9b23a8909db433060732fd2cb308a95f8bcbba13ed981c1e3215c0542b833a54

Analysis

max time kernel
119s
max time network
107s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
21/09/2024, 21:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9b23a8909db433060732fd2cb308a95f8bcbba13ed981c1e3215c0542b833a54N.exe
Size

184KB
MD5

63ee11d28b6cae8255ab4421b5dc6580
SHA1

54f8eea5bdcbc07d1c429028d4ce216673078171
SHA256

9b23a8909db433060732fd2cb308a95f8bcbba13ed981c1e3215c0542b833a54
SHA512

c88933160edf81c33135d1da4e8cc52ec4c72c96b497563a10a4d98e6d00484ceac4553561d4b8d3363cc2c841d4879b790d4e768663f5c810e85a3ba6cb0ae0
SSDEEP

3072:R/+aqCoEy55EdyPa4HSTJS0clvnqnveuR:R/LoDAyP2TQ0clPqnveu

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
1624	Unicorn-15902.exe
3120	Unicorn-46197.exe
4840	Unicorn-525.exe
2576	Unicorn-34350.exe
2764	Unicorn-59601.exe
3988	Unicorn-3715.exe
1864	Unicorn-9845.exe
1928	Unicorn-25832.exe
4832	Unicorn-21748.exe
2256	Unicorn-15617.exe
1476	Unicorn-46999.exe
3976	Unicorn-32054.exe
2768	Unicorn-9230.exe
4992	Unicorn-9495.exe
2728	Unicorn-20356.exe
3432	Unicorn-56148.exe
1636	Unicorn-25422.exe
4972	Unicorn-35728.exe
2360	Unicorn-58841.exe
1212	Unicorn-7039.exe
4956	Unicorn-8820.exe
2848	Unicorn-54757.exe
3264	Unicorn-15115.exe
1972	Unicorn-56048.exe
4688	Unicorn-58094.exe
3688	Unicorn-17808.exe
4076	Unicorn-41758.exe
2960	Unicorn-21892.exe
2176	Unicorn-32827.exe
3684	Unicorn-41758.exe
872	Unicorn-51825.exe
4520	Unicorn-54970.exe
3472	Unicorn-59054.exe
1820	Unicorn-49495.exe
2220	Unicorn-64461.exe
4788	Unicorn-33180.exe
4968	Unicorn-10621.exe
1804	Unicorn-4491.exe
1732	Unicorn-57584.exe
4924	Unicorn-63714.exe
4004	Unicorn-59630.exe
2284	Unicorn-4399.exe
3316	Unicorn-15260.exe
2524	Unicorn-58239.exe
1316	Unicorn-12567.exe
4928	Unicorn-8218.exe
1144	Unicorn-22417.exe
1152	Unicorn-65090.exe
1360	Unicorn-28712.exe
1516	Unicorn-44278.exe
2716	Unicorn-39018.exe
1048	Unicorn-123.exe
8	Unicorn-47186.exe
3032	Unicorn-8291.exe
3192	Unicorn-8291.exe
2468	Unicorn-36972.exe
2736	Unicorn-3392.exe
3884	Unicorn-17127.exe
4632	Unicorn-30034.exe
848	Unicorn-30034.exe
1652	Unicorn-56314.exe
4944	Unicorn-46100.exe
468	Unicorn-39786.exe
3592	Unicorn-15836.exe

Program crash 24 IoCs

pid	pid_target	Process	procid_target
5980	1048	WerFault.exe	139
7628	5272	WerFault.exe	183
7636	5276	WerFault.exe	184
10300	8496	WerFault.exe	421
12688	10496	WerFault.exe	514
12604	10544	WerFault.exe	515
13156	8496	WerFault.exe	421
10648	13548	WerFault.exe	650
888	11500	WerFault.exe	683
64	14748	WerFault.exe	717
15844	14424	WerFault.exe	708
4272	14856	WerFault.exe	720
14696	15084	WerFault.exe	727
2420	15244	WerFault.exe	755
1508	14484	WerFault.exe	744
14412	14840	WerFault.exe	756
1540	15976	WerFault.exe	778
15240	16168	WerFault.exe	796
17228	15012	WerFault.exe	804
16956	16364	WerFault.exe	800
16852	15456	WerFault.exe	771
11068	6560	Process not Found	1191
12064	16840	Process not Found	1076
2308	9008	Process not Found	472

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7580.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52583.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4777.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61376.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4489.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30352.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47514.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9334.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3569.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12640.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21790.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36818.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16427.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24752.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25500.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4507.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54166.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19683.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48030.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52054.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47460.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32556.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4507.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65524.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2780.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1731.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6835.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39845.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48202.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24326.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45541.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17281.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18439.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35426.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54669.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21960.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64057.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50924.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58841.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56309.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39226.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30713.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59512.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59516.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7295.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7871.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11892.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2692.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21918.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14019.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63518.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30024.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46958.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44135.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36080.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42364.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30522.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19116.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4969.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17514.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56048.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	5228	dwm.exe
Token: SeChangeNotifyPrivilege	5228	dwm.exe
Token: 33	5228	dwm.exe
Token: SeIncBasePriorityPrivilege	5228	dwm.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
1376	9b23a8909db433060732fd2cb308a95f8bcbba13ed981c1e3215c0542b833a54N.exe
1624	Unicorn-15902.exe
4840	Unicorn-525.exe
3120	Unicorn-46197.exe
2764	Unicorn-59601.exe
2576	Unicorn-34350.exe
3988	Unicorn-3715.exe
1864	Unicorn-9845.exe
4832	Unicorn-21748.exe
2256	Unicorn-15617.exe
1928	Unicorn-25832.exe
1476	Unicorn-46999.exe
2728	Unicorn-20356.exe
3976	Unicorn-32054.exe
2768	Unicorn-9230.exe
4992	Unicorn-9495.exe
1636	Unicorn-25422.exe
3432	Unicorn-56148.exe
2360	Unicorn-58841.exe
4972	Unicorn-35728.exe
1972	Unicorn-56048.exe
3264	Unicorn-15115.exe
4956	Unicorn-8820.exe
2848	Unicorn-54757.exe
1212	Unicorn-7039.exe
4076	Unicorn-41758.exe
4688	Unicorn-58094.exe
2176	Unicorn-32827.exe
3688	Unicorn-17808.exe
2960	Unicorn-21892.exe
3684	Unicorn-41758.exe
872	Unicorn-51825.exe
4520	Unicorn-54970.exe
3472	Unicorn-59054.exe
1820	Unicorn-49495.exe
2220	Unicorn-64461.exe
4788	Unicorn-33180.exe
1804	Unicorn-4491.exe
4968	Unicorn-10621.exe
4924	Unicorn-63714.exe
2524	Unicorn-58239.exe
4004	Unicorn-59630.exe
1732	Unicorn-57584.exe
1144	Unicorn-22417.exe
2284	Unicorn-4399.exe
4928	Unicorn-8218.exe
1316	Unicorn-12567.exe
3316	Unicorn-15260.exe
1152	Unicorn-65090.exe
1360	Unicorn-28712.exe
2468	Unicorn-36972.exe
848	Unicorn-30034.exe
2736	Unicorn-3392.exe
4632	Unicorn-30034.exe
8	Unicorn-47186.exe
2716	Unicorn-39018.exe
1048	Unicorn-123.exe
3032	Unicorn-8291.exe
3192	Unicorn-8291.exe
1516	Unicorn-44278.exe
3884	Unicorn-17127.exe
1652	Unicorn-56314.exe
4944	Unicorn-46100.exe
468	Unicorn-39786.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1376 wrote to memory of 1624	1376	9b23a8909db433060732fd2cb308a95f8bcbba13ed981c1e3215c0542b833a54N.exe	83
PID 1376 wrote to memory of 1624	1376	9b23a8909db433060732fd2cb308a95f8bcbba13ed981c1e3215c0542b833a54N.exe	83
PID 1376 wrote to memory of 1624	1376	9b23a8909db433060732fd2cb308a95f8bcbba13ed981c1e3215c0542b833a54N.exe	83
PID 1376 wrote to memory of 3120	1376	9b23a8909db433060732fd2cb308a95f8bcbba13ed981c1e3215c0542b833a54N.exe	87
PID 1376 wrote to memory of 3120	1376	9b23a8909db433060732fd2cb308a95f8bcbba13ed981c1e3215c0542b833a54N.exe	87
PID 1376 wrote to memory of 3120	1376	9b23a8909db433060732fd2cb308a95f8bcbba13ed981c1e3215c0542b833a54N.exe	87
PID 1624 wrote to memory of 4840	1624	Unicorn-15902.exe	86
PID 1624 wrote to memory of 4840	1624	Unicorn-15902.exe	86
PID 1624 wrote to memory of 4840	1624	Unicorn-15902.exe	86
PID 4840 wrote to memory of 2576	4840	Unicorn-525.exe	91
PID 4840 wrote to memory of 2576	4840	Unicorn-525.exe	91
PID 4840 wrote to memory of 2576	4840	Unicorn-525.exe	91
PID 1624 wrote to memory of 2764	1624	Unicorn-15902.exe	92
PID 1624 wrote to memory of 2764	1624	Unicorn-15902.exe	92
PID 1624 wrote to memory of 2764	1624	Unicorn-15902.exe	92
PID 3120 wrote to memory of 1864	3120	Unicorn-46197.exe	93
PID 3120 wrote to memory of 1864	3120	Unicorn-46197.exe	93
PID 3120 wrote to memory of 1864	3120	Unicorn-46197.exe	93
PID 1376 wrote to memory of 3988	1376	9b23a8909db433060732fd2cb308a95f8bcbba13ed981c1e3215c0542b833a54N.exe	94
PID 1376 wrote to memory of 3988	1376	9b23a8909db433060732fd2cb308a95f8bcbba13ed981c1e3215c0542b833a54N.exe	94
PID 1376 wrote to memory of 3988	1376	9b23a8909db433060732fd2cb308a95f8bcbba13ed981c1e3215c0542b833a54N.exe	94
PID 2764 wrote to memory of 1928	2764	Unicorn-59601.exe	95
PID 2764 wrote to memory of 1928	2764	Unicorn-59601.exe	95
PID 2764 wrote to memory of 1928	2764	Unicorn-59601.exe	95
PID 2576 wrote to memory of 4832	2576	Unicorn-34350.exe	96
PID 2576 wrote to memory of 4832	2576	Unicorn-34350.exe	96
PID 2576 wrote to memory of 4832	2576	Unicorn-34350.exe	96
PID 1624 wrote to memory of 2256	1624	Unicorn-15902.exe	97
PID 1624 wrote to memory of 2256	1624	Unicorn-15902.exe	97
PID 1624 wrote to memory of 2256	1624	Unicorn-15902.exe	97
PID 4840 wrote to memory of 1476	4840	Unicorn-525.exe	98
PID 4840 wrote to memory of 1476	4840	Unicorn-525.exe	98
PID 4840 wrote to memory of 1476	4840	Unicorn-525.exe	98
PID 3988 wrote to memory of 3976	3988	Unicorn-3715.exe	99
PID 3988 wrote to memory of 3976	3988	Unicorn-3715.exe	99
PID 3988 wrote to memory of 3976	3988	Unicorn-3715.exe	99
PID 1376 wrote to memory of 2768	1376	9b23a8909db433060732fd2cb308a95f8bcbba13ed981c1e3215c0542b833a54N.exe	100
PID 1376 wrote to memory of 2768	1376	9b23a8909db433060732fd2cb308a95f8bcbba13ed981c1e3215c0542b833a54N.exe	100
PID 1376 wrote to memory of 2768	1376	9b23a8909db433060732fd2cb308a95f8bcbba13ed981c1e3215c0542b833a54N.exe	100
PID 1864 wrote to memory of 4992	1864	Unicorn-9845.exe	101
PID 1864 wrote to memory of 4992	1864	Unicorn-9845.exe	101
PID 1864 wrote to memory of 4992	1864	Unicorn-9845.exe	101
PID 3120 wrote to memory of 2728	3120	Unicorn-46197.exe	102
PID 3120 wrote to memory of 2728	3120	Unicorn-46197.exe	102
PID 3120 wrote to memory of 2728	3120	Unicorn-46197.exe	102
PID 2256 wrote to memory of 3432	2256	Unicorn-15617.exe	103
PID 2256 wrote to memory of 3432	2256	Unicorn-15617.exe	103
PID 2256 wrote to memory of 3432	2256	Unicorn-15617.exe	103
PID 4832 wrote to memory of 1636	4832	Unicorn-21748.exe	104
PID 4832 wrote to memory of 1636	4832	Unicorn-21748.exe	104
PID 4832 wrote to memory of 1636	4832	Unicorn-21748.exe	104
PID 1928 wrote to memory of 4972	1928	Unicorn-25832.exe	105
PID 1928 wrote to memory of 4972	1928	Unicorn-25832.exe	105
PID 1928 wrote to memory of 4972	1928	Unicorn-25832.exe	105
PID 2576 wrote to memory of 2360	2576	Unicorn-34350.exe	106
PID 2576 wrote to memory of 2360	2576	Unicorn-34350.exe	106
PID 2576 wrote to memory of 2360	2576	Unicorn-34350.exe	106
PID 4840 wrote to memory of 1212	4840	Unicorn-525.exe	107
PID 4840 wrote to memory of 1212	4840	Unicorn-525.exe	107
PID 4840 wrote to memory of 1212	4840	Unicorn-525.exe	107
PID 1624 wrote to memory of 4956	1624	Unicorn-15902.exe	108
PID 1624 wrote to memory of 4956	1624	Unicorn-15902.exe	108
PID 1624 wrote to memory of 4956	1624	Unicorn-15902.exe	108
PID 2764 wrote to memory of 2848	2764	Unicorn-59601.exe	109

C:\Users\Admin\AppData\Local\Temp\9b23a8909db433060732fd2cb308a95f8bcbba13ed981c1e3215c0542b833a54N.exe
"C:\Users\Admin\AppData\Local\Temp\9b23a8909db433060732fd2cb308a95f8bcbba13ed981c1e3215c0542b833a54N.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1376
- C:\Users\Admin\AppData\Local\Temp\Unicorn-15902.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-15902.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1624
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-525.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-525.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34350.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34350.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21748.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25422.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59054.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7689.exe
        8⤵
        
        PID:1944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36962.exe
        9⤵
        
        PID:6884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21966.exe
        10⤵
        
        PID:8616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24120.exe
        11⤵
        
        PID:14608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50740.exe
        11⤵
        
        PID:14748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18172.exe
        11⤵
        
        PID:17312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25914.exe
        10⤵
        
        PID:12040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37441.exe
        10⤵
        
        PID:17168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22981.exe
        9⤵
        
        PID:8444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28780.exe
        10⤵
        
        PID:14788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50917.exe
        10⤵
        
        PID:1452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21411.exe
        9⤵
        
        PID:14312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2048.exe
        9⤵
        
        PID:4540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38524.exe
        8⤵
        
        PID:5268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65162.exe
        9⤵
        
        PID:7916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-502.exe
        10⤵
        
        PID:64
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46361.exe
        9⤵
        
        PID:11212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16235.exe
        9⤵
        
        PID:14920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23698.exe
        9⤵
        
        PID:17236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45794.exe
        8⤵
        
        PID:8052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2739.exe
        9⤵
        
        PID:14164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53865.exe
        9⤵
        
        PID:17056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9507.exe
        9⤵
        
        PID:16620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29065.exe
        8⤵
        
        PID:9584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12068.exe
        8⤵
        
        PID:14744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26718.exe
        7⤵
        
        PID:1016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36962.exe
        8⤵
        
        PID:6784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39226.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:8500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3294.exe
        9⤵
        
        PID:13076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21752.exe
        9⤵
        
        PID:17076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54668.exe
        8⤵
        
        PID:9572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37093.exe
        8⤵
        
        PID:11592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65382.exe
        8⤵
        
        PID:16588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-951.exe
        8⤵
        
        PID:2032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33785.exe
        7⤵
        
        PID:5132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34218.exe
        8⤵
        
        PID:8632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23776.exe
        8⤵
        
        PID:12088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42852.exe
        8⤵
        
        PID:15928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10037.exe
        8⤵
        
        PID:14448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28655.exe
        7⤵
        
        PID:8988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25173.exe
        7⤵
        
        PID:12956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18864.exe
        7⤵
        
        PID:17076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12068.exe
        7⤵
        
        PID:17244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64461.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27918.exe
        7⤵
        
        PID:4396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9334.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:7116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55754.exe
        9⤵
        
        PID:4116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24211.exe
        9⤵
        
        PID:14040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27249.exe
        9⤵
        
        PID:14840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57452.exe
        9⤵
        
        PID:16420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45541.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:10820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13627.exe
        8⤵
        
        PID:15092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43830.exe
        8⤵
        
        PID:6232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18296.exe
        7⤵
        
        PID:5244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56776.exe
        8⤵
        
        PID:8480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2780.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:11976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37590.exe
        8⤵
        
        PID:15684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40764.exe
        8⤵
        
        PID:3468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57792.exe
        7⤵
        
        PID:8844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63735.exe
        7⤵
        
        PID:13196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65382.exe
        7⤵
        
        PID:16600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15565.exe
        6⤵
        
        PID:4636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48468.exe
        7⤵
        
        PID:6132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56776.exe
        8⤵
        
        PID:8464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36718.exe
        8⤵
        
        PID:13144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55899.exe
        8⤵
        
        PID:15668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33366.exe
        7⤵
        
        PID:9084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22483.exe
        7⤵
        
        PID:12456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15338.exe
        6⤵
        
        PID:1552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29558.exe
        7⤵
        
        PID:8392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13086.exe
        7⤵
        
        PID:11880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58010.exe
        7⤵
        
        PID:15412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52470.exe
        6⤵
        
        PID:9120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3148.exe
        6⤵
        
        PID:12428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40139.exe
        6⤵
        
        PID:6512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58841.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10621.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27918.exe
        7⤵
        
        PID:2124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-829.exe
        8⤵
        
        PID:5832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11493.exe
        9⤵
        
        PID:3348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21790.exe
        10⤵
        
        PID:4800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43943.exe
        10⤵
        
        PID:13972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12728.exe
        9⤵
        
        PID:9696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50278.exe
        9⤵
        
        PID:13880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55795.exe
        8⤵
        
        PID:6736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52708.exe
        9⤵
        
        PID:14748
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 14748 -s 464
        10⤵
        Program crash
        
        PID:64
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50366.exe
        8⤵
        
        PID:10544
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10544 -s 472
        9⤵
        Program crash
        
        PID:12604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3304.exe
        8⤵
        
        PID:12640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35550.exe
        8⤵
        
        PID:9248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62518.exe
        8⤵
        
        PID:17000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34510.exe
        8⤵
        
        PID:17360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12266.exe
        7⤵
        
        PID:5612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31058.exe
        8⤵
        
        PID:7684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17492.exe
        8⤵
        
        PID:6720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4507.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21411.exe
        7⤵
        
        PID:14304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32556.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45754.exe
        7⤵
        
        PID:5920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54856.exe
        8⤵
        
        PID:7460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3569.exe
        9⤵
        
        PID:12620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44310.exe
        9⤵
        
        PID:3040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52583.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:10844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16427.exe
        8⤵
        
        PID:15224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37256.exe
        8⤵
        
        PID:7012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5416.exe
        7⤵
        
        PID:7936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30713.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:9848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41727.exe
        7⤵
        
        PID:16020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5416.exe
        7⤵
        
        PID:5596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28935.exe
        6⤵
        
        PID:7108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56776.exe
        7⤵
        
        PID:8560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14159.exe
        7⤵
        
        PID:13132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54992.exe
        6⤵
        
        PID:9156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11892.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32102.exe
        6⤵
        
        PID:4344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57584.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54669.exe
        6⤵
        
        PID:5812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11446.exe
        7⤵
        
        PID:7796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25272.exe
        8⤵
        
        PID:15916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12307.exe
        8⤵
        
        PID:840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53080.exe
        7⤵
        
        PID:11576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34135.exe
        7⤵
        
        PID:15420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44310.exe
        7⤵
        
        PID:14444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19151.exe
        6⤵
        
        PID:8128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62718.exe
        7⤵
        
        PID:10140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58499.exe
        7⤵
        
        PID:15296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29927.exe
        7⤵
        
        PID:4048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5852.exe
        6⤵
        
        PID:10680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33061.exe
        6⤵
        
        PID:15964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47484.exe
        6⤵
        
        PID:16464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17287.exe
        6⤵
        
        PID:1764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44373.exe
        5⤵
        
        PID:1424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22018.exe
        6⤵
        
        PID:6696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7513.exe
        7⤵
        
        PID:9320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9132.exe
        7⤵
        
        PID:13320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30304.exe
        7⤵
        
        PID:4692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57077.exe
        6⤵
        
        PID:9704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31227.exe
        6⤵
        
        PID:13260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32020.exe
        6⤵
        
        PID:16436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1987.exe
        5⤵
        
        PID:6444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24120.exe
        6⤵
        
        PID:14856
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 14856 -s 440
        7⤵
        Program crash
        
        PID:4272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39992.exe
        5⤵
        
        PID:9480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17281.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:14156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46999.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46999.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51825.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56314.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36818.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11877.exe
        8⤵
        
        PID:7564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7295.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:9916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58499.exe
        9⤵
        
        PID:14840
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 14840 -s 436
        10⤵
        Program crash
        
        PID:14412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13407.exe
        9⤵
        
        PID:17364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64275.exe
        9⤵
        
        PID:6508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42468.exe
        8⤵
        
        PID:10740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16427.exe
        8⤵
        
        PID:15212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39074.exe
        8⤵
        
        PID:14460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5416.exe
        7⤵
        
        PID:7912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1401.exe
        7⤵
        
        PID:12212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45316.exe
        7⤵
        
        PID:11116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31918.exe
        6⤵
        
        PID:5668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15962.exe
        7⤵
        
        PID:7768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21790.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:13140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30024.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:10760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16427.exe
        7⤵
        
        PID:15200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10983.exe
        6⤵
        
        PID:8112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36579.exe
        6⤵
        
        PID:10828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33061.exe
        6⤵
        
        PID:16004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34734.exe
        6⤵
        
        PID:16616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46100.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43616.exe
        6⤵
        
        PID:5496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39122.exe
        7⤵
        
        PID:6120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7513.exe
        8⤵
        
        PID:9328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17492.exe
        8⤵
        
        PID:11876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55499.exe
        8⤵
        
        PID:15640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44144.exe
        7⤵
        
        PID:10472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12562.exe
        7⤵
        
        PID:14852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41334.exe
        7⤵
        
        PID:17304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52889.exe
        6⤵
        
        PID:6536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57648.exe
        7⤵
        
        PID:11792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33069.exe
        6⤵
        
        PID:10152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17824.exe
        6⤵
        
        PID:13540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51519.exe
        5⤵
        
        PID:5576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39122.exe
        6⤵
        
        PID:6000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3569.exe
        7⤵
        
        PID:12648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44310.exe
        7⤵
        
        PID:14852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57383.exe
        6⤵
        
        PID:11784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13125.exe
        6⤵
        
        PID:4176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11952.exe
        6⤵
        
        PID:16936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31535.exe
        5⤵
        
        PID:7748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18360.exe
        6⤵
        
        PID:16648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62547.exe
        6⤵
        
        PID:14820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24424.exe
        5⤵
        
        PID:10788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14157.exe
        5⤵
        
        PID:15124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16441.exe
        5⤵
        
        PID:17180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7039.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7039.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12567.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54669.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30352.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9475.exe
        8⤵
        
        PID:6612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34108.exe
        7⤵
        
        PID:11180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16235.exe
        7⤵
        
        PID:14676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49999.exe
        7⤵
        
        PID:17336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6497.exe
        7⤵
        
        PID:16456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19151.exe
        6⤵
        
        PID:7944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32288.exe
        7⤵
        
        PID:14520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36579.exe
        6⤵
        
        PID:10400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33061.exe
        6⤵
        
        PID:16040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30458.exe
        6⤵
        
        PID:2872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51415.exe
        5⤵
        
        PID:3928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35976.exe
        6⤵
        
        PID:6740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-715.exe
        7⤵
        
        PID:8744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17492.exe
        7⤵
        
        PID:12484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34631.exe
        6⤵
        
        PID:9520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25417.exe
        6⤵
        
        PID:14036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18439.exe
        6⤵
        
        PID:6248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14901.exe
        5⤵
        
        PID:6616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52900.exe
        6⤵
        
        PID:14340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6199.exe
        6⤵
        
        PID:16840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13896.exe
        6⤵
        
        PID:5872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24815.exe
        5⤵
        
        PID:9432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42976.exe
        5⤵
        
        PID:15368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48708.exe
        5⤵
        
        PID:17336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22417.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22417.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54669.exe
        5⤵
        
        PID:5420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50772.exe
        6⤵
        
        PID:7732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30024.exe
        6⤵
        
        PID:10772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16427.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:15208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46107.exe
        6⤵
        
        PID:17188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45794.exe
        5⤵
        
        PID:6564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3569.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:12612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1296.exe
        6⤵
        
        PID:2188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12447.exe
        6⤵
        
        PID:4540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42407.exe
        6⤵
        
        PID:16388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55610.exe
        6⤵
        
        PID:16944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36579.exe
        5⤵
        
        PID:11020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33061.exe
        5⤵
        
        PID:15988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61376.exe
        5⤵
        
        PID:14812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-897.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-897.exe
      4⤵
      PID:2372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57020.exe
        5⤵
        
        PID:6652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13605.exe
        6⤵
        
        PID:8712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32441.exe
        6⤵
        
        PID:12036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56309.exe
        5⤵
        
        PID:8304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4777.exe
        5⤵
        
        PID:12788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32163.exe
        5⤵
        
        PID:4456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31034.exe
        5⤵
        
        PID:15948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32706.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32706.exe
      4⤵
      PID:6380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54166.exe
        5⤵
        
        PID:10692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2692.exe
        5⤵
        
        PID:15148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3773.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3773.exe
      4⤵
      PID:9456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61288.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61288.exe
      4⤵
      PID:14104
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59601.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59601.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25832.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25832.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35728.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4399.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65058.exe
        7⤵
        
        PID:2720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50798.exe
        8⤵
        
        PID:6604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29558.exe
        9⤵
        
        PID:8384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46600.exe
        10⤵
        
        PID:10096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9708.exe
        10⤵
        
        PID:13676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64965.exe
        10⤵
        
        PID:15148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7082.exe
        9⤵
        
        PID:9404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17989.exe
        9⤵
        
        PID:14508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56309.exe
        8⤵
        
        PID:8476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4777.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:13004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7027.exe
        8⤵
        
        PID:15720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56205.exe
        7⤵
        
        PID:5764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55754.exe
        8⤵
        
        PID:8284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24211.exe
        8⤵
        
        PID:14240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14019.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:10008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56606.exe
        7⤵
        
        PID:14924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20906.exe
        7⤵
        
        PID:17196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16604.exe
        6⤵
        
        PID:1004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22594.exe
        7⤵
        
        PID:6852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31608.exe
        8⤵
        
        PID:10724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2692.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:15180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13599.exe
        8⤵
        
        PID:17092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18172.exe
        8⤵
        
        PID:4208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47460.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:10220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50497.exe
        7⤵
        
        PID:14416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48342.exe
        6⤵
        
        PID:6984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25386.exe
        7⤵
        
        PID:10976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2692.exe
        7⤵
        
        PID:15164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32329.exe
        6⤵
        
        PID:7256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47478.exe
        6⤵
        
        PID:14276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58239.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54669.exe
        6⤵
        
        PID:5884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6999.exe
        7⤵
        
        PID:8404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27284.exe
        7⤵
        
        PID:11956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10037.exe
        7⤵
        
        PID:16556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4507.exe
        6⤵
        
        PID:7600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28349.exe
        6⤵
        
        PID:12480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37102.exe
        5⤵
        
        PID:2780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14233.exe
        6⤵
        
        PID:6976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46600.exe
        7⤵
        
        PID:10092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21960.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:13712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45200.exe
        7⤵
        
        PID:17132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42364.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55515.exe
        6⤵
        
        PID:9968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44056.exe
        6⤵
        
        PID:13560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17405.exe
        6⤵
        
        PID:17392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28856.exe
        6⤵
        
        PID:15520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6952.exe
        5⤵
        
        PID:6128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35556.exe
        6⤵
        
        PID:17120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63518.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:10804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62629.exe
        5⤵
        
        PID:15116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52403.exe
        5⤵
        
        PID:14992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54757.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54757.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33180.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62453.exe
        6⤵
        
        PID:6008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42604.exe
        7⤵
        
        PID:7416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11166.exe
        7⤵
        
        PID:8692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44632.exe
        7⤵
        
        PID:14424
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 14424 -s 464
        8⤵
        Program crash
        
        PID:15844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17213.exe
        7⤵
        
        PID:1508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53631.exe
        7⤵
        
        PID:15060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10983.exe
        6⤵
        
        PID:7760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7295.exe
        7⤵
        
        PID:10444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58499.exe
        7⤵
        
        PID:15056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30119.exe
        7⤵
        
        PID:17380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36579.exe
        6⤵
        
        PID:11024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33061.exe
        6⤵
        
        PID:16012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10037.exe
        6⤵
        
        PID:16684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1830.exe
        5⤵
        
        PID:1388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6859.exe
        6⤵
        
        PID:6096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59516.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55038.exe
        8⤵
        
        PID:12776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-502.exe
        8⤵
        
        PID:15932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10652.exe
        8⤵
        
        PID:14040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16978.exe
        7⤵
        
        PID:10768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35862.exe
        7⤵
        
        PID:16072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12640.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32641.exe
        7⤵
        
        PID:6996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34580.exe
        6⤵
        
        PID:8760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39458.exe
        6⤵
        
        PID:12152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35941.exe
        6⤵
        
        PID:14700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21917.exe
        5⤵
        
        PID:6052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41364.exe
        6⤵
        
        PID:8756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24211.exe
        6⤵
        
        PID:14180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52967.exe
        5⤵
        
        PID:9076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19683.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25628.exe
        5⤵
        
        PID:2104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4491.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4491.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38224.exe
        5⤵
        
        PID:3452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10943.exe
        6⤵
        
        PID:5880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11877.exe
        7⤵
        
        PID:7580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7207.exe
        8⤵
        
        PID:13516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56091.exe
        7⤵
        
        PID:10384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17989.exe
        7⤵
        
        PID:14500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5416.exe
        6⤵
        
        PID:7296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46756.exe
        7⤵
        
        PID:16560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6017.exe
        6⤵
        
        PID:11336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13138.exe
        6⤵
        
        PID:16104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44118.exe
        6⤵
        
        PID:4368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12266.exe
        5⤵
        
        PID:5620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56776.exe
        6⤵
        
        PID:8488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14159.exe
        6⤵
        
        PID:13124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18439.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4507.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10642.exe
        5⤵
        
        PID:12996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17095.exe
        5⤵
        
        PID:14768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52157.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52157.exe
      4⤵
      PID:960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-829.exe
        5⤵
        
        PID:5840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13823.exe
        6⤵
        
        PID:7724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17784.exe
        7⤵
        
        PID:17048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44675.exe
        7⤵
        
        PID:16648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30024.exe
        6⤵
        
        PID:10776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16427.exe
        6⤵
        
        PID:15232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46107.exe
        6⤵
        
        PID:17136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21176.exe
        5⤵
        
        PID:7544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26538.exe
        6⤵
        
        PID:11412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24072.exe
        6⤵
        
        PID:16128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3974.exe
        6⤵
        
        PID:17352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53272.exe
        5⤵
        
        PID:9464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41727.exe
        5⤵
        
        PID:15996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56947.exe
        5⤵
        
        PID:16120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2589.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2589.exe
      4⤵
      PID:3012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60284.exe
        5⤵
        
        PID:8424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47897.exe
        5⤵
        
        PID:11896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61326.exe
        5⤵
        
        PID:15412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23682.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23682.exe
      4⤵
      PID:9104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20213.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20213.exe
      4⤵
      PID:12468
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15617.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15617.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56148.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56148.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54970.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39786.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6667.exe
        7⤵
        
        PID:5780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7025.exe
        8⤵
        
        PID:6208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3569.exe
        9⤵
        
        PID:12596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1296.exe
        9⤵
        
        PID:12776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6225.exe
        9⤵
        
        PID:15028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7596.exe
        9⤵
        
        PID:16512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50924.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:3392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29256.exe
        8⤵
        
        PID:9360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36080.exe
        8⤵
        
        PID:12668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46000.exe
        8⤵
        
        PID:15000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45681.exe
        7⤵
        
        PID:8168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32288.exe
        8⤵
        
        PID:14400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58342.exe
        7⤵
        
        PID:11240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2640.exe
        7⤵
        
        PID:15456
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 15456 -s 424
        8⤵
        Program crash
        
        PID:16852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48255.exe
        6⤵
        
        PID:5888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11877.exe
        7⤵
        
        PID:7556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62334.exe
        8⤵
        
        PID:10936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2692.exe
        8⤵
        
        PID:15084
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 15084 -s 436
        9⤵
        Program crash
        
        PID:14696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30119.exe
        8⤵
        
        PID:7652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42468.exe
        7⤵
        
        PID:10732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16427.exe
        7⤵
        
        PID:15104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46107.exe
        7⤵
        
        PID:17112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6899.exe
        6⤵
        
        PID:7872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6989.exe
        7⤵
        
        PID:15584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24752.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37004.exe
        7⤵
        
        PID:17196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36579.exe
        6⤵
        
        PID:9536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33061.exe
        6⤵
        
        PID:16048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34734.exe
        6⤵
        
        PID:4060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15836.exe
        5⤵
        Executes dropped EXE
        
        PID:3592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6667.exe
        6⤵
        
        PID:5788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64394.exe
        7⤵
        
        PID:5224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21585.exe
        7⤵
        
        PID:11100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2640.exe
        7⤵
        
        PID:15396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16220.exe
        7⤵
        
        PID:3504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22546.exe
        6⤵
        
        PID:7832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47844.exe
        6⤵
        
        PID:11164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30269.exe
        6⤵
        
        PID:14492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8475.exe
        6⤵
        
        PID:16116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57906.exe
        5⤵
        
        PID:5908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25500.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3569.exe
        7⤵
        
        PID:12628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13392.exe
        7⤵
        
        PID:16724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29256.exe
        6⤵
        
        PID:9344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36080.exe
        6⤵
        
        PID:13328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14889.exe
        6⤵
        
        PID:5180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46231.exe
        5⤵
        
        PID:7788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7295.exe
        6⤵
        
        PID:10380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58499.exe
        6⤵
        
        PID:15244
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 15244 -s 436
        7⤵
        Program crash
        
        PID:2420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44326.exe
        6⤵
        
        PID:17060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45044.exe
        5⤵
        
        PID:11172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62437.exe
        5⤵
        
        PID:14888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41864.exe
        5⤵
        
        PID:17296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34609.exe
        5⤵
        
        PID:14356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49495.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49495.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38416.exe
        5⤵
        
        PID:3580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49454.exe
        6⤵
        
        PID:6136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64394.exe
        7⤵
        
        PID:6548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54166.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:10860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9219.exe
        8⤵
        
        PID:16212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60846.exe
        8⤵
        
        PID:16940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21585.exe
        7⤵
        
        PID:11032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2640.exe
        7⤵
        
        PID:15448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30418.exe
        7⤵
        
        PID:16620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32404.exe
        7⤵
        
        PID:4888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37434.exe
        6⤵
        
        PID:7608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9744.exe
        6⤵
        
        PID:11484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6419.exe
        6⤵
        
        PID:16232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13252.exe
        5⤵
        
        PID:5124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26268.exe
        6⤵
        
        PID:7876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61248.exe
        6⤵
        
        PID:11648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19744.exe
        6⤵
        
        PID:15864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45794.exe
        5⤵
        
        PID:5044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46870.exe
        6⤵
        
        PID:13536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36579.exe
        5⤵
        
        PID:11456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6419.exe
        5⤵
        
        PID:16224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56140.exe
        5⤵
        
        PID:16516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63012.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63012.exe
      4⤵
      PID:4352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55676.exe
        5⤵
        
        PID:3196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11446.exe
        6⤵
        
        PID:8084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65152.exe
        7⤵
        
        PID:13956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34290.exe
        7⤵
        
        PID:4708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3782.exe
        7⤵
        
        PID:3084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14185.exe
        6⤵
        
        PID:11600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34135.exe
        6⤵
        
        PID:15572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52984.exe
        6⤵
        
        PID:15428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32058.exe
        5⤵
        
        PID:6364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65126.exe
        6⤵
        
        PID:16364
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 16364 -s 464
        7⤵
        Program crash
        
        PID:16956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12307.exe
        6⤵
        
        PID:1960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15172.exe
        5⤵
        
        PID:10812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4063.exe
        5⤵
        
        PID:10992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27666.exe
        5⤵
        
        PID:16988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17092.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17092.exe
      4⤵
      PID:5188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6231.exe
        5⤵
        
        PID:7828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29356.exe
        6⤵
        
        PID:15848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49754.exe
        6⤵
        
        PID:17336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-82.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-82.exe
        6⤵
        
        PID:10496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16978.exe
        5⤵
        
        PID:11028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35862.exe
        5⤵
        
        PID:15948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44310.exe
        5⤵
        
        PID:17176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55822.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55822.exe
      4⤵
      PID:8780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20122.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20122.exe
      4⤵
      PID:12160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42583.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42583.exe
      4⤵
      PID:16864
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8820.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8820.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45001.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45001.exe
      4⤵
      PID:4340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55676.exe
        5⤵
        
        PID:4160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55240.exe
        6⤵
        
        PID:7084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12307.exe
        7⤵
        
        PID:15228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44607.exe
        6⤵
        
        PID:9832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62312.exe
        6⤵
        
        PID:15380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7596.exe
        6⤵
        
        PID:16504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9507.exe
        6⤵
        
        PID:16856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64539.exe
        5⤵
        
        PID:6180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21598.exe
        6⤵
        
        PID:11500
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 11500 -s 476
        7⤵
        Program crash
        
        PID:888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46840.exe
        6⤵
        
        PID:14396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26437.exe
        5⤵
        
        PID:11628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38219.exe
        5⤵
        
        PID:15012
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 15012 -s 440
        6⤵
        Program crash
        
        PID:17228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21752.exe
        5⤵
        
        PID:15852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52260.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52260.exe
      4⤵
      PID:5504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47840.exe
        5⤵
        
        PID:7696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52132.exe
        6⤵
        
        PID:13944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64057.exe
        6⤵
        
        PID:15068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53865.exe
        6⤵
        
        PID:17236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9507.exe
        6⤵
        
        PID:15480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31865.exe
        5⤵
        
        PID:12408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13191.exe
        5⤵
        
        PID:10992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59801.exe
        5⤵
        
        PID:17084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6835.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:16704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54043.exe
        5⤵
        
        PID:11140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41929.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41929.exe
      4⤵
      PID:8836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3793.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3793.exe
      4⤵
      PID:12236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18098.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18098.exe
      4⤵
      PID:16800
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-65090.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-65090.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20134.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20134.exe
      4⤵
      PID:3356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9334.exe
        5⤵
        
        PID:7128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39226.exe
        6⤵
        
        PID:8556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11959.exe
        6⤵
        
        PID:13344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3713.exe
        5⤵
        
        PID:9976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49921.exe
        5⤵
        
        PID:13548
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 13548 -s 468
        6⤵
        Program crash
        
        PID:10648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3425.exe
        5⤵
        
        PID:14748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20841.exe
        5⤵
        
        PID:16580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25647.exe
        5⤵
        
        PID:16840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18296.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18296.exe
      4⤵
      PID:5240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21966.exe
        5⤵
        
        PID:8596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51108.exe
        5⤵
        
        PID:13184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11641.exe
        5⤵
        
        PID:17008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4507.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4507.exe
      4⤵
      PID:8300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21411.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21411.exe
      4⤵
      PID:14132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2048.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2048.exe
      4⤵
      PID:10648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19233.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19233.exe
      4⤵
      PID:2440
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49898.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49898.exe
    3⤵
    PID:436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19880.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19880.exe
      4⤵
      PID:6756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52054.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8496
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8496 -s 472
        6⤵
        Program crash
        
        PID:10300
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8496 -s 500
        6⤵
        Program crash
        
        PID:13156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29744.exe
        5⤵
        
        PID:13456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26837.exe
        5⤵
        
        PID:15924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30304.exe
        5⤵
        
        PID:12200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45017.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45017.exe
      4⤵
      PID:9556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31227.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31227.exe
      4⤵
      PID:12020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56140.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56140.exe
      4⤵
      PID:17388
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12631.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12631.exe
    3⤵
    PID:6576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17514.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17514.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:14140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45470.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45470.exe
      4⤵
      PID:15596
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2663.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2663.exe
    3⤵
    PID:9668
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55952.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55952.exe
    3⤵
    PID:14048
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53075.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53075.exe
    3⤵
    PID:16496
- C:\Users\Admin\AppData\Local\Temp\Unicorn-46197.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-46197.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3120
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9845.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9845.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9495.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9495.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41758.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8291.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16398.exe
        7⤵
        
        PID:5192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37368.exe
        8⤵
        
        PID:7144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56776.exe
        9⤵
        
        PID:8576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51108.exe
        9⤵
        
        PID:13212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56309.exe
        8⤵
        
        PID:8352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4777.exe
        8⤵
        
        PID:13012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8475.exe
        8⤵
        
        PID:14828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1358.exe
        7⤵
        
        PID:6292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37856.exe
        8⤵
        
        PID:9212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46081.exe
        8⤵
        
        PID:12812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21560.exe
        8⤵
        
        PID:15664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42416.exe
        7⤵
        
        PID:10224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10834.exe
        7⤵
        
        PID:14056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-870.exe
        7⤵
        
        PID:17404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18439.exe
        7⤵
        
        PID:6252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29204.exe
        6⤵
        
        PID:5356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64394.exe
        7⤵
        
        PID:5372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31608.exe
        8⤵
        
        PID:10748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2692.exe
        8⤵
        
        PID:15132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1566.exe
        8⤵
        
        PID:15444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60846.exe
        8⤵
        
        PID:4336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29256.exe
        7⤵
        
        PID:9352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36080.exe
        7⤵
        
        PID:12708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29088.exe
        7⤵
        
        PID:4796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13723.exe
        6⤵
        
        PID:7956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58930.exe
        7⤵
        
        PID:14696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64057.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:15656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1731.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:16488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27067.exe
        6⤵
        
        PID:11228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13435.exe
        6⤵
        
        PID:14684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24798.exe
        6⤵
        
        PID:17328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30034.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30788.exe
        6⤵
        
        PID:5256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20408.exe
        7⤵
        
        PID:8076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57958.exe
        7⤵
        
        PID:9988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37067.exe
        7⤵
        
        PID:4480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56300.exe
        7⤵
        
        PID:15152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15338.exe
        7⤵
        
        PID:13252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44451.exe
        6⤵
        
        PID:8880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49870.exe
        6⤵
        
        PID:12700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3955.exe
        6⤵
        
        PID:4456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12741.exe
        6⤵
        
        PID:15212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18435.exe
        5⤵
        
        PID:5436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25500.exe
        6⤵
        
        PID:6388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23990.exe
        7⤵
        
        PID:12748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56335.exe
        7⤵
        
        PID:16240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57260.exe
        7⤵
        
        PID:3004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45593.exe
        6⤵
        
        PID:9500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50278.exe
        6⤵
        
        PID:13624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20164.exe
        5⤵
        
        PID:8132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15567.exe
        6⤵
        
        PID:13580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-545.exe
        6⤵
        
        PID:6316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55158.exe
        5⤵
        
        PID:9888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52899.exe
        5⤵
        
        PID:14868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24199.exe
        5⤵
        
        PID:14812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34318.exe
        5⤵
        
        PID:544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21892.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21892.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39018.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44986.exe
        6⤵
        
        PID:5308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53320.exe
        7⤵
        
        PID:6828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13605.exe
        8⤵
        
        PID:8724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32441.exe
        8⤵
        
        PID:12028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56309.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4777.exe
        7⤵
        
        PID:12976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42469.exe
        7⤵
        
        PID:4312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18013.exe
        7⤵
        
        PID:1048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35976.exe
        6⤵
        
        PID:6776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11545.exe
        7⤵
        
        PID:12980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45200.exe
        7⤵
        
        PID:17196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44310.exe
        7⤵
        
        PID:17192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33481.exe
        6⤵
        
        PID:11260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59512.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:14756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47932.exe
        6⤵
        
        PID:16496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32404.exe
        6⤵
        
        PID:6540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58561.exe
        5⤵
        
        PID:5528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54088.exe
        6⤵
        
        PID:6308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7871.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:11720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39422.exe
        7⤵
        
        PID:15844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21602.exe
        7⤵
        
        PID:16904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3854.exe
        7⤵
        
        PID:2368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17004.exe
        6⤵
        
        PID:8680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36080.exe
        6⤵
        
        PID:12764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33132.exe
        6⤵
        
        PID:16716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1075.exe
        6⤵
        
        PID:6236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14299.exe
        5⤵
        
        PID:8152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63823.exe
        5⤵
        
        PID:9316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13435.exe
        5⤵
        
        PID:14808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8927.exe
        5⤵
        
        PID:16740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17127.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17127.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61.exe
        5⤵
        
        PID:5276
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5276 -s 632
        6⤵
        Program crash
        
        PID:7636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5416.exe
        5⤵
        
        PID:8044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46958.exe
        6⤵
        
        PID:11368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24072.exe
        6⤵
        
        PID:16136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16802.exe
        6⤵
        
        PID:5972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65524.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:10672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41727.exe
        5⤵
        
        PID:16064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40418.exe
        5⤵
        
        PID:17364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47514.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47514.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56776.exe
        5⤵
        
        PID:8568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13481.exe
        6⤵
        
        PID:1044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64809.exe
        5⤵
        
        PID:12012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54962.exe
        5⤵
        
        PID:15128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50709.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50709.exe
      4⤵
      PID:8236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47524.exe
        5⤵
        
        PID:17032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2507.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2507.exe
      4⤵
      PID:12892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5738.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5738.exe
      4⤵
      PID:14892
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20356.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20356.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15115.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15115.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63714.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24218.exe
        6⤵
        
        PID:1108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28048.exe
        7⤵
        
        PID:6068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4752.exe
        8⤵
        
        PID:9380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50470.exe
        8⤵
        
        PID:12944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48254.exe
        7⤵
        
        PID:9856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49345.exe
        7⤵
        
        PID:13372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24037.exe
        7⤵
        
        PID:14412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45730.exe
        7⤵
        
        PID:15052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2705.exe
        7⤵
        
        PID:6276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24326.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15385.exe
        7⤵
        
        PID:5148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62334.exe
        8⤵
        
        PID:10888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2692.exe
        8⤵
        
        PID:15156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13304.exe
        7⤵
        
        PID:9944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11959.exe
        7⤵
        
        PID:14136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64653.exe
        7⤵
        
        PID:15168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40956.exe
        7⤵
        
        PID:5716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13723.exe
        6⤵
        
        PID:7968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24120.exe
        7⤵
        
        PID:14616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1618.exe
        7⤵
        
        PID:15028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18172.exe
        7⤵
        
        PID:15952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-424.exe
        6⤵
        
        PID:11244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13435.exe
        6⤵
        
        PID:14708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34609.exe
        6⤵
        
        PID:16304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23366.exe
        5⤵
        
        PID:740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30378.exe
        6⤵
        
        PID:6632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21966.exe
        7⤵
        
        PID:8696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17554.exe
        7⤵
        
        PID:12128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60393.exe
        6⤵
        
        PID:7896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22483.exe
        6⤵
        
        PID:12492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3473.exe
        6⤵
        
        PID:6672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4403.exe
        5⤵
        
        PID:2148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39226.exe
        6⤵
        
        PID:8868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44135.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:13152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19848.exe
        6⤵
        
        PID:16528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9507.exe
        6⤵
        
        PID:15868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19884.exe
        5⤵
        
        PID:10032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41256.exe
        5⤵
        
        PID:13544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26104.exe
        5⤵
        
        PID:14788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51614.exe
        5⤵
        
        PID:2644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15260.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15260.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54669.exe
        5⤵
        
        PID:5332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59516.exe
        6⤵
        
        PID:7492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29230.exe
        6⤵
        
        PID:8032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35862.exe
        6⤵
        
        PID:16032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52678.exe
        6⤵
        
        PID:16388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58622.exe
        5⤵
        
        PID:8788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45323.exe
        5⤵
        
        PID:12168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48030.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:13492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34423.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34423.exe
      4⤵
      PID:4920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41177.exe
        5⤵
        
        PID:6264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39226.exe
        6⤵
        
        PID:8524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11959.exe
        6⤵
        
        PID:13696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50829.exe
        6⤵
        
        PID:4540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8475.exe
        6⤵
        
        PID:17036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7108.exe
        5⤵
        
        PID:9000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45656.exe
        6⤵
        
        PID:6712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31227.exe
        5⤵
        
        PID:13300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7027.exe
        5⤵
        
        PID:16676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50533.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50533.exe
      4⤵
      PID:6596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39226.exe
        5⤵
        
        PID:8776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11462.exe
        5⤵
        
        PID:12636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57260.exe
        5⤵
        
        PID:15320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51868.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51868.exe
      4⤵
      PID:9540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11892.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11892.exe
      4⤵
      PID:11804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51346.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51346.exe
      4⤵
      PID:14880
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56048.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56048.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59630.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59630.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58753.exe
        5⤵
        
        PID:5568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8177.exe
        6⤵
        
        PID:6472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30342.exe
        7⤵
        
        PID:14372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24473.exe
        7⤵
        
        PID:6904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5904.exe
        6⤵
        
        PID:10664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41508.exe
        6⤵
        
        PID:14960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45200.exe
        6⤵
        
        PID:16416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58509.exe
        6⤵
        
        PID:168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45986.exe
        5⤵
        
        PID:8292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36771.exe
        5⤵
        
        PID:11828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37437.exe
        5⤵
        
        PID:15004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13898.exe
        5⤵
        
        PID:1852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24772.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24772.exe
      4⤵
      PID:916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35976.exe
        5⤵
        
        PID:6688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54166.exe
        6⤵
        
        PID:10700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2692.exe
        6⤵
        
        PID:15076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26463.exe
        5⤵
        
        PID:9684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25417.exe
        5⤵
        
        PID:13960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21918.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21918.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48318.exe
        5⤵
        
        PID:17264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64286.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64286.exe
      4⤵
      PID:10908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26640.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26640.exe
      4⤵
      PID:15616
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8218.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8218.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54669.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54669.exe
      4⤵
      PID:5808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11493.exe
        5⤵
        
        PID:6848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31608.exe
        6⤵
        
        PID:10712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2692.exe
        6⤵
        
        PID:15172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40242.exe
        6⤵
        
        PID:17144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63289.exe
        6⤵
        
        PID:17200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12728.exe
        5⤵
        
        PID:9648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50278.exe
        5⤵
        
        PID:14076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14299.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14299.exe
      4⤵
      PID:8140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52132.exe
        5⤵
        
        PID:13964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64057.exe
        5⤵
        
        PID:15288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1731.exe
        5⤵
        
        PID:16480
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21499.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21499.exe
      4⤵
      PID:11704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45498.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45498.exe
      4⤵
      PID:16220
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58266.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58266.exe
    3⤵
    PID:2140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35976.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35976.exe
      4⤵
      PID:6744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34348.exe
        5⤵
        
        PID:10056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34404.exe
        5⤵
        
        PID:13628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45200.exe
        5⤵
        
        PID:15068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30304.exe
        5⤵
        
        PID:10268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33481.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33481.exe
      4⤵
      PID:11208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59512.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59512.exe
      4⤵
      PID:13572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39845.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39845.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:14700
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61103.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61103.exe
    3⤵
    PID:6568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12147.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12147.exe
      4⤵
      PID:11344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59075.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59075.exe
      4⤵
      PID:16116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37145.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37145.exe
      4⤵
      PID:1440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20389.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20389.exe
      4⤵
      PID:15352
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54920.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54920.exe
    3⤵
    PID:9596
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61288.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61288.exe
    3⤵
    PID:13664
- C:\Users\Admin\AppData\Local\Temp\Unicorn-3715.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-3715.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3988
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32054.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32054.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58094.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58094.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8291.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57430.exe
        6⤵
        
        PID:5216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27638.exe
        7⤵
        
        PID:7300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58229.exe
        7⤵
        
        PID:9992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9821.exe
        7⤵
        
        PID:14452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51903.exe
        6⤵
        
        PID:7532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28244.exe
        7⤵
        
        PID:10408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56064.exe
        7⤵
        
        PID:4336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61376.exe
        7⤵
        
        PID:16432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1401.exe
        6⤵
        
        PID:10708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29712.exe
        6⤵
        
        PID:9248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35426.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42530.exe
        5⤵
        
        PID:6680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55754.exe
        6⤵
        
        PID:8072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56579.exe
        6⤵
        
        PID:11008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17668.exe
        6⤵
        
        PID:732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11140.exe
        5⤵
        
        PID:9688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28427.exe
        5⤵
        
        PID:6584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3392.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3392.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61.exe
        5⤵
        
        PID:5272
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5272 -s 628
        6⤵
        Program crash
        
        PID:7628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19806.exe
        5⤵
        
        PID:8188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46870.exe
        6⤵
        
        PID:13192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8337.exe
        6⤵
        
        PID:14460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3974.exe
        6⤵
        
        PID:16524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36744.exe
        5⤵
        
        PID:11304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13138.exe
        5⤵
        
        PID:16096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44310.exe
        5⤵
        
        PID:13548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2675.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2675.exe
      4⤵
      PID:5556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58364.exe
        5⤵
        
        PID:7288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4415.exe
        6⤵
        
        PID:8904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11959.exe
        6⤵
        
        PID:14296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6314.exe
        5⤵
        
        PID:10196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4969.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:14092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56300.exe
        5⤵
        
        PID:13952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44310.exe
        5⤵
        
        PID:15476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5966.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5966.exe
      4⤵
      PID:7524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57778.exe
        5⤵
        
        PID:13348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29935.exe
        5⤵
        
        PID:16980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62724.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62724.exe
      4⤵
      PID:10456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16526.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16526.exe
      4⤵
      PID:16056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42367.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42367.exe
      4⤵
      PID:16532
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17808.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17808.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-123.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-123.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1048
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1048 -s 628
        5⤵
        Program crash
        
        PID:5980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50314.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50314.exe
      4⤵
      PID:6428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56776.exe
        5⤵
        
        PID:8584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51108.exe
        5⤵
        
        PID:13204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28847.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28847.exe
      4⤵
      PID:8640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1977.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1977.exe
      4⤵
      PID:12792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14590.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14590.exe
      4⤵
      PID:6908
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36972.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36972.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8229.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8229.exe
      4⤵
      PID:5172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49236.exe
        5⤵
        
        PID:6868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61784.exe
        6⤵
        
        PID:9200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50165.exe
        6⤵
        
        PID:13072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13897.exe
        6⤵
        
        PID:17012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9308.exe
        6⤵
        
        PID:4784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59023.exe
        5⤵
        
        PID:9824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43480.exe
        5⤵
        
        PID:1964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26374.exe
        5⤵
        
        PID:392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30522.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30522.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31634.exe
        5⤵
        
        PID:8228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3102.exe
        5⤵
        
        PID:13384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46107.exe
        5⤵
        
        PID:17160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65314.exe
        5⤵
        
        PID:17220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26655.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26655.exe
      4⤵
      PID:9396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56335.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56335.exe
      4⤵
      PID:13404
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55027.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55027.exe
    3⤵
    PID:5388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53512.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53512.exe
      4⤵
      PID:6016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30212.exe
        5⤵
        
        PID:12672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54886.exe
        5⤵
        
        PID:1292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25495.exe
        5⤵
        
        PID:2056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56570.exe
        5⤵
        
        PID:14648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-284.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-284.exe
      4⤵
      PID:10024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65271.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65271.exe
      4⤵
      PID:14932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37441.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37441.exe
      4⤵
      PID:17120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28856.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28856.exe
      4⤵
      PID:16148
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18515.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18515.exe
    3⤵
    PID:6408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8499.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8499.exe
      4⤵
      PID:8504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46081.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46081.exe
      4⤵
      PID:12820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34388.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34388.exe
      4⤵
      PID:4804
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49722.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49722.exe
    3⤵
    PID:10236
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2699.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2699.exe
    3⤵
    PID:14080
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23064.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23064.exe
    3⤵
    PID:17104
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58805.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58805.exe
    3⤵
    PID:5684
- C:\Users\Admin\AppData\Local\Temp\Unicorn-9230.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-9230.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2768
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41758.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41758.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47186.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47186.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:8
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44986.exe
        5⤵
        
        PID:5324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54088.exe
        6⤵
        
        PID:6312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46958.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:11392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24072.exe
        7⤵
        
        PID:16168
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 16168 -s 436
        8⤵
        Program crash
        
        PID:15240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9507.exe
        7⤵
        
        PID:16916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59983.exe
        6⤵
        
        PID:9312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36080.exe
        6⤵
        
        PID:12840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34798.exe
        5⤵
        
        PID:7856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47844.exe
        5⤵
        
        PID:11132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30269.exe
        5⤵
        
        PID:14484
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 14484 -s 456
        6⤵
        Program crash
        
        PID:1508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10037.exe
        5⤵
        
        PID:16492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4700.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4700.exe
      4⤵
      PID:5444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64394.exe
        5⤵
        
        PID:5396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52438.exe
        6⤵
        
        PID:9724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29744.exe
        6⤵
        
        PID:13336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13968.exe
        6⤵
        
        PID:2036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53761.exe
        5⤵
        
        PID:9604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19551.exe
        5⤵
        
        PID:13704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36282.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36282.exe
      4⤵
      PID:7816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53180.exe
        5⤵
        
        PID:11420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24072.exe
        5⤵
        
        PID:16160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60654.exe
        5⤵
        
        PID:3724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53709.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53709.exe
      4⤵
      PID:11144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21603.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21603.exe
      4⤵
      PID:11140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63309.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63309.exe
      4⤵
      PID:16880
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30034.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30034.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30788.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30788.exe
      4⤵
      PID:5248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43782.exe
        5⤵
        
        PID:6484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33554.exe
        6⤵
        
        PID:10924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2692.exe
        6⤵
        
        PID:15068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21585.exe
        5⤵
        
        PID:11036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2640.exe
        5⤵
        
        PID:15388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28664.exe
        5⤵
        
        PID:16940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61376.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25068.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25068.exe
      4⤵
      PID:7184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52708.exe
        5⤵
        
        PID:14800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50366.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50366.exe
      4⤵
      PID:10496
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10496 -s 476
        5⤵
        Program crash
        
        PID:12688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13034.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13034.exe
      4⤵
      PID:11220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7868.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7868.exe
      4⤵
      PID:10912
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49162.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49162.exe
    3⤵
    PID:5404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11877.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11877.exe
      4⤵
      PID:7468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60580.exe
        5⤵
        
        PID:10964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13190.exe
        5⤵
        
        PID:15008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36542.exe
        5⤵
        
        PID:16396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11166.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11166.exe
      4⤵
      PID:9008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44632.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44632.exe
      4⤵
      PID:14432
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12764.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12764.exe
    3⤵
    PID:7888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3740.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3740.exe
      4⤵
      PID:3672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51980.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51980.exe
      4⤵
      PID:15408
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27913.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27913.exe
    3⤵
    PID:10480
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16526.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16526.exe
    3⤵
    PID:15976
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 15976 -s 464
      4⤵
      Program crash
      PID:1540
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25953.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25953.exe
    3⤵
    PID:16916
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28864.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28864.exe
    3⤵
    PID:6036
- C:\Users\Admin\AppData\Local\Temp\Unicorn-32827.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-32827.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2176
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28712.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28712.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34872.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34872.exe
      4⤵
      PID:5232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37176.exe
        5⤵
        
        PID:3412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46958.exe
        6⤵
        
        PID:11384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63735.exe
        6⤵
        
        PID:15404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18172.exe
        6⤵
        
        PID:16464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49293.exe
        5⤵
        
        PID:10072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35696.exe
        5⤵
        
        PID:13720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56300.exe
        5⤵
        
        PID:15080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58509.exe
        5⤵
        
        PID:16392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7580.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7580.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60580.exe
        5⤵
        
        PID:10956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13190.exe
        5⤵
        
        PID:15052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1731.exe
        5⤵
        
        PID:16468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64275.exe
        5⤵
        
        PID:16760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10127.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10127.exe
      4⤵
      PID:9440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56143.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56143.exe
      4⤵
      PID:14244
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50314.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50314.exe
    3⤵
    PID:6400
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16860.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16860.exe
      4⤵
      PID:6820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56579.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56579.exe
      4⤵
      PID:12968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39074.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39074.exe
      4⤵
      PID:16408
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19116.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19116.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:7480
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28427.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28427.exe
    3⤵
    PID:6524
- C:\Users\Admin\AppData\Local\Temp\Unicorn-44278.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-44278.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1516
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44986.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44986.exe
    3⤵
    PID:5304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62448.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62448.exe
      4⤵
      PID:7212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-715.exe
        5⤵
        
        PID:7932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17492.exe
        5⤵
        
        PID:8984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5877.exe
        5⤵
        
        PID:15896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48202.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47539.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47539.exe
      4⤵
      PID:9548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19551.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19551.exe
      4⤵
      PID:13864
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33428.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33428.exe
    3⤵
    PID:7652
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25479.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25479.exe
    3⤵
    PID:11120
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34510.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34510.exe
    3⤵
    PID:7484
- C:\Users\Admin\AppData\Local\Temp\Unicorn-4489.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-4489.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5516
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23362.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23362.exe
    3⤵
    PID:5948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62334.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62334.exe
      4⤵
      PID:10900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2692.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2692.exe
      4⤵
      PID:15140
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59983.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59983.exe
    3⤵
    PID:9284
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36080.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36080.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:13040
- C:\Users\Admin\AppData\Local\Temp\Unicorn-55459.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-55459.exe
  2⤵
  PID:7948
- C:\Users\Admin\AppData\Local\Temp\Unicorn-30960.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-30960.exe
  2⤵
  PID:11196
- C:\Users\Admin\AppData\Local\Temp\Unicorn-56837.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-56837.exe
  2⤵
  PID:14884
- C:\Users\Admin\AppData\Local\Temp\Unicorn-47069.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-47069.exe
  2⤵
  PID:15972

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1048 -ip 1048
1⤵
PID:5948

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 5276 -ip 5276
1⤵
PID:7708

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 5272 -ip 5272
1⤵
PID:7980

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 8496 -ip 8496
1⤵
PID:9948

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 10496 -ip 10496
1⤵
PID:11532

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 10544 -ip 10544
1⤵
PID:12208

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 8496 -ip 8496
1⤵
PID:12728

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 13548 -ip 13548
1⤵
PID:14988

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 14788 -ip 14788
1⤵
PID:16264

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 11500 -ip 11500
1⤵
PID:1836

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 14424 -ip 14424
1⤵
PID:14792

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 14856 -ip 14856
1⤵
PID:15972

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 14616 -ip 14616
1⤵
PID:15896

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 14484 -ip 14484
1⤵
PID:15348

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 14920 -ip 14920
1⤵
PID:16264

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 15008 -ip 15008
1⤵
PID:3004

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 15052 -ip 15052
1⤵
PID:14700

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 15380 -ip 15380
1⤵
PID:9296

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 16168 -ip 16168
1⤵
PID:15112

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 676 -p 15964 -ip 15964
1⤵
PID:16568

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 15012 -ip 15012
1⤵
PID:17240

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 680 -p 8724 -ip 8724
1⤵
PID:14040

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 17296 -ip 17296
1⤵
PID:17400

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 1508 -ip 1508
1⤵
PID:16736

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:5228

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-11742.exe

Filesize
184KB

MD5
e0a830f6bcdd7148995956a538abee32

SHA1
8d893fd51e735d98c0412957a805b808536cea3a

SHA256
44f62fec71143f133d1879732ca5968ee9f47561a203c4100ba37f59de8bc227

SHA512
29f58cc83d43998dec8f9ec46a9e4f57788463179bbb7910efb02b0c093dad9b8533e01ea7e12c820033e23111a158bc10d9824fbeb9c1a955164357808f8e6f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-13605.exe

Filesize
184KB

MD5
5f56b8428ae55a6a6ade0649dfdd5321

SHA1
622d6cd2099753c6d866fbcf3e422748822d500c

SHA256
3226162453e652cb18d7a256bb47ac37e1248fb36bc7c1e53a421b23abf73b54

SHA512
ae2841043b5950f615a508837baa9fd1b09b9024da6476ca4ad1d09e8229534b8f782150d3e348c3a3723e5bd1e8a4bc166f4d65700fb6c93ad48eb374c8b0fb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-15115.exe

Filesize
184KB

MD5
7044d604568dee8aa3529b93f5d29226

SHA1
ab8afc7aaf4b8ac39b349874419f6a76cea8eac6

SHA256
4e7d28988b87e71d361c983d33e426848d3a4d2fbd35cd9ed6a91a18ed72c465

SHA512
84d7f5042def126e4f83d80e9d7d1d1e56d922946660e22db324168ea4fa00fb681f67250d10a33536eb161c58dc347dfae3a50786c21d06b898b22d32773008

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-15617.exe

Filesize
184KB

MD5
91e93d6f6f94ecea2c6eaef32cb3f15b

SHA1
3ba32d25025fb97e4d4d120c10f73b15f9128afc

SHA256
f102ff42a27fdaf800d3859ba3f694f61a208f15f7bbc9eec8949b1ca9cbc3d9

SHA512
c6120511009dc33859703467355e6c1dd6719fb81c9474f15cab565d40842d3e29af1ad303562c42a86c851e87236ec6216117924df36d4d523d937d350779e4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-15902.exe

Filesize
184KB

MD5
7b92ae7ae56ebb74549123a5fad35572

SHA1
d9ae101391b8f8999663655675a4e9f00e6690da

SHA256
72515d73b39d6ef51009d00fa6cb0ed254dada463792019a8054fb111d3a5c39

SHA512
a679b6ac68d9e4d46100b22733197b547db1c2ed0f6f39e164908baa6b4ee2036e59ba00b599a08d404e0caaaeac764815a4ca7e9e7f9ed42de59f6822365f94

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-17808.exe

Filesize
184KB

MD5
b9813ba80341b800cdecb63a4d0b4d08

SHA1
677200963846671d20f40ec36eacbde932ffe5ae

SHA256
e3d64af904f5a22c2b8a2dfac7b94c8cf69880aff77a3a50c0bb88318c5fb18e

SHA512
391716534dc2918570ce463e5bf2d718d244204843f0a47bb112b09ce97bc0a8b2a00a5629889f500dd86fd0f218a3d25753824ef0f0197d05eaab3b3ce48200

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-20356.exe

Filesize
184KB

MD5
885e0eb82a0f5def718594261befc880

SHA1
ba108b089c73cabbbb2dfd6abd6d8d685fdced18

SHA256
1eb95cd778a1c2c1f30196ea67e73d1092153cabcbb3d3f55e952ec1cf9be1c5

SHA512
0febb455ddd4ac54deba373e78247d203473eb6b56cf38ddc73369f3b6a428374222ccd50e7a229c86cef267c81c4a9cd713ced359bdb27b94a20cd7c981428d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-21748.exe

Filesize
184KB

MD5
88a7abde2081d1702aaed64a115a8e89

SHA1
b1afcc58477801ee897adead9805807a3c8af3e1

SHA256
bb2baae3b53f1b0c1455ea43ec042a86beee89daa5ef09672d2a0e03970ffd6e

SHA512
2b093074ae8b568a6487eb88ffb7b4fa923871002ef87a0aa691de6380b77186dbaee218c434d894a5a3d5218fc5d436486cd4995c2f5b2273d1be88994427f5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-21892.exe

Filesize
184KB

MD5
b524ef2d084d8119271a9b61287cfbad

SHA1
d5d814fbe73ed350d55eaec68fb52d896e0e41ac

SHA256
b599f544b018baedf10e794d73d5f3f046aeeffff65efb22720d20a6ce4c52e8

SHA512
dd22023d87672ead85b7a22831e2730cc06cbd1d3cc81de2a6892efcfc5fc2da5c4c14b6456027b059f137ea6d2cd54affe3654afde378c7b9be87213b16b455

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-25422.exe

Filesize
184KB

MD5
1c0f9ac39ac941718501e286abaee3d6

SHA1
806f183c663c81798d1e93b90b2c2d6818426f07

SHA256
b87b647596f7615d88e453d5324d2409b2523184dc31a51bff903c62a6e6d829

SHA512
c175c3cf5bb7dba62e9f4c21752f18fc2870e715026feabbd6e7ca6656cfd7cd3c69ab9be4d3b5bc29eabdbe6494783ef482da783f5c2f1e81261cb4ac666b58

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-25832.exe

Filesize
184KB

MD5
bf06aa189b0d71a99cec66b3bef9dbd5

SHA1
624d5922b40dd399ca5c90e7933972e146c786c1

SHA256
0907ee60c0f7337294a11f61fe627b8f9c04960a6fa13bda00d881c8f8d434fa

SHA512
0db52e20d5f5423e043aa46c3be06db38a6223879b9d0d2e420cf604a328fef2fbc68cedefaed031fa6e402be916c7986b5dccbc896f20d180d0a099538333fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-32054.exe

Filesize
184KB

MD5
887141fe3ebd6f71cb469c2983d702e0

SHA1
c56d88e3c14347a5bda8fbe78177e06be1edd3dd

SHA256
d551395e96e61e089f7b035e12506115a96420cd679c91cc42008138bc3064ab

SHA512
86a6cc3d8b10fd3dcf6cb749fe2981823afb739578d6923a428494cdb02b1e755dc36f2c46aacce0f545027d0bd311d18727e0adad515113340916bffdca4117

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-32827.exe

Filesize
184KB

MD5
3949fa8e3ee7a9b69a6cf58260933ae8

SHA1
800d6612293ca54a1716b8b4d257fe5d59b1b67a

SHA256
7aefd309c2eb0ff4a95b3fcf4d8ed6427c38791e23a8f55485f7cebcc7ec42f7

SHA512
95e55c00716145596964f7554864cda1a58692bf80dff0bb5d6c61b57d47e5fcef4034e1be2c2ca0cc9a55cbc1bf75c8b6cc1b38de4b09030782a450be61e94c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-34350.exe

Filesize
184KB

MD5
0bed152cad90fb4380dff52aebf47fa4

SHA1
4de73da1928fd9eb82ff633c1676d09e24d93596

SHA256
b808670c74db142e42bbcf02fe9f2b74dfee247356173c9c50eb6af29635d74a

SHA512
c6836414331fd9b8a0ab761907e0903d785e246d2a2792da8682e1dd9c063657eea1dd67839704f6f72a985f446aeb1d27ba6cfe69b93025f3338333556aff2b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-35728.exe

Filesize
184KB

MD5
98949ac576ac94acdb78688254bc2b7d

SHA1
6c5b6db0f2aea978cc89c63501d35b30fe28e0b3

SHA256
f784c53c5076be6a247d4631061a978f5c19211d0300a54b2413ce4ea28e52c5

SHA512
dca3a6a70d029fcf493320ff688eeaf30ed7131b4c5f7d729ccb949717fa350fe413af39b240764cad5ddd4a9d620004759750a30bab4aa907082cb437627b2f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-3715.exe

Filesize
184KB

MD5
fbe8bfdea7ebc86837f826ef21459fb8

SHA1
0b5e3e364905ae1ae60b65993ff3add0168bde91

SHA256
bf5be188f079e8c3469b29a228669fdf28ab59c600ea3f733f5648d5c10c9e42

SHA512
18abac54a6a1a1a38c8a59830924f32a6685409e92adab23e499c52645c5879b5a4f5896aac4d794ca2ea7c11f8d00a68678217d4df1aae4da2bb0ae539e83f8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-41758.exe

Filesize
184KB

MD5
01b9279188d0c9154514170e1b125dbb

SHA1
950025c235110bc1f960ff066166cf522775f1e8

SHA256
d396081f9f53efab1e28cab73d031438e9ce9a78db085ef72c1075b6dbb95d2e

SHA512
a2462c9ad0441235b0f2c95c89e04e5d7b3bb5cb6ffe699ec60833b91afbb6578f7af0e0c6035dc5411839ca6093b634c129cc52e6843eb34ae080b331618235

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-46197.exe

Filesize
184KB

MD5
dbcfb0aea06b02f4f83aa337c1b84387

SHA1
cce30af34d646cc891dd973f5f272a3c90166046

SHA256
6cd4714915a16d9fa38b1b42e0a2feee744714bc9b1e20cdef1bd92c1a6dc884

SHA512
7b2c725984ba47da5711519ac2167d26e02454354b43cca22572362e481777318bcf28d3a63c553baa03fb9c147a2fb44d07994fbda94635e86835281d5a7f37

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-46999.exe

Filesize
184KB

MD5
8fdbf43022a3a78e258842f6fbf2476b

SHA1
cc04b900ad0bb09653359329bf0c4f712eaf8a5b

SHA256
8f9bb9c259cdfc0a6c464f48ccf37d4e26233a215c652fb5428883266757b491

SHA512
b4389aa126c964b757b27db384728e3b476bea2bc7ec78931ce4db047902dda3946d701847f4658440f777fb86756ba6d7a01084c08a6e69c5b6650671433384

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-51825.exe

Filesize
184KB

MD5
c7e80a5a0443f00f0f08ca2935784908

SHA1
7b7dbea70d02d3847eb0b892e66bda5de8b75b75

SHA256
753cf2243eba4a2797761879d71b3e108a36193e64a3f1c1733bb519d501d98c

SHA512
951c4a18f1d90d93c068f5c980101b61abab3249ae466909b5432b67e2d6a5074473cca43d2284c4eba2b8f5a3ca4721246a60f117b974d31ef5031792838fa2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-525.exe

Filesize
184KB

MD5
612ac7c61b389fca2ece5d195983e451

SHA1
4bcc39601a5e8bcadfb0a17ca931d5dd3cb59a86

SHA256
c137b332fadad5eca67c18d6de8b56d4da9289c445861c3f0c6d66067cc5dd38

SHA512
11d6256b12b6ec8b7f4736e97afb8dd07ec43943c2f379ddd5313175bab97dd6201bbbc61572454ee38dab255ba41ad6e893f7e53ecad71d49909056ba6f3c26

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-54757.exe

Filesize
184KB

MD5
eca0b020d45e226e377f39606115a498

SHA1
35d3dfe6c8b6ef883973a45f6c97fe00a54a8ac4

SHA256
cc9b376ee4e80eafbd51a21ebcd4afd958633562ec87c57bf4ab62f02ae4643e

SHA512
da2466531d3186122b0a8289ec41cc6a30e295ab5ce45a4b06bf011378c2c600dc24c96b6953617c7a7a643133d7977d174eb7b8976ea50609ee37d0c08dd756

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-54970.exe

Filesize
184KB

MD5
fd96f188a22683c71dd6692260449983

SHA1
e7590e8f81fb3fe89a1113a166c76a29b2ca142d

SHA256
e901912bc939f8c62213ffce43e3bff6c3e103ff3445cbc333d499d4a98c1dbe

SHA512
a3594f36579e272c8b49ff6a00170406692c270f36b990cfe57196b85b7340310bc7c34ee49bb314a767a8103735d2238012dde7fa0177ca7d99461a42af9016

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-56048.exe

Filesize
184KB

MD5
3b056c6081d96e439148c751b27dab8b

SHA1
0c41bff05d212e9816808f9dc805e6d205b4109b

SHA256
a13513bc45cfeb5a4f2ec5a0ba77ef2e6d8aa789ed5c9f70bca4a4eebaa3d857

SHA512
ec3b1022aa6500c6a9889f55633377f8cc3c4d0175bfd0f275d59eee30e93addeacb06a7ce808f362fee8db9b29d09e168858bd897dfe5e56230d9bd39c03c82

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-56148.exe

Filesize
184KB

MD5
e23a466a29a774aaef0c4a2e00760c1e

SHA1
ade6b90dc026bd246e586841b551e187e4821042

SHA256
41959ce59d5d0f116d6d8b6f383837e1c7b4847751f5c9d1369e48717081e29b

SHA512
e0232cd8202228f71e48f063a395244d48a3d1b4cf830bc2a237a2bc1ada1a37a1d8340e167ba4f40762efaf7b6c7bcc386e6ec164ccf21c9c6a0d88b0e8897a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-58094.exe

Filesize
184KB

MD5
cd9cd8c18bd9515d7273e5fb9c7528c6

SHA1
af07ed56894711504355938bff39069e1b949339

SHA256
f8bae39cf75bc8e376dbca7c9ef0d53d6d77620c6aec100d8571cd5db46ac36b

SHA512
dae82864cb5490e76c432ed07f938c3e1362e181fe2c978e6f2e71258334bef98300f5d8036ccabd8e239644c2334940eab7e70b0738b8a9b8b167f5c960c24d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-58841.exe

Filesize
184KB

MD5
a0f1229366a6eed1536c23b1e1bb6c14

SHA1
ec077ceab44f57f52377c65f61d6c6308bd891c0

SHA256
55a09340ece73ad0b1a0ba35c754974e066c56c63385d8f6b53026bdfca66d04

SHA512
f6a521a87e9ab24a7fc2f98ab5c920ffed85560c408dd88f6ce92530c126e384581d397ad5a9334db089d69bf63abbcabd575a93ffa5b1b67054ee6eaabbb3c2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-59601.exe

Filesize
184KB

MD5
efc7ca3daccba490cadd723b33639f43

SHA1
60dbdf6c395b050476287f9c48cfe1ea25e046bb

SHA256
f991cafb18b8e642633f5b65d9d40055d986085365e54fa25252b930213bed97

SHA512
9b142fdcdaa448a95054dbcb30d976ea6b5c9237ccaa354ab6d367b7816305b9369c153cd3f2e0fcae70dabab2933dd4aa964e36fe30722053285aaf020832d9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-64394.exe

Filesize
184KB

MD5
76980a2831e1e107792f0cd554c297b9

SHA1
a3f4c580fb2eea4de01616526ec1a9c67437210c

SHA256
01c0c4ece4c0a318464022d7cd2bf4c374a5a0d7dc06ca7b61ee0afde001c970

SHA512
81a886c02612acd7f7506ab277bf32a2491e1d856f906ddef8ba8fbde89a02fd42ccc56edd8a1602eea8372e40dca34d8b02dd414a488a30f09cf9043f0c8bef

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-7039.exe

Filesize
184KB

MD5
3a00a77d7d4014f5737788f2d2be5fe3

SHA1
ff4eb3916776c967289cd08c139a28bbfeb95670

SHA256
2bd5cd604e7eabd6ba14af6d655f24d2b40d0cf0a2bf3dcf9708e6c5d23acd79

SHA512
1cf1f48f6869c21904eb410eb44750815554f7cc3cdc5887ccff5f9115181d33b643a194c3a5a309ac05197e7e34b7cd7ad0098cc45f0ee188a803e343eee934

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-8820.exe

Filesize
184KB

MD5
68b7c1c39d79176d3833249ff1fb2969

SHA1
9cb86407758c9e40a724386b6a24a7ef7432b234

SHA256
1df825f48f3ae83d68e6da68692cd8c5a8758102484bfcb4e4776e0f905c794e

SHA512
8b6d060577d1f59a90777235e89a3afb3d1463f79a90aea58becf077c31819b0ab51377257501a1431bf51c32dcc4e1a1351b6858770e7af66b5e98178194dd4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-9230.exe

Filesize
184KB

MD5
10fff1db71d77f63e5289903f1a7b7e2

SHA1
b684a84176335a116f567c4296217ca54a61574d

SHA256
7d791400b123a96d67cdbfc34c42adbc3c4ad50919fdce10364da1054700e78a

SHA512
9d4859ecabec85f2ca5b88f4912c29b38cbe7b0d4a667c3a70ece6bf61ca27558090c68d382484595f56dd254046268a3d9e5f8e7ceed143c875b9989df70e5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-9495.exe

Filesize
184KB

MD5
3ecb81f8df071c7af95eaace6cbab574

SHA1
8f3b1573bf14627d1db4e8fa4f83dc1ab0da1981

SHA256
968c721cd16c29f22026d7bf40a9755f93051eb7e6de01ec848007cf4fe606dc

SHA512
80f8c19693753745ffa15f8aaf0bd36dd5a6a706e1a2000c964b64394756e3d5de21d7068b3cec84858f1e8bb81479b88d25797f7462a3381df7bfcf6287218a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-9845.exe

Filesize
184KB

MD5
c6267481e9651284d11ca061ae8b4812

SHA1
4e026ba61c16029be453ccb5d886b35016493fe1

SHA256
e706b9b53590bb27266faa29f42091f93d3d5dca83b72e6a2d87e5ab79d4a795

SHA512
82e6245b932b41d86bfdaddbb411d7095a6d14e7a05bf5c722365c68059596b32486ba9b097b3e259c5fcdc328f170a4bd7aa61a1e4868048d8d6a6e6301ddb0

Download Submit
memory/8-334-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/436-484-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/468-378-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/740-497-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/820-430-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/848-348-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/872-215-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/916-496-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/960-429-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1004-494-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1016-394-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1048-333-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1108-452-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1144-286-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1152-291-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1212-149-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1316-284-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1360-314-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1376-563-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1376-0-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1388-425-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1424-495-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1476-73-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1516-331-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1624-6-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1636-121-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1652-372-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1732-273-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1804-252-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1820-230-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1864-49-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1928-55-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1944-392-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1972-164-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2124-419-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2140-483-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2176-198-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2188-3010-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2220-237-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2256-67-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2284-278-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2360-139-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2372-485-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2468-336-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2524-283-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2576-27-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2716-332-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2720-482-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2728-99-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2736-346-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2764-37-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2768-96-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2780-492-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2848-152-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2960-197-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/3032-335-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/3120-16-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/3264-162-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/3316-282-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/3356-453-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/3432-112-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/3452-422-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/3472-229-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/3592-380-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/3688-195-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/3884-347-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/3928-480-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/3976-94-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/3988-48-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/4004-277-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/4076-196-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/4312-3115-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/4340-404-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/4352-393-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/4520-221-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/4636-426-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/4688-183-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/4788-242-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/4832-66-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/4840-19-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/4920-481-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/4924-274-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/4928-285-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/4944-373-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/4956-150-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/4968-249-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/4972-123-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/4992-97-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/5056-3726-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/5172-527-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/5192-528-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/5216-564-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/5232-559-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/5248-560-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/5272-561-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/5308-562-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/5356-581-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/5436-587-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/5472-588-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/9564-5057-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/11096-5083-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/11948-5092-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/13880-2986-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/14136-2985-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/14484-3208-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/14492-3425-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/14748-3236-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/14800-3405-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/14808-3407-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/14920-3478-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/15052-3406-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/15068-3036-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/15132-3410-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/15168-3773-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/15224-3408-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/15720-4016-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/15932-3064-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/16456-4017-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/17012-3795-0x0000000075320000-0x00000000753BF000-memory.dmp

Filesize
636KB

Download
memory/17060-3660-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/17168-3558-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads