172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57295.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57295.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45251.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47837.exe
        6⤵
        
        PID:10944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63828.exe
        6⤵
        
        PID:15284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14508.exe
        6⤵
        
        PID:14576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62024.exe
        5⤵
        
        PID:10064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17579.exe
        5⤵
        
        PID:15040
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 15040 -s 436
        6⤵
        Program crash
        
        PID:14412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54463.exe
        5⤵
        
        PID:2136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6855.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6855.exe
      4⤵
      PID:5948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47437.exe
        5⤵
        
        PID:7744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27602.exe
        6⤵
        
        PID:5440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58864.exe
        5⤵
        
        PID:5996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42343.exe
        5⤵
        
        PID:14924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18003.exe
        5⤵
        
        PID:5444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53027.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53027.exe
      4⤵
      PID:5960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35495.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35495.exe
      4⤵
      PID:11768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59289.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59289.exe
      4⤵
      PID:15932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45355.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45355.exe
      4⤵
      PID:15756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4128.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4128.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6232
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49267.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49267.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46757.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46757.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63425.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41499.exe
        6⤵
        
        PID:6016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32985.exe
        7⤵
        
        PID:7236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42845.exe
        8⤵
        
        PID:11600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18592.exe
        8⤵
        
        PID:4004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39211.exe
        7⤵
        
        PID:11284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2270.exe
        7⤵
        
        PID:15488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31611.exe
        7⤵
        
        PID:14172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6373.exe
        7⤵
        
        PID:5000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15754.exe
        6⤵
        
        PID:8800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53488.exe
        6⤵
        
        PID:13000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31111.exe
        6⤵
        
        PID:6988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45008.exe
        5⤵
        
        PID:5736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12372.exe
        6⤵
        
        PID:7100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45969.exe
        7⤵
        
        PID:11188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18592.exe
        7⤵
        
        PID:15760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6347.exe
        6⤵
        
        PID:11268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39987.exe
        6⤵
        
        PID:15632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48558.exe
        6⤵
        
        PID:1088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24306.exe
        5⤵
        
        PID:8288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57188.exe
        5⤵
        
        PID:12112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50379.exe
        5⤵
        
        PID:988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2719.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2719.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63145.exe
        5⤵
        
        PID:5132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4956.exe
        6⤵
        
        PID:2524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20925.exe
        7⤵
        
        PID:8376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62284.exe
        7⤵
        
        PID:11016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17750.exe
        7⤵
        
        PID:16216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54845.exe
        7⤵
        
        PID:3012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65200.exe
        6⤵
        
        PID:9504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25038.exe
        6⤵
        
        PID:13356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54845.exe
        6⤵
        
        PID:3644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43087.exe
        5⤵
        
        PID:5980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13680.exe
        6⤵
        
        PID:12504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5062.exe
        6⤵
        
        PID:16300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14508.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54152.exe
        5⤵
        
        PID:9388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10954.exe
        5⤵
        
        PID:15364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50265.exe
        5⤵
        
        PID:16288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28352.exe
        5⤵
        
        PID:17008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-990.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-990.exe
      4⤵
      PID:5972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56721.exe
        5⤵
        
        PID:7912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59876.exe
        6⤵
        
        PID:10452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7750.exe
        6⤵
        
        PID:14724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48147.exe
        6⤵
        
        PID:5060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54845.exe
        6⤵
        
        PID:15828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30519.exe
        5⤵
        
        PID:10284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50887.exe
        5⤵
        
        PID:14208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43744.exe
        5⤵
        
        PID:2424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42616.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42616.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:8344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16810.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16810.exe
      4⤵
      PID:12468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38028.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38028.exe
      4⤵
      PID:5268
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17903.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17903.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29491.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29491.exe
      4⤵
      PID:1184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50976.exe
        5⤵
        
        PID:6696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15637.exe
        6⤵
        
        PID:10016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40659.exe
        6⤵
        
        PID:12596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5843.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:15772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18058.exe
        5⤵
        
        PID:9812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2891.exe
        5⤵
        
        PID:13912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13362.exe
        5⤵
        
        PID:14224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44043.exe
        5⤵
        
        PID:6024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64363.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64363.exe
      4⤵
      PID:216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20925.exe
        5⤵
        
        PID:8392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34109.exe
        6⤵
        
        PID:14700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43673.exe
        6⤵
        
        PID:15376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62284.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58400.exe
        5⤵
        
        PID:15192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54845.exe
        5⤵
        
        PID:15560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15371.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15371.exe
      4⤵
      PID:9784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41176.exe
        5⤵
        
        PID:6256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22238.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22238.exe
      4⤵
      PID:13428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54463.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54463.exe
      4⤵
      PID:15596
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21822.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21822.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:5096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33405.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33405.exe
      4⤵
      PID:4328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32969.exe
        5⤵
        
        PID:5660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60805.exe
        6⤵
        
        PID:8008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2580.exe
        7⤵
        
        PID:2628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8954.exe
        7⤵
        
        PID:15912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14508.exe
        7⤵
        
        PID:15796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23259.exe
        6⤵
        
        PID:10772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6373.exe
        6⤵
        
        PID:16080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43243.exe
        5⤵
        
        PID:8680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47623.exe
        5⤵
        
        PID:12752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43618.exe
        5⤵
        
        PID:9980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3119.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3119.exe
      4⤵
      PID:6456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59793.exe
        5⤵
        
        PID:9208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37971.exe
        5⤵
        
        PID:12720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35576.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55967.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55967.exe
      4⤵
      PID:9976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63960.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63960.exe
      4⤵
      PID:13380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50379.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50379.exe
      4⤵
      PID:16136
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39407.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39407.exe
    3⤵
    PID:5752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2512.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2512.exe
      4⤵
      PID:7772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58864.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58864.exe
      4⤵
      PID:11240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42343.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42343.exe
      4⤵
      PID:14844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44043.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44043.exe
      4⤵
      PID:18408
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49665.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49665.exe
    3⤵
    PID:7612
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1866.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1866.exe
    3⤵
    PID:11900
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44291.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44291.exe
    3⤵
    PID:16016
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2743.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2743.exe
    3⤵
    PID:16380
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23728.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23728.exe
    3⤵
    PID:2484
- C:\Users\Admin\AppData\Local\Temp\Unicorn-22023.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-22023.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3308
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15568.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15568.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59481.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59481.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9808.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19897.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:32
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14032.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34941.exe
        8⤵
        
        PID:5484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47437.exe
        9⤵
        
        PID:7688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9927.exe
        10⤵
        
        PID:1016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58864.exe
        9⤵
        
        PID:9476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42343.exe
        9⤵
        
        PID:14860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49735.exe
        9⤵
        
        PID:14784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10457.exe
        9⤵
        
        PID:2560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21671.exe
        8⤵
        
        PID:8188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13798.exe
        8⤵
        
        PID:11748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10457.exe
        8⤵
        
        PID:2360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46544.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14292.exe
        8⤵
        
        PID:9112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4280.exe
        9⤵
        
        PID:4988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42055.exe
        8⤵
        
        PID:12556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59551.exe
        8⤵
        
        PID:15176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42832.exe
        8⤵
        
        PID:15640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43744.exe
        8⤵
        
        PID:14852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54431.exe
        7⤵
        
        PID:9652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34988.exe
        7⤵
        
        PID:12800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39238.exe
        7⤵
        
        PID:5128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55620.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13752.exe
        7⤵
        
        PID:5256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50805.exe
        8⤵
        
        PID:6416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50089.exe
        9⤵
        
        PID:7684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16575.exe
        9⤵
        
        PID:9404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62563.exe
        9⤵
        
        PID:13868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22027.exe
        9⤵
        
        PID:15608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52039.exe
        9⤵
        
        PID:15308
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 15308 -s 80
        10⤵
        Program crash
        
        PID:15636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55805.exe
        9⤵
        
        PID:828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40695.exe
        8⤵
        
        PID:9684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9404.exe
        9⤵
        
        PID:12332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14508.exe
        9⤵
        
        PID:6640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29122.exe
        8⤵
        
        PID:12904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37.exe
        8⤵
        
        PID:4780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3119.exe
        7⤵
        
        PID:6384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65133.exe
        8⤵
        
        PID:10928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43984.exe
        8⤵
        
        PID:15220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14508.exe
        8⤵
        
        PID:6824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65059.exe
        7⤵
        
        PID:8236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32632.exe
        7⤵
        
        PID:464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-551.exe
        7⤵
        
        PID:16228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62408.exe
        6⤵
        
        PID:6792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20925.exe
        7⤵
        
        PID:8404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62284.exe
        7⤵
        
        PID:12284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22172.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64075.exe
        6⤵
        
        PID:9860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35059.exe
        6⤵
        
        PID:13632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43249.exe
        6⤵
        
        PID:7096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12372.exe
        6⤵
        
        PID:4584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13243.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64385.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59637.exe
        7⤵
        
        PID:5500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23753.exe
        8⤵
        
        PID:6944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35481.exe
        9⤵
        
        PID:8676
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8676 -s 380
        10⤵
        Program crash
        
        PID:9472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6347.exe
        9⤵
        
        PID:10892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54845.exe
        9⤵
        
        PID:15988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38339.exe
        8⤵
        
        PID:10176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4810.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:14312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56295.exe
        8⤵
        
        PID:15584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6191.exe
        7⤵
        
        PID:7404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15416.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:14692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60445.exe
        8⤵
        
        PID:15896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31758.exe
        7⤵
        
        PID:11004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48208.exe
        7⤵
        
        PID:14772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50379.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:16280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50628.exe
        6⤵
        
        PID:5156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5164.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50828.exe
        8⤵
        
        PID:1272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7550.exe
        7⤵
        
        PID:12460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37.exe
        7⤵
        
        PID:15868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62756.exe
        6⤵
        
        PID:8360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23966.exe
        6⤵
        
        PID:14324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45044.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:14360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28898.exe
        5⤵
        Executes dropped EXE
        
        PID:3372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55361.exe
        6⤵
        
        PID:5416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47437.exe
        7⤵
        
        PID:7708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17825.exe
        8⤵
        
        PID:16144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8643.exe
        8⤵
        
        PID:5020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58864.exe
        7⤵
        
        PID:11148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42343.exe
        7⤵
        
        PID:14932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39238.exe
        7⤵
        
        PID:1808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46176.exe
        6⤵
        
        PID:7936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1354.exe
        6⤵
        
        PID:11680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6373.exe
        6⤵
        
        PID:15812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4691.exe
        5⤵
        
        PID:6124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8288.exe
        6⤵
        
        PID:5640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51464.exe
        6⤵
        
        PID:11328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-647.exe
        6⤵
        
        PID:15544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54845.exe
        6⤵
        
        PID:1180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1662.exe
        5⤵
        
        PID:8984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28287.exe
        5⤵
        
        PID:13056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21808.exe
        5⤵
        
        PID:15424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63072.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63072.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33109.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35029.exe
        6⤵
        
        PID:4536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39025.exe
        7⤵
        
        PID:5468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27837.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15933.exe
        9⤵
        
        PID:10972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63828.exe
        9⤵
        
        PID:15196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14508.exe
        9⤵
        
        PID:6576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53628.exe
        8⤵
        
        PID:11172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12026.exe
        8⤵
        
        PID:15300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31492.exe
        8⤵
        
        PID:4076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6191.exe
        7⤵
        
        PID:7412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55865.exe
        8⤵
        
        PID:13008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14508.exe
        8⤵
        
        PID:3636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7062.exe
        7⤵
        
        PID:11168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12455.exe
        7⤵
        
        PID:12696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18859.exe
        7⤵
        
        PID:5608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50628.exe
        6⤵
        
        PID:5508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56529.exe
        7⤵
        
        PID:8176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2284.exe
        8⤵
        
        PID:11496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5843.exe
        8⤵
        
        PID:15876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47380.exe
        7⤵
        
        PID:10876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47195.exe
        7⤵
        
        PID:15568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46803.exe
        7⤵
        
        PID:3528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52642.exe
        7⤵
        
        PID:15524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40451.exe
        6⤵
        
        PID:8820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57572.exe
        6⤵
        
        PID:13032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32438.exe
        6⤵
        
        PID:15324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26794.exe
        6⤵
        
        PID:6332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6995.exe
        5⤵
        Suspicious use of SetWindowsHookEx
        
        PID:2064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2652.exe
        6⤵
        
        PID:5360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23753.exe
        7⤵
        
        PID:6012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23613.exe
        8⤵
        
        PID:9532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11303.exe
        8⤵
        
        PID:12640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5843.exe
        8⤵
        
        PID:16000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55216.exe
        7⤵
        
        PID:8916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10238.exe
        7⤵
        
        PID:14236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6191.exe
        6⤵
        
        PID:7384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22617.exe
        7⤵
        
        PID:13748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2427.exe
        7⤵
        
        PID:14500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14508.exe
        7⤵
        
        PID:2796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7062.exe
        6⤵
        
        PID:9168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12455.exe
        6⤵
        
        PID:12744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16580.exe
        6⤵
        
        PID:16128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5559.exe
        6⤵
        
        PID:7152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64363.exe
        5⤵
        
        PID:5276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-504.exe
        6⤵
        
        PID:8104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53156.exe
        6⤵
        
        PID:11688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58929.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:17372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19263.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26322.exe
        5⤵
        
        PID:4352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54463.exe
        5⤵
        
        PID:7096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39039.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39039.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15725.exe
        5⤵
        
        PID:2120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22963.exe
        6⤵
        
        PID:7080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33945.exe
        7⤵
        
        PID:6948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61324.exe
        7⤵
        
        PID:11640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47187.exe
        7⤵
        
        PID:16140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54845.exe
        7⤵
        
        PID:15432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1303.exe
        6⤵
        
        PID:6884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23966.exe
        6⤵
        
        PID:13896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50379.exe
        6⤵
        
        PID:14420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10327.exe
        5⤵
        
        PID:6360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22845.exe
        6⤵
        
        PID:9092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37971.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:12728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30962.exe
        6⤵
        
        PID:14772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31492.exe
        6⤵
        
        PID:6008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1722.exe
        5⤵
        
        PID:9428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2891.exe
        5⤵
        
        PID:13948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43322.exe
        5⤵
        
        PID:1288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35880.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35880.exe
      4⤵
      PID:2768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23649.exe
        5⤵
        
        PID:5532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29757.exe
        6⤵
        
        PID:6004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35253.exe
        7⤵
        
        PID:4900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14508.exe
        7⤵
        
        PID:6840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34551.exe
        6⤵
        
        PID:9996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17646.exe
        6⤵
        
        PID:14712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36060.exe
        6⤵
        
        PID:16328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36271.exe
        6⤵
        
        PID:15372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39534.exe
        6⤵
        
        PID:14168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61360.exe
        5⤵
        
        PID:7832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12106.exe
        5⤵
        
        PID:9472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31872.exe
        5⤵
        
        PID:15324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13431.exe
        5⤵
        
        PID:16632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43883.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43883.exe
      4⤵
      PID:5140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52445.exe
        5⤵
        
        PID:6168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39337.exe
        6⤵
        
        PID:13396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10106.exe
        6⤵
        
        PID:15140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14508.exe
        6⤵
        
        PID:7000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51464.exe
        5⤵
        
        PID:10868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47195.exe
        5⤵
        
        PID:15560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44043.exe
        5⤵
        
        PID:6052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54748.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54748.exe
      4⤵
      PID:8964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14536.exe
        5⤵
        
        PID:11536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60319.exe
        5⤵
        
        PID:15560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5843.exe
        5⤵
        
        PID:15852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49437.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49437.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:13048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59609.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59609.exe
      4⤵
      PID:15864
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64120.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64120.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25761.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25761.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17349.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24277.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12932.exe
        7⤵
        
        PID:6080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12372.exe
        8⤵
        
        PID:6600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51464.exe
        8⤵
        
        PID:10832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6373.exe
        8⤵
        
        PID:4236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56264.exe
        7⤵
        
        PID:8992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47623.exe
        7⤵
        
        PID:12764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18625.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:14384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48620.exe
        6⤵
        
        PID:5456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1080.exe
        7⤵
        
        PID:7352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11931.exe
        7⤵
        
        PID:11884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54845.exe
        7⤵
        
        PID:16168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62791.exe
        6⤵
        
        PID:9888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21862.exe
        6⤵
        
        PID:15068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65436.exe
        6⤵
        
        PID:3188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56295.exe
        6⤵
        
        PID:18376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46404.exe
        5⤵
        
        PID:4136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46529.exe
        6⤵
        
        PID:6268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20925.exe
        7⤵
        
        PID:8384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43613.exe
        8⤵
        
        PID:13568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14508.exe
        8⤵
        
        PID:14640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62284.exe
        7⤵
        
        PID:12260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54845.exe
        7⤵
        
        PID:15788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40363.exe
        6⤵
        
        PID:8812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32632.exe
        6⤵
        
        PID:11544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54463.exe
        6⤵
        
        PID:1636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38619.exe
        5⤵
        
        PID:7044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43457.exe
        6⤵
        
        PID:9132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6419.exe
        7⤵
        
        PID:5708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33887.exe
        6⤵
        
        PID:12784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6796.exe
        6⤵
        
        PID:1384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45496.exe
        5⤵
        
        PID:9740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31174.exe
        5⤵
        
        PID:13440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49128.exe
        5⤵
        
        PID:4112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43559.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43559.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29129.exe
        5⤵
        
        PID:932
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 932 -s 628
        6⤵
        Program crash
        
        PID:6848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31899.exe
        5⤵
        
        PID:6260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49705.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59461.exe
        7⤵
        
        PID:9452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54845.exe
        7⤵
        
        PID:1820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53348.exe
        6⤵
        
        PID:11800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54845.exe
        6⤵
        
        PID:14460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1338.exe
        5⤵
        
        PID:9836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57217.exe
        6⤵
        
        PID:14604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9927.exe
        6⤵
        
        PID:15504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60260.exe
        5⤵
        
        PID:1420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6373.exe
        5⤵
        
        PID:15652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46491.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46491.exe
      4⤵
      PID:5680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12372.exe
        5⤵
        
        PID:7112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47380.exe
        5⤵
        
        PID:10852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10457.exe
        5⤵
        
        PID:1200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17727.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17727.exe
      4⤵
      PID:8196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31034.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31034.exe
      4⤵
      PID:11956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22187.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22187.exe
      4⤵
      PID:16064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42908.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42908.exe
      4⤵
      PID:5872
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40051.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40051.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13072.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13072.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27785.exe
        5⤵
        
        PID:1176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52813.exe
        6⤵
        
        PID:5180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62533.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17381.exe
        8⤵
        
        PID:12380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6319.exe
        8⤵
        
        PID:15996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55415.exe
        8⤵
        
        PID:16304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14508.exe
        8⤵
        
        PID:2100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53156.exe
        7⤵
        
        PID:11672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23783.exe
        6⤵
        
        PID:8096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39729.exe
        7⤵
        
        PID:14576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25275.exe
        7⤵
        
        PID:7104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51707.exe
        6⤵
        
        PID:12652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36690.exe
        6⤵
        
        PID:16236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13103.exe
        5⤵
        
        PID:3048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35481.exe
        6⤵
        
        PID:8260
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8260 -s 408
        7⤵
        Program crash
        
        PID:9440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14374.exe
        6⤵
        
        PID:12120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54845.exe
        6⤵
        
        PID:15476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38287.exe
        5⤵
        
        PID:10024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50643.exe
        5⤵
        
        PID:15088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47406.exe
        5⤵
        
        PID:2132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24447.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24447.exe
      4⤵
      PID:1068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60405.exe
        5⤵
        
        PID:5920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57577.exe
        6⤵
        
        PID:7048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65133.exe
        7⤵
        
        PID:10956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2375.exe
        7⤵
        
        PID:15276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14508.exe
        7⤵
        
        PID:15936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34551.exe
        6⤵
        
        PID:10124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42919.exe
        6⤵
        
        PID:3968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60280.exe
        6⤵
        
        PID:5768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6191.exe
        5⤵
        
        PID:7420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40629.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63828.exe
        6⤵
        
        PID:15292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51523.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:14872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31421.exe
        6⤵
        
        PID:6112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7062.exe
        5⤵
        
        PID:9556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12455.exe
        5⤵
        
        PID:12704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18859.exe
        5⤵
        
        PID:6000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26838.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26838.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13332.exe
        5⤵
        
        PID:7448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7160.exe
        6⤵
        
        PID:15364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11931.exe
        5⤵
        
        PID:11888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37.exe
        5⤵
        
        PID:1116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52128.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52128.exe
      4⤵
      PID:9760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38575.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38575.exe
      4⤵
      PID:13444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41175.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41175.exe
      4⤵
      PID:15896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29959.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29959.exe
      4⤵
      PID:640
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29336.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29336.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24661.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24661.exe
      4⤵
      PID:1964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7696.exe
        5⤵
        
        PID:1544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20925.exe
        6⤵
        
        PID:8468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33887.exe
        6⤵
        
        PID:12712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44512.exe
        6⤵
        
        PID:6592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47712.exe
        5⤵
        
        PID:8296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12018.exe
        5⤵
        
        PID:13292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9728.exe
        5⤵
        
        PID:13800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9211.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9211.exe
      4⤵
      PID:5648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54173.exe
        5⤵
        
        PID:7620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31811.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:11604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30598.exe
        5⤵
        
        PID:16932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1303.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1303.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23966.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23966.exe
      4⤵
      PID:14296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12372.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12372.exe
      4⤵
      PID:5232
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3478.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3478.exe
    3⤵
    PID:908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44645.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44645.exe
      4⤵
      PID:3576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50089.exe
        5⤵
        
        PID:7784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16575.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62563.exe
        5⤵
        
        PID:13888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47904.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47904.exe
      4⤵
      PID:8976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25038.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25038.exe
      4⤵
      PID:13076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37.exe
      4⤵
      PID:18388
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25531.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25531.exe
    3⤵
    PID:7036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50089.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50089.exe
      4⤵
      PID:7716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4323.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4323.exe
      4⤵
      PID:9576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34036.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34036.exe
      4⤵
      PID:14776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46803.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46803.exe
      4⤵
      PID:14800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36271.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36271.exe
      4⤵
      PID:16088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30598.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30598.exe
      4⤵
      PID:16940
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64605.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64605.exe
    3⤵
    PID:9880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20077.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20077.exe
      4⤵
      PID:15240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60445.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60445.exe
      4⤵
      PID:996
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30594.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30594.exe
    3⤵
    PID:11448
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64548.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64548.exe
    3⤵
    PID:16356
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62149.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62149.exe
    3⤵
    PID:15628
- C:\Users\Admin\AppData\Local\Temp\Unicorn-30818.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-30818.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4968
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51313.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51313.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46181.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46181.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55257.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29321.exe
        6⤵
        
        PID:3800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4956.exe
        7⤵
        
        PID:5308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37453.exe
        8⤵
        
        PID:7292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-255.exe
        8⤵
        
        PID:11840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61559.exe
        8⤵
        
        PID:15944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61308.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:9776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25038.exe
        7⤵
        
        PID:12320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22081.exe
        7⤵
        
        PID:6936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11095.exe
        6⤵
        
        PID:6956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29093.exe
        7⤵
        
        PID:8044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4147.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:11724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54845.exe
        7⤵
        
        PID:14344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62756.exe
        6⤵
        
        PID:9172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23966.exe
        6⤵
        
        PID:12436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16580.exe
        6⤵
        
        PID:15864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9067.exe
        6⤵
        
        PID:16996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47172.exe
        5⤵
        
        PID:5288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46721.exe
        6⤵
        
        PID:6448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25969.exe
        7⤵
        
        PID:9008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33887.exe
        7⤵
        
        PID:12572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18518.exe
        7⤵
        
        PID:5572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63309.exe
        7⤵
        
        PID:7060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53524.exe
        6⤵
        
        PID:9456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62563.exe
        6⤵
        
        PID:13964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16854.exe
        5⤵
        
        PID:6176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35481.exe
        6⤵
        
        PID:8540
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8540 -s 380
        7⤵
        Program crash
        
        PID:9432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47380.exe
        6⤵
        
        PID:10808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47195.exe
        6⤵
        
        PID:15508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25230.exe
        6⤵
        
        PID:16308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6373.exe
        6⤵
        
        PID:4332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57940.exe
        5⤵
        
        PID:10216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2010.exe
        5⤵
        
        PID:14328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54463.exe
        5⤵
        
        PID:15092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27223.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27223.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59061.exe
        5⤵
        
        PID:3816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61749.exe
        6⤵
        
        PID:6188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40001.exe
        7⤵
        
        PID:8048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26021.exe
        8⤵
        
        PID:9544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33459.exe
        8⤵
        
        PID:15604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5843.exe
        8⤵
        
        PID:15848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35511.exe
        7⤵
        
        PID:10432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47195.exe
        7⤵
        
        PID:15536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6373.exe
        7⤵
        
        PID:2480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39351.exe
        6⤵
        
        PID:8444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48199.exe
        6⤵
        
        PID:12428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3119.exe
        5⤵
        
        PID:6208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13680.exe
        6⤵
        
        PID:12740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14508.exe
        6⤵
        
        PID:15308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65059.exe
        5⤵
        
        PID:9088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32632.exe
        5⤵
        
        PID:12736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6373.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56047.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56047.exe
      4⤵
      PID:6380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35097.exe
        5⤵
        
        PID:9296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15387.exe
        5⤵
        
        PID:12616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50960.exe
        5⤵
        
        PID:3428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64260.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64260.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:9900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60293.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60293.exe
      4⤵
      PID:13996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44.exe
      4⤵
      PID:6336
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34675.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34675.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53036.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53036.exe
      4⤵
      PID:1864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60405.exe
        5⤵
        
        PID:5936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30141.exe
        6⤵
        
        PID:7488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11088.exe
        7⤵
        
        PID:16156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10211.exe
        7⤵
        
        PID:16156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55991.exe
        7⤵
        
        PID:16332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36081.exe
        7⤵
        
        PID:1528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58864.exe
        6⤵
        
        PID:7496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42343.exe
        6⤵
        
        PID:14788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6373.exe
        6⤵
        
        PID:16252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-291.exe
        5⤵
        
        PID:6852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45969.exe
        6⤵
        
        PID:11656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38223.exe
        6⤵
        
        PID:15972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18592.exe
        6⤵
        
        PID:4588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29594.exe
        5⤵
        
        PID:11436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9067.exe
        5⤵
        
        PID:16916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24062.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24062.exe
      4⤵
      PID:6400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34063.exe
        5⤵
        
        PID:9872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58095.exe
        5⤵
        
        PID:13288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54845.exe
        5⤵
        
        PID:5084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7587.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7587.exe
      4⤵
      PID:9248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34107.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34107.exe
      4⤵
      PID:15056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37644.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37644.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5772
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53211.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53211.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50893.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50893.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30193.exe
        5⤵
        
        PID:6372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20925.exe
        6⤵
        
        PID:6172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48473.exe
        7⤵
        
        PID:3988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9927.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62284.exe
        6⤵
        
        PID:12276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54845.exe
        6⤵
        
        PID:2228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44780.exe
        5⤵
        
        PID:9592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25038.exe
        5⤵
        
        PID:13340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54845.exe
        5⤵
        
        PID:14404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2351.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2351.exe
      4⤵
      PID:7008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20925.exe
        5⤵
        
        PID:8152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4147.exe
        5⤵
        
        PID:11704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54845.exe
        5⤵
        
        PID:15428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46263.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46263.exe
      4⤵
      PID:9792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47240.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47240.exe
      4⤵
      PID:13416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56308.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56308.exe
      4⤵
      PID:16236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44043.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44043.exe
      4⤵
      PID:6220
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27276.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27276.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60805.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60805.exe
      4⤵
      PID:7876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63908.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63908.exe
      4⤵
      PID:10360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26006.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26006.exe
      4⤵
      PID:14520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6373.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6373.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1744
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33950.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33950.exe
    3⤵
    PID:8336
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3015.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3015.exe
    3⤵
    PID:11280
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25802.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25802.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:13796
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25892.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25892.exe
    3⤵
    PID:2784
- C:\Users\Admin\AppData\Local\Temp\Unicorn-63492.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-63492.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2904
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54541.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54541.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50021.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50021.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61801.exe
        5⤵
        
        PID:4740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20141.exe
        6⤵
        
        PID:4372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60805.exe
        7⤵
        
        PID:7892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13488.exe
        8⤵
        
        PID:12312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14508.exe
        8⤵
        
        PID:15768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63908.exe
        7⤵
        
        PID:10364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26006.exe
        7⤵
        
        PID:15308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49735.exe
        7⤵
        
        PID:16296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6373.exe
        7⤵
        
        PID:2292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5806.exe
        6⤵
        
        PID:9252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2891.exe
        6⤵
        
        PID:13876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13362.exe
        6⤵
        
        PID:464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6373.exe
        6⤵
        
        PID:4456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63804.exe
        5⤵
        
        PID:6972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40155.exe
        5⤵
        
        PID:4548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15933.exe
        6⤵
        
        PID:11052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27263.exe
        6⤵
        
        PID:14372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18592.exe
        6⤵
        
        PID:5080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54152.exe
        5⤵
        
        PID:9736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40119.exe
        5⤵
        
        PID:6904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6373.exe
        5⤵
        
        PID:14744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9455.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9455.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44645.exe
        5⤵
        
        PID:5336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56913.exe
        6⤵
        
        PID:7972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40105.exe
        7⤵
        
        PID:13656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14508.exe
        7⤵
        
        PID:15620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23259.exe
        6⤵
        
        PID:10368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47195.exe
        6⤵
        
        PID:15528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31611.exe
        6⤵
        
        PID:15516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10457.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39351.exe
        5⤵
        
        PID:8436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22350.exe
        5⤵
        
        PID:10880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46803.exe
        5⤵
        
        PID:14684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36271.exe
        5⤵
        
        PID:15624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37.exe
        5⤵
        
        PID:5856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40207.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40207.exe
      4⤵
      PID:6748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20925.exe
        5⤵
        
        PID:8172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62284.exe
        5⤵
        
        PID:12268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55102.exe
        5⤵
        
        PID:16968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54091.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54091.exe
      4⤵
      PID:8456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7431.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7431.exe
      4⤵
      PID:13640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21808.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21808.exe
      4⤵
      PID:6100
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50768.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50768.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37489.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37489.exe
      4⤵
      PID:2680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60125.exe
        5⤵
        
        PID:6652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46353.exe
        6⤵
        
        PID:12420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18592.exe
        6⤵
        
        PID:3840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1739.exe
        5⤵
        
        PID:9424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50887.exe
        5⤵
        
        PID:13464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32187.exe
        5⤵
        
        PID:2572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60810.exe
        5⤵
        
        PID:5324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50732.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50732.exe
      4⤵
      PID:7268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53893.exe
        5⤵
        
        PID:14468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18187.exe
        5⤵
        
        PID:16236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59625.exe
        5⤵
        
        PID:3156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48287.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48287.exe
      4⤵
      PID:10376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60460.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60460.exe
      4⤵
      PID:13612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50379.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50379.exe
      4⤵
      PID:3612
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25878.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25878.exe
    3⤵
    PID:5664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13420.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13420.exe
      4⤵
      PID:5796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11848.exe
        5⤵
        
        PID:11204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35431.exe
        5⤵
        
        PID:14404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14508.exe
        5⤵
        
        PID:6540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34551.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34551.exe
      4⤵
      PID:9644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44043.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44043.exe
      4⤵
      PID:2196
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48480.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48480.exe
    3⤵
    PID:7992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41869.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41869.exe
      4⤵
      PID:10032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28215.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28215.exe
      4⤵
      PID:13468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50960.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50960.exe
      4⤵
      PID:6140
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25118.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25118.exe
    3⤵
    PID:10256
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31551.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31551.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:14224
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50690.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50690.exe
    3⤵
    PID:15528
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16456.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16456.exe
    3⤵
    PID:16340
- C:\Users\Admin\AppData\Local\Temp\Unicorn-21874.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-21874.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1972
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55257.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55257.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45251.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45251.exe
      4⤵
      PID:6856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33945.exe
        5⤵
        
        PID:7840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53156.exe
        5⤵
        
        PID:11664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37.exe
        5⤵
        
        PID:18416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7203.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7203.exe
      4⤵
      PID:9828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51595.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51595.exe
      4⤵
      PID:13368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63952.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63952.exe
      4⤵
      PID:16200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49128.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49128.exe
      4⤵
      PID:14588
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45008.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45008.exe
    3⤵
    PID:5744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63559.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63559.exe
      4⤵
      PID:8864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2891.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2891.exe
      4⤵
      PID:13804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10457.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10457.exe
      4⤵
      PID:1932
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40643.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40643.exe
    3⤵
    PID:8216
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43784.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43784.exe
    3⤵
    PID:11928
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38723.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38723.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:16048
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27297.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27297.exe
    3⤵
    PID:14368
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50379.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50379.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:15408
- C:\Users\Admin\AppData\Local\Temp\Unicorn-21623.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-21623.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3972
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13752.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13752.exe
    3⤵
    PID:5248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60509.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60509.exe
      4⤵
      PID:6460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46581.exe
        5⤵
        
        PID:8844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37971.exe
        5⤵
        
        PID:12588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26686.exe
        5⤵
        
        PID:15404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42832.exe
        5⤵
        
        PID:15652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25976.exe
        5⤵
        
        PID:13844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12107.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12107.exe
      4⤵
      PID:10000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54395.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54395.exe
      4⤵
      PID:4424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54845.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54845.exe
      4⤵
      PID:6968
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42947.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42947.exe
    3⤵
    PID:7172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9404.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9404.exe
      4⤵
      PID:12300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18592.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18592.exe
      4⤵
      PID:228
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48287.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48287.exe
    3⤵
    PID:10268
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23512.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23512.exe
    3⤵
    PID:6248
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50379.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50379.exe
    3⤵
    PID:16056
- C:\Users\Admin\AppData\Local\Temp\Unicorn-44413.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-44413.exe
  2⤵
  PID:4600
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44365.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44365.exe
    3⤵
    PID:6692
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24589.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24589.exe
      4⤵
      PID:11620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55991.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55991.exe
      4⤵
      PID:2808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56501.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56501.exe
      4⤵
      PID:4596
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14131.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14131.exe
    3⤵
    PID:9608
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54595.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54595.exe
    3⤵
    PID:14768
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6373.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6373.exe
    3⤵
    PID:15480
- C:\Users\Admin\AppData\Local\Temp\Unicorn-20822.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-20822.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:7452
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23585.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23585.exe
    3⤵
    PID:14680
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12727.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12727.exe
    3⤵
    PID:15540
- C:\Users\Admin\AppData\Local\Temp\Unicorn-43463.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-43463.exe
  2⤵
  PID:11028
- C:\Users\Admin\AppData\Local\Temp\Unicorn-17407.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-17407.exe
  2⤵
  PID:14836
- C:\Users\Admin\AppData\Local\Temp\Unicorn-64065.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-64065.exe
  2⤵
  PID:15496

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 932 -ip 932
1⤵
PID:1032

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 8260 -ip 8260
1⤵
PID:9248

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 8540 -ip 8540
1⤵
PID:9324

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 8676 -ip 8676
1⤵
PID:9380

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:17308

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-12038.exe

Filesize
468KB

MD5
65187cfc4e1659f076c98c172e554bf0

SHA1
ca30acaaa23125e8b51ec9711054fe8b36a60ec9

SHA256
14866df687460505e030822089a62bfa707b12afaa6260a27e57b74621630f7e

SHA512
36e64eb62a0c1348a912e9b283742f379617b67654f80c46b2e72fa7b34975c379724277f71e0060b7f5fb3054565bd4f4c99de9362c5ad207ee0d8da43d6bb7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-15568.exe

Filesize
468KB

MD5
2011b2c5ebbc8a7c8b33e856b14eb3b1

SHA1
41ab98359ac0a58b15ac06975b379412652ad939

SHA256
b6d2ac4d5adac6d1f06909e622c82f231e0d68875cddd139fd961b23aa9f2c40

SHA512
845132cc6c1c8097a72f5cfa760751427dfc6bd6d4fe00dc1cd5eb54ee47e3942332c4500be15188b1fbd818aa8edb90dd0bbf8fc5b4abb6065a835156b27d93

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-17903.exe

Filesize
468KB

MD5
f23a8e123e9bd9cb7699acd47fdbc9f8

SHA1
e9d90d40359adbadc346f2946d0f00c81d26d808

SHA256
b372db9db39535c52c10502f6eea638e3cb47a64815d151f40efb0aab2eba7ac

SHA512
b9234a5e02d0ab54e0f559a1984fcbe855acc356e3aa3f41f5c241c52f57f7c38f5f6d86811f270f8d229ee3bcd54c598963ee7f19f3518c7e1eba1c37a7ece2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-18147.exe

Filesize
468KB

MD5
24f7981574dc8cf471eaa73bf4194d80

SHA1
7e2a86c7bf789339bd7038c70fc477a9a4558655

SHA256
d4d36d024a436abbb1d855bd18737946bdb2b09fb18cfa21b3e23ef6c9c917c0

SHA512
ef3e5ef2d7941d4ad0a6bd0558d3dca1ff659ac9cb54faa10a6c354197a20d96454fd9a858f0422a0cc10e3c78b6ec9e4605b7a621cd5cfbfbd847f21da58e2e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-18553.exe

Filesize
468KB

MD5
f189c6d511c059ad793986ba799ca27a

SHA1
becb6422e545009153ce155d6b789bed4b473c0d

SHA256
f0fc8453f0eb97037a5870fc602cf7a227b50281a1017908fc0db8281729c176

SHA512
0129cd4d3e7bf67106797bbb0032dac634a1008bee19af952938ffbe6c39acd20809610357f906e8d117cb721809255d725a3183970a6a69186da69cd870ee45

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-19897.exe

Filesize
468KB

MD5
b2a27a4cd673753abcf49e88324a36d8

SHA1
7eb77e694663203764ce16623dec3f27cc2b3e07

SHA256
72120a25f93cb0042c0cb7b246dbf5bb3a90d5f62871419f0c3db4988138e62f

SHA512
bfc20fe87582d68224fd01b5868a2e63d2fc099da548167de98cb594122e2f2959f658086b2f0aaa05f9a4d3b30c9d204da0a64a7c0347ece39ad7155c8b66ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-21277.exe

Filesize
468KB

MD5
2f2cc71eeb73d45502c44b20d989f244

SHA1
b2d5f46c306a02391700dd9b6f337b75e19a7387

SHA256
4d634d0bd1f2da73218baa127b3e8b63d4e417ba59510ad98109d89307a0b45b

SHA512
3a8ddcc7b89b6e64d5295e1e4ab60b5218c63d8674b28355f3c566532d21d5e0d2b002dad4bf15340068993eadf3a0b5c4612917e459645e9ac283e275b48c4f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-21874.exe

Filesize
468KB

MD5
5dfad35a62119e150ae2daf00305e642

SHA1
fb57907cdbc0fd85178cb322ebdbf7b490dedbb7

SHA256
811c025c7f30f99f27912b10aab89c78f09288f24d26b2bb192707e89fece885

SHA512
5880b933d57014b7a58fd4d9590085e658e51675e872e0d96997c0b26590af935b411c26ceb633b004d427df9260769345d8518ec8366e264f10dac639c9f220

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-22023.exe

Filesize
468KB

MD5
f6d56c23d0c2b2dec9c469cba9ed428b

SHA1
611af38b4552d6febcd42b10abb10f6809baa7e0

SHA256
05f347eda2bdc7755e1a9eab51d0c4e599062b678875d5357f99247243d9d217

SHA512
6e2ec13bc284f55a6916d86920c5c85e1e2c75c0b4eda52fbb0cb2aa062858f4b8b81a957042b60ad2d1af7f8c3ae5030b2b697c2a21dd3ba16c75faf6dbc492

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-25761.exe

Filesize
468KB

MD5
d713fb1c3e0e9f6e3716bd5dcce97087

SHA1
fe3d5af45e6a0e76f81c9d7eb6ef60822a40d09b

SHA256
60b317d36415986c0770d844458afdccf5a6dd8ffa0745329fdf534e06e54cec

SHA512
fa0c80869a341f20cfb2ac5709f528c34b236047154f3a9a2bfd0fe4c6b4cb389a28642259de0464521d2122b32cf8d1036594d1ee17e548729f37fb17b8f19b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-29335.exe

Filesize
468KB

MD5
ea62ec840df7ed1b2ca435e779c45aae

SHA1
38ab1697eec8248a568ce28c500b8aed618b8a4b

SHA256
4fa319d0b174487a4c1a0cfefe930231e29e322b4eab0d39be78a94cbd106d3a

SHA512
fa21ea6c707b3e3ea79b8f50f38e661d6c7a14e8c70142740742c18f0e0bd35097c2ca9b79eb3e383b9b796e8d51cf1fa7b23ca8252ece91f5d1808c0fa899d7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-30818.exe

Filesize
468KB

MD5
93b064046385b4c09d2072603026da95

SHA1
5c62f79d256d031acf87e072d47021b4019a6072

SHA256
2e8dd112a62f1185684f5e1f15ef6777e89708aceba55fb714733d8ee6fac5f1

SHA512
dc282acdbec7c5c572e17b57aa58b758b86c283ef6e52779ddb00f74df8f887e77f94a06e5696ce8ff2f3225de73ff74af3d9c0031fe515b20db22b3b725d71d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-33109.exe

Filesize
468KB

MD5
503038f47b4ba56da48e1ec9f9e556d3

SHA1
f60efaad975196a02161e9fdebae2c3dbf3eae65

SHA256
172f564d315bb61ee4ac9113a52ef46dbc450e94ee02ef0665532241199a8299

SHA512
a809a17a402c1f708ab191189ae3120bd305e427df39f80124e4c6e8cf92782d2bb3a4bd13b18fd8321d5b12caf09ee61154d11b8a9336e995a64dbf1808d694

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-34675.exe

Filesize
468KB

MD5
b01f4cb45bbd3b65a5d804e4765002d4

SHA1
2f3480ff04d4ce99229c9e5a327ba8385d9ff3be

SHA256
d902d25bd0d2145b02aba0324b1bfeb2dcc38b5433f2a3d000897e543a549177

SHA512
6640388fee9df5d8a0e8e5739ea1dd7b578c5668770b1535808accf40c26ae767a54c45422613d8e34f24b25dae11a8b72c2d7d50c53b8fc57df3f8c94e9b6b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-40051.exe

Filesize
468KB

MD5
0d4049925202796a7a636a0df96b59f2

SHA1
0ff38416f2e0907859977054cd7936df08b06486

SHA256
de5105e4fbee95d333b68bdb03c2cfcb647891f51f19cd46746afc25b171786c

SHA512
4f6a76f366e1450afe4d4b79f3386086b0cfec6e08734f6ef398257b666258766762a59d1484d74663891bb5d610c4fb1c1431318d48bdda51e339ce6d045f7a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-43145.exe

Filesize
468KB

MD5
17eefd909bc10c34b72890155d81c1ea

SHA1
b58b5598a754fd759756edbfaccafe3637c6ed40

SHA256
492fa42614d6dcf2fc02fe71719d3888d5f4be37b47efbf4669ef26824fb5ae7

SHA512
c6cd6dab101823f7c02e48ac3ff6a0d69e32eebea1ef9d63afc4d21929c01ce85e2c83ca04087c8a34c3fea0d5190822b07d08333aea408bb2db674c93b27c4e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-46181.exe

Filesize
468KB

MD5
b91675df526420c7add0f95270959207

SHA1
b6c6b6a55c0b44621cc0201d751166d613b3f165

SHA256
2ee5fe1bc395924cbac7b16c0d59dcad6a92b41ba9866022690b0a594fa3ce49

SHA512
f874908aac37b04427dc53a34aa6ddd06167a7b0b8178395023c773aa3368b99a4194777fac0ddc6cec75fcb6eca8dbc4662baa55d64071d180765d6f9fb27c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-46757.exe

Filesize
468KB

MD5
f41c222dc36068ab89d1c2e717fe87f7

SHA1
323c74d0f5ad09403bde05493586c3e98132ef29

SHA256
d8ff31d992fb8e990048c61555509c80875b97ab3352dba02937049d720f885c

SHA512
cd41bce620baab714ee02f6cb49130048557b97e297abc9415d20cfd13ed685e6878381736cea666485492ccc57b9237eaed0afbf02bdf3c8cf1f1083693f2f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-49201.exe

Filesize
468KB

MD5
1d38d7a1e31859b230cd077aab585de7

SHA1
9a752a318b1bfe915ea1449f1c1506b6ab60ff28

SHA256
d8a9462bf1983cf3f6a70200db7ef2831f10494c5497a98a8bdcd692c92a19cf

SHA512
b131201256077035d643bd83e91c00043ab8b1965b6681fb3edb7ec884c64fde856e11d6203a81cd6f033a8e68248fb8b9c326421e1755e4a2d0695dfac420b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-49267.exe

Filesize
468KB

MD5
7ad70508bd2248919a0ca81daa9a14fe

SHA1
bea00c7225c7097ee46daaabc9d5e65f1dabc1ae

SHA256
955f28c32bde75460e190985fa9ddcfa427e5ca76cf4b2391cb5c3ed0c5aa161

SHA512
809da4569856f5674a5a0522233c85bb0df2421337e57a84323da572a8720229f536ba54aa504210c145ab23ac9e046c7dadba02b3aa6a4e3c22a1fe1e34558a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-50265.exe

Filesize
468KB

MD5
8e930c47c05a2dafe1daa3f6c2fbb407

SHA1
e37f80923bfc2392c71db0fb8705c73721806aeb

SHA256
629d92dbeae28ddfdc3e2241a2fe5f932ef2aba2dbb705ab93915b692af6675a

SHA512
9beffcdefc53e7c169b5a4e5362a9ca900db81ac86ba157c05b89e88d73a54c5958c788849a28e8594bded506bd4d2852e315e799f00e98f39a92a361693039b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-51313.exe

Filesize
468KB

MD5
f9ae3e37f961bf76649c551a69310d42

SHA1
cb3dc3ddaa33036170d5af12939ddcf5ed6eac5c

SHA256
b8cbadac2ceee26100fcce3b8114b77d5175c31691e694446c7b4f984b440041

SHA512
1102ff40b037db14f81a91de71bd50773b7d2848bc568099070067f37bf4275d1f4859e94e0c4428ca0e9b15a2f4f0a1d922583f1097160c590c4c424bfbee07

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-52060.exe

Filesize
468KB

MD5
3067a2d330995811aaac243e125dd0c4

SHA1
5bf152dfcb450b76991c6f1bd42b12a2693a61b2

SHA256
8e2addbbc0cd8c0211d466d67c674cc1141c33c97153cb11d5e10a7d875126f9

SHA512
7e9e8433a63c87d7407a706f0f8834ae95ca7e7bfa1528f04ad5c394c9440a94fde4fcadb12d35d13450310009095660804f96e4d9102bf20457e6b443e39348

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-52728.exe

Filesize
468KB

MD5
236df89e49fae8f0a88162036acfbfba

SHA1
a7c128b14368731ad23960f29b615759d97d40ea

SHA256
6fde4097d64128cdc4e1e866ea5376a2765fad9ffdad7d1542c88d74b278d160

SHA512
1a951e56da39a7dc54445cb39a7c0969e90a83b4029a40c2971587bbc5d45e523154ffe84761fe586a8a086bc1b7cccdda04183723a767d1ca3dd4eb8a551efb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-54541.exe

Filesize
468KB

MD5
0bb8fb66ec7fa1ea03968270847bf18b

SHA1
d577fa0efa0b0eaf1fd0d95ac9c59b7bd6041f83

SHA256
b42555c78cafe5068b5bb8d3a3310f2bb980f56711e630e4e5b2ed6a34d703eb

SHA512
cdf1f52d48950baebc8a79b87388ff04984050be433e8487b96a007cd33cc2efa779e3f3ab6659c68bdd3166c1dbcc552377e2ec17ffc555606b2f548860dcf6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-55397.exe

Filesize
468KB

MD5
3d7c084740af55f901bd91f5e28281ef

SHA1
b7d867c9e2e41490a22916468df062bae9362b3d

SHA256
60dd8f0ae85a50e8d9520150ae9a3cb9ad852188e151df0d0395c97221160049

SHA512
fe1df9b828b24facddf816407b3ede4f72c307913caac6f9645dc11dfc7955525161c1aa6237a30ef656ac954e170d6ede3fb29ef796f53372ab30623660c5ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-59481.exe

Filesize
468KB

MD5
531819b489a909ae399d63ad4e5ddb74

SHA1
89f7c4a4ba168fcf49911269e73f5e0555b19ca8

SHA256
53d2279375b2741f5b0ccc4c54576fb2985fb6174e66b13e8e8756326db46afc

SHA512
23e9dca7fe76d4079bd006366f054f693eefc11371f249cac136b847bcb66c232820f442447fdac63ecf30ccbb4a056daa858d8a285200598df27a2730c6964a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-59813.exe

Filesize
468KB

MD5
a85c8594087082cfd1b11326f3832992

SHA1
02d61cfaec028415a764ddaa122990d1bec3393f

SHA256
8099f6a4a4168d74fc3b21995ce2276b0ab8dc4f897cdd6e6b9bbaef23717254

SHA512
4f1994f47512eb3edd4ced4a1a1d1a5d9d37cc443d724e6d1abc13bcac3d78eabb62d9a5278f6aa547807d9795d46f39c429df23258890076e64776b358fe6f4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-63072.exe

Filesize
468KB

MD5
29a3e8f090f1beda47d9c0a8d972e0a7

SHA1
caff17ebffca696d6993e7072272e2e5a8d45b61

SHA256
62260c2fd6f7570e832abcabd3642bc4ba09ed843f2bbd185abaac1879b21d48

SHA512
4ac10cfee6884ee993056fed2527fa8bf3af32034089b486360013fb293afada506cdfcce50502f3e5f9f1789f07caf513716e2b5cd7c43f3c2494b9f951ed16

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-63492.exe

Filesize
468KB

MD5
2c3aeeb1a2e6a31f842f90c3893c92ca

SHA1
6d5b0478d8ccaa6fc649b86bc0a0639a016addb6

SHA256
f8aa3257972bff5b62d2c97dc09e603423ddf0ce524e09426f9c215403ea56ef

SHA512
efd2fbaa63576d76f30e6d037ab9b2efc5ba14ffd76cc2ca063cf42f361bb2e3ed4f120e372d07b8db0f23120d3e397e28e97624d91d23d23e07b7db17aa2939

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-63840.exe

Filesize
468KB

MD5
731776492384db04507b14f1845de46c

SHA1
807e62d3c60f55ef97138a423ee565bb2037db82

SHA256
96466431329a0601db8f734282048a1cb4de1dc8ac231d01740fbdbbad13844e

SHA512
3e0edb433d31eee9ea77c66f14ee6005c8a347a970ae4dcd73560e26c60f0b3fd1388cebb13c4123097b52992343d5036e07a538d709f38d74419e2ab3aa4951

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-64120.exe

Filesize
468KB

MD5
e4ced0fb99a5b5716372566ce94c43cb

SHA1
d6ab13f7228f23d54cda15944adcfd95c965c323

SHA256
b5ad4fc5470f0485f94f3fb4fffb39a61114a91fef7c8c96844264d6f86de22a

SHA512
fbad57ae069c1b5f0e6720e25abcdbd742334964e96363f7dba62e9fa8e02c6ac2fde994dfa2f14ac67dae8f24f5eec27bd3852c9ddafc37e561690b38eeb2e4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-9808.exe

Filesize
468KB

MD5
24d779a777e90860831eb59199d53852

SHA1
a4219db8e4d7d5391db3bdafcd149536f60f4d4c

SHA256
aa12619b84f8829ece106240a4fff7df871030659004f5aaff118ccb6189fe55

SHA512
fc63028ceddecaebbd72fe23cbf20814ec98d7444381183809167620997c568005f6850aae05a47cd4afb6fd7bc34ed75b816b7f6bc4e2a89a77e4f20b925668

Download Submit
memory/32-217-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/448-418-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/540-102-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/768-389-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/908-452-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/928-154-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/932-488-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1068-443-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1176-442-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1184-467-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1344-155-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1400-407-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1576-384-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1600-494-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1608-153-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1644-44-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1672-525-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1764-45-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1804-119-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1836-304-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1864-450-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1940-507-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1964-451-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1972-164-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1976-277-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2000-229-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2024-240-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2064-397-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2092-201-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2120-411-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2124-398-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2128-246-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2172-329-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2256-318-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2284-364-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2384-404-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2408-63-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2432-13-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2680-499-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2716-27-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2768-419-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2776-160-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2824-255-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2840-335-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2868-126-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2876-87-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2876-2612-0x00000000752E0000-0x0000000075309000-memory.dmp

Filesize
164KB

Download
memory/2904-103-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2976-156-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2988-6-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2992-412-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3068-334-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3184-202-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3252-276-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3288-359-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3304-200-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3308-18-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3352-230-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3372-413-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3404-378-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3436-101-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3556-337-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3604-324-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3740-275-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3792-157-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3800-510-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3816-516-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3916-463-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3944-111-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3972-336-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4020-317-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4044-265-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4136-498-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4144-523-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4200-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4272-260-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4328-495-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4380-2839-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4408-339-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4436-205-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4464-358-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4468-338-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4536-396-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4740-462-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4828-365-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4836-231-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4852-100-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4876-55-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4912-98-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4924-172-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4932-472-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4948-250-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4968-32-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5096-376-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5132-520-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5248-534-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5288-538-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5360-548-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/14684-2809-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/15324-2650-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/15516-3022-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/15640-2849-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/16300-2944-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads