58311e94f84d3ae3f1748f8d8989818c88189f5677791786dab41e9665aff475

Analysis

max time kernel
120s
max time network
98s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
25/09/2024, 22:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

58311e94f84d3ae3f1748f8d8989818c88189f5677791786dab41e9665aff475N.exe
Size

468KB
MD5

4191e159b6fba9366c1ee26c096aa320
SHA1

d18cc86ad4b5d4060978397b97239bfd3983ed60
SHA256

58311e94f84d3ae3f1748f8d8989818c88189f5677791786dab41e9665aff475
SHA512

401a5cb5f113ea09f4f8e6061d93259a1efc82a7816c1a6939bafe2385341852eceb59a41f1d3f81e3caf17e4b5dc83a36278367ee2e3104f1dfd4cca919ce32
SSDEEP

3072:W1N/ogLda58Un+/SP35FafOcfhzWI8JnmHe0Va9lQuaibFN4wlM:W11o9qUnBPpFafgxPxlQdwFN4

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2884	Unicorn-34861.exe
3144	Unicorn-3112.exe
1636	Unicorn-44700.exe
4788	Unicorn-32853.exe
1420	Unicorn-28769.exe
768	Unicorn-8903.exe
1016	Unicorn-49281.exe
3868	Unicorn-53055.exe
380	Unicorn-53055.exe
4684	Unicorn-28913.exe
3632	Unicorn-48514.exe
1220	Unicorn-11922.exe
216	Unicorn-14523.exe
3468	Unicorn-3615.exe
3020	Unicorn-34171.exe
3648	Unicorn-19872.exe
2636	Unicorn-26003.exe
1712	Unicorn-21919.exe
1572	Unicorn-52453.exe
4672	Unicorn-43523.exe
4320	Unicorn-32587.exe
676	Unicorn-13558.exe
348	Unicorn-44285.exe
1980	Unicorn-39936.exe
1916	Unicorn-34070.exe
4140	Unicorn-20335.exe
4632	Unicorn-4020.exe
3640	Unicorn-16364.exe
3912	Unicorn-2266.exe
2464	Unicorn-30946.exe
2980	Unicorn-27539.exe
536	Unicorn-34123.exe
3944	Unicorn-33569.exe
1700	Unicorn-1259.exe
3820	Unicorn-43683.exe
828	Unicorn-48943.exe
2152	Unicorn-8872.exe
4100	Unicorn-704.exe
4352	Unicorn-57808.exe
1420	Unicorn-51943.exe
1892	Unicorn-53797.exe
2388	Unicorn-56490.exe
4904	Unicorn-10818.exe
1344	Unicorn-41280.exe
4328	Unicorn-41545.exe
1028	Unicorn-32614.exe
3528	Unicorn-21679.exe
4628	Unicorn-21679.exe
4080	Unicorn-40153.exe
3720	Unicorn-54241.exe
3924	Unicorn-30291.exe
672	Unicorn-50157.exe
4276	Unicorn-45808.exe
1568	Unicorn-49171.exe
2512	Unicorn-36727.exe
1708	Unicorn-47588.exe
3600	Unicorn-16041.exe
888	Unicorn-7946.exe
1912	Unicorn-65315.exe
5028	Unicorn-45450.exe
1600	Unicorn-20290.exe
4572	Unicorn-55564.exe
3656	Unicorn-55564.exe
1212	Unicorn-55564.exe

Program crash 7 IoCs

pid	pid_target	Process	procid_target
2812	1420	WerFault.exe	89
4416	3948	WerFault.exe	162
9176	5144	WerFault.exe	185
10660	6376	WerFault.exe	250
15876	15504	WerFault.exe	753
15904	15536	WerFault.exe	757
15024	15316	WerFault.exe	730

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2266.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41545.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54703.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6890.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39908.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18895.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39343.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49725.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33876.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22009.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11775.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7946.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2108.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54043.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55082.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58905.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14409.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59289.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21807.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15761.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49031.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57808.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48569.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19161.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9009.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13558.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22441.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28149.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37997.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21035.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10062.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15564.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57168.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31590.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17999.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58905.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38535.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22968.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37515.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22839.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32614.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20125.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39713.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1555.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3815.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58055.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30946.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18195.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36976.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34714.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3194.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31967.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34171.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42403.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8872.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64770.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63042.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65177.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1745.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9731.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7780.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57151.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34861.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60031.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	6320	dwm.exe
Token: SeChangeNotifyPrivilege	6320	dwm.exe
Token: 33	6320	dwm.exe
Token: SeIncBasePriorityPrivilege	6320	dwm.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
5100	58311e94f84d3ae3f1748f8d8989818c88189f5677791786dab41e9665aff475N.exe
2884	Unicorn-34861.exe
3144	Unicorn-3112.exe
1636	Unicorn-44700.exe
1420	Unicorn-28769.exe
768	Unicorn-8903.exe
1016	Unicorn-49281.exe
4788	Unicorn-32853.exe
4684	Unicorn-28913.exe
3868	Unicorn-53055.exe
380	Unicorn-53055.exe
3632	Unicorn-48514.exe
1220	Unicorn-11922.exe
216	Unicorn-14523.exe
3468	Unicorn-3615.exe
3020	Unicorn-34171.exe
3648	Unicorn-19872.exe
1712	Unicorn-21919.exe
2636	Unicorn-26003.exe
4320	Unicorn-32587.exe
4140	Unicorn-20335.exe
1916	Unicorn-34070.exe
1572	Unicorn-52453.exe
676	Unicorn-13558.exe
348	Unicorn-44285.exe
1980	Unicorn-39936.exe
4672	Unicorn-43523.exe
4632	Unicorn-4020.exe
3640	Unicorn-16364.exe
3912	Unicorn-2266.exe
2464	Unicorn-30946.exe
2980	Unicorn-27539.exe
536	Unicorn-34123.exe
1700	Unicorn-1259.exe
3944	Unicorn-33569.exe
2152	Unicorn-8872.exe
3820	Unicorn-43683.exe
828	Unicorn-48943.exe
1420	Unicorn-51943.exe
4904	Unicorn-10818.exe
4352	Unicorn-57808.exe
1892	Unicorn-53797.exe
4100	Unicorn-704.exe
1344	Unicorn-41280.exe
4628	Unicorn-21679.exe
3528	Unicorn-21679.exe
2388	Unicorn-56490.exe
4328	Unicorn-41545.exe
1028	Unicorn-32614.exe
4080	Unicorn-40153.exe
3720	Unicorn-54241.exe
4276	Unicorn-45808.exe
3924	Unicorn-30291.exe
672	Unicorn-50157.exe
1568	Unicorn-49171.exe
2512	Unicorn-36727.exe
1708	Unicorn-47588.exe
3600	Unicorn-16041.exe
1912	Unicorn-65315.exe
5028	Unicorn-45450.exe
888	Unicorn-7946.exe
1600	Unicorn-20290.exe
3656	Unicorn-55564.exe
4572	Unicorn-55564.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5100 wrote to memory of 2884	5100	58311e94f84d3ae3f1748f8d8989818c88189f5677791786dab41e9665aff475N.exe	82
PID 5100 wrote to memory of 2884	5100	58311e94f84d3ae3f1748f8d8989818c88189f5677791786dab41e9665aff475N.exe	82
PID 5100 wrote to memory of 2884	5100	58311e94f84d3ae3f1748f8d8989818c88189f5677791786dab41e9665aff475N.exe	82
PID 2884 wrote to memory of 3144	2884	Unicorn-34861.exe	83
PID 2884 wrote to memory of 3144	2884	Unicorn-34861.exe	83
PID 2884 wrote to memory of 3144	2884	Unicorn-34861.exe	83
PID 5100 wrote to memory of 1636	5100	58311e94f84d3ae3f1748f8d8989818c88189f5677791786dab41e9665aff475N.exe	84
PID 5100 wrote to memory of 1636	5100	58311e94f84d3ae3f1748f8d8989818c88189f5677791786dab41e9665aff475N.exe	84
PID 5100 wrote to memory of 1636	5100	58311e94f84d3ae3f1748f8d8989818c88189f5677791786dab41e9665aff475N.exe	84
PID 3144 wrote to memory of 4788	3144	Unicorn-3112.exe	87
PID 3144 wrote to memory of 4788	3144	Unicorn-3112.exe	87
PID 3144 wrote to memory of 4788	3144	Unicorn-3112.exe	87
PID 2884 wrote to memory of 768	2884	Unicorn-34861.exe	88
PID 2884 wrote to memory of 768	2884	Unicorn-34861.exe	88
PID 2884 wrote to memory of 768	2884	Unicorn-34861.exe	88
PID 1636 wrote to memory of 1420	1636	Unicorn-44700.exe	89
PID 1636 wrote to memory of 1420	1636	Unicorn-44700.exe	89
PID 1636 wrote to memory of 1420	1636	Unicorn-44700.exe	89
PID 5100 wrote to memory of 1016	5100	58311e94f84d3ae3f1748f8d8989818c88189f5677791786dab41e9665aff475N.exe	90
PID 5100 wrote to memory of 1016	5100	58311e94f84d3ae3f1748f8d8989818c88189f5677791786dab41e9665aff475N.exe	90
PID 5100 wrote to memory of 1016	5100	58311e94f84d3ae3f1748f8d8989818c88189f5677791786dab41e9665aff475N.exe	90
PID 768 wrote to memory of 3868	768	Unicorn-8903.exe	96
PID 768 wrote to memory of 3868	768	Unicorn-8903.exe	96
PID 768 wrote to memory of 3868	768	Unicorn-8903.exe	96
PID 1016 wrote to memory of 380	1016	Unicorn-49281.exe	97
PID 1016 wrote to memory of 380	1016	Unicorn-49281.exe	97
PID 1016 wrote to memory of 380	1016	Unicorn-49281.exe	97
PID 3144 wrote to memory of 4684	3144	Unicorn-3112.exe	98
PID 3144 wrote to memory of 4684	3144	Unicorn-3112.exe	98
PID 3144 wrote to memory of 4684	3144	Unicorn-3112.exe	98
PID 5100 wrote to memory of 3632	5100	58311e94f84d3ae3f1748f8d8989818c88189f5677791786dab41e9665aff475N.exe	99
PID 5100 wrote to memory of 3632	5100	58311e94f84d3ae3f1748f8d8989818c88189f5677791786dab41e9665aff475N.exe	99
PID 5100 wrote to memory of 3632	5100	58311e94f84d3ae3f1748f8d8989818c88189f5677791786dab41e9665aff475N.exe	99
PID 2884 wrote to memory of 1220	2884	Unicorn-34861.exe	100
PID 2884 wrote to memory of 1220	2884	Unicorn-34861.exe	100
PID 2884 wrote to memory of 1220	2884	Unicorn-34861.exe	100
PID 1636 wrote to memory of 216	1636	Unicorn-44700.exe	102
PID 1636 wrote to memory of 216	1636	Unicorn-44700.exe	102
PID 1636 wrote to memory of 216	1636	Unicorn-44700.exe	102
PID 4788 wrote to memory of 3468	4788	Unicorn-32853.exe	103
PID 4788 wrote to memory of 3468	4788	Unicorn-32853.exe	103
PID 4788 wrote to memory of 3468	4788	Unicorn-32853.exe	103
PID 4684 wrote to memory of 3020	4684	Unicorn-28913.exe	106
PID 4684 wrote to memory of 3020	4684	Unicorn-28913.exe	106
PID 4684 wrote to memory of 3020	4684	Unicorn-28913.exe	106
PID 3144 wrote to memory of 3648	3144	Unicorn-3112.exe	107
PID 3144 wrote to memory of 3648	3144	Unicorn-3112.exe	107
PID 3144 wrote to memory of 3648	3144	Unicorn-3112.exe	107
PID 3632 wrote to memory of 2636	3632	Unicorn-48514.exe	108
PID 3632 wrote to memory of 2636	3632	Unicorn-48514.exe	108
PID 3632 wrote to memory of 2636	3632	Unicorn-48514.exe	108
PID 3868 wrote to memory of 1712	3868	Unicorn-53055.exe	109
PID 3868 wrote to memory of 1712	3868	Unicorn-53055.exe	109
PID 3868 wrote to memory of 1712	3868	Unicorn-53055.exe	109
PID 1220 wrote to memory of 1572	1220	Unicorn-11922.exe	110
PID 1220 wrote to memory of 1572	1220	Unicorn-11922.exe	110
PID 1220 wrote to memory of 1572	1220	Unicorn-11922.exe	110
PID 5100 wrote to memory of 4672	5100	58311e94f84d3ae3f1748f8d8989818c88189f5677791786dab41e9665aff475N.exe	111
PID 5100 wrote to memory of 4672	5100	58311e94f84d3ae3f1748f8d8989818c88189f5677791786dab41e9665aff475N.exe	111
PID 5100 wrote to memory of 4672	5100	58311e94f84d3ae3f1748f8d8989818c88189f5677791786dab41e9665aff475N.exe	111
PID 768 wrote to memory of 4320	768	Unicorn-8903.exe	112
PID 768 wrote to memory of 4320	768	Unicorn-8903.exe	112
PID 768 wrote to memory of 4320	768	Unicorn-8903.exe	112
PID 380 wrote to memory of 676	380	Unicorn-53055.exe	113

C:\Users\Admin\AppData\Local\Temp\58311e94f84d3ae3f1748f8d8989818c88189f5677791786dab41e9665aff475N.exe
"C:\Users\Admin\AppData\Local\Temp\58311e94f84d3ae3f1748f8d8989818c88189f5677791786dab41e9665aff475N.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5100
- C:\Users\Admin\AppData\Local\Temp\Unicorn-34861.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-34861.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2884
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3112.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3112.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32853.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32853.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3615.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4020.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54241.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41387.exe
        8⤵
        
        PID:4796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60603.exe
        9⤵
        
        PID:6248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24121.exe
        10⤵
        
        PID:7928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22968.exe
        10⤵
        
        PID:11416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22839.exe
        10⤵
        
        PID:15972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30343.exe
        9⤵
        
        PID:9112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8770.exe
        9⤵
        
        PID:11068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41313.exe
        9⤵
        
        PID:15156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9025.exe
        8⤵
        
        PID:6524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36561.exe
        9⤵
        
        PID:9996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56270.exe
        9⤵
        
        PID:13828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54427.exe
        9⤵
        
        PID:9500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18946.exe
        8⤵
        
        PID:9932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64770.exe
        8⤵
        
        PID:13568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35674.exe
        8⤵
        
        PID:5528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42709.exe
        7⤵
        
        PID:5184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58055.exe
        8⤵
        
        PID:4416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28497.exe
        9⤵
        
        PID:12788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37515.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:15564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5211.exe
        8⤵
        
        PID:9812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58905.exe
        8⤵
        
        PID:13108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40640.exe
        8⤵
        
        PID:3120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10062.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21267.exe
        7⤵
        
        PID:10696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61149.exe
        7⤵
        
        PID:14952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31967.exe
        7⤵
        
        PID:17280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30291.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5206.exe
        7⤵
        
        PID:5316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42705.exe
        8⤵
        
        PID:6392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1008.exe
        9⤵
        
        PID:9196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30635.exe
        10⤵
        
        PID:13116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55082.exe
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:5416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9233.exe
        9⤵
        
        PID:11388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-769.exe
        8⤵
        
        PID:8876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56601.exe
        8⤵
        
        PID:12436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30630.exe
        8⤵
        
        PID:15716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9025.exe
        7⤵
        
        PID:6640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7780.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:10096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17375.exe
        8⤵
        
        PID:13864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54427.exe
        8⤵
        
        PID:4296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18946.exe
        7⤵
        
        PID:9940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64770.exe
        7⤵
        
        PID:13160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17550.exe
        6⤵
        
        PID:5252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14884.exe
        7⤵
        
        PID:7148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43914.exe
        7⤵
        
        PID:5384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59289.exe
        7⤵
        
        PID:13448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55903.exe
        7⤵
        
        PID:5368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18528.exe
        6⤵
        
        PID:8120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3633.exe
        6⤵
        
        PID:11452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43765.exe
        6⤵
        
        PID:5392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16364.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50157.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47609.exe
        7⤵
        
        PID:4820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33577.exe
        8⤵
        
        PID:4780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44179.exe
        9⤵
        
        PID:8136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9233.exe
        9⤵
        
        PID:11544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61933.exe
        9⤵
        
        PID:16096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25465.exe
        8⤵
        
        PID:1556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13814.exe
        8⤵
        
        PID:12284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13142.exe
        8⤵
        
        PID:15940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41505.exe
        7⤵
        
        PID:6948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22005.exe
        8⤵
        
        PID:8388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9233.exe
        8⤵
        
        PID:11556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31224.exe
        7⤵
        
        PID:9224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22009.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:12872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59020.exe
        7⤵
        
        PID:1272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3815.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25191.exe
        7⤵
        
        PID:7012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11832.exe
        8⤵
        
        PID:1236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43914.exe
        7⤵
        
        PID:9888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3674.exe
        7⤵
        
        PID:13528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5637.exe
        7⤵
        
        PID:15800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61593.exe
        6⤵
        
        PID:5772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60209.exe
        7⤵
        
        PID:3308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52124.exe
        7⤵
        
        PID:5928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21843.exe
        6⤵
        
        PID:9808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61533.exe
        6⤵
        
        PID:14928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54936.exe
        6⤵
        
        PID:15468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45808.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62336.exe
        6⤵
        
        PID:5720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46535.exe
        7⤵
        
        PID:7200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23877.exe
        7⤵
        
        PID:9708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59289.exe
        7⤵
        
        PID:13728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-716.exe
        6⤵
        
        PID:8376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8029.exe
        6⤵
        
        PID:11904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44175.exe
        6⤵
        
        PID:15588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62463.exe
        6⤵
        
        PID:864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14750.exe
        5⤵
        
        PID:5244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58055.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22441.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:14396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8787.exe
        7⤵
        
        PID:17692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5211.exe
        6⤵
        
        PID:10032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58905.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:13024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5637.exe
        6⤵
        
        PID:15696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21453.exe
        5⤵
        
        PID:7676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17216.exe
        5⤵
        
        PID:10616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40148.exe
        5⤵
        
        PID:14976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32281.exe
        5⤵
        
        PID:5992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28913.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28913.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34171.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27539.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7946.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28149.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14884.exe
        9⤵
        
        PID:6928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39343.exe
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:18240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43914.exe
        9⤵
        
        PID:10008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3674.exe
        9⤵
        
        PID:13572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49420.exe
        8⤵
        
        PID:7952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33876.exe
        8⤵
        
        PID:10860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1.exe
        8⤵
        
        PID:15092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26923.exe
        8⤵
        
        PID:6096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34733.exe
        7⤵
        
        PID:6012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58548.exe
        8⤵
        
        PID:8528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2164.exe
        8⤵
        
        PID:11948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52840.exe
        8⤵
        
        PID:15528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1049.exe
        8⤵
        
        PID:16972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60031.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11775.exe
        7⤵
        
        PID:13904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39713.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45450.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11620.exe
        7⤵
        
        PID:5840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13452.exe
        8⤵
        
        PID:8912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36067.exe
        8⤵
        
        PID:12224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61365.exe
        8⤵
        
        PID:15684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39375.exe
        8⤵
        
        PID:6084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5455.exe
        7⤵
        
        PID:8020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61671.exe
        7⤵
        
        PID:12048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52840.exe
        7⤵
        
        PID:15580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35667.exe
        7⤵
        
        PID:16480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63.exe
        6⤵
        
        PID:6140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56649.exe
        7⤵
        
        PID:7280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12352.exe
        8⤵
        
        PID:12936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59166.exe
        8⤵
        
        PID:6132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10027.exe
        7⤵
        
        PID:10356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57151.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:14536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48871.exe
        6⤵
        
        PID:8648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48365.exe
        6⤵
        
        PID:11880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44705.exe
        6⤵
        
        PID:15636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34227.exe
        6⤵
        
        PID:5576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34123.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65315.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13758.exe
        7⤵
        
        PID:5944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8854.exe
        8⤵
        
        PID:6612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5211.exe
        8⤵
        
        PID:10048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58905.exe
        8⤵
        
        PID:13492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1745.exe
        8⤵
        
        PID:6464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43389.exe
        7⤵
        
        PID:7568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25900.exe
        7⤵
        
        PID:10456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35004.exe
        7⤵
        
        PID:14608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29637.exe
        7⤵
        
        PID:3352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40763.exe
        6⤵
        
        PID:3460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52347.exe
        7⤵
        
        PID:8880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53966.exe
        7⤵
        
        PID:11896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46975.exe
        7⤵
        
        PID:15616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57849.exe
        7⤵
        
        PID:5960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49725.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34719.exe
        7⤵
        
        PID:12816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33430.exe
        7⤵
        
        PID:15024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11775.exe
        6⤵
        
        PID:13884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-818.exe
        6⤵
        
        PID:2076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20290.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47993.exe
        6⤵
        
        PID:5696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14884.exe
        7⤵
        
        PID:6972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49109.exe
        8⤵
        
        PID:13192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13187.exe
        7⤵
        
        PID:9976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3674.exe
        7⤵
        
        PID:13928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49420.exe
        6⤵
        
        PID:7904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33876.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4277.exe
        6⤵
        
        PID:14932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65415.exe
        6⤵
        
        PID:17664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19523.exe
        5⤵
        
        PID:6036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60001.exe
        6⤵
        
        PID:6956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30059.exe
        7⤵
        
        PID:12352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23701.exe
        7⤵
        
        PID:16320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33430.exe
        7⤵
        
        PID:15644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43914.exe
        6⤵
        
        PID:10108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3674.exe
        6⤵
        
        PID:13636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54838.exe
        6⤵
        
        PID:16488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28066.exe
        5⤵
        
        PID:7224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60183.exe
        6⤵
        
        PID:14100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59166.exe
        6⤵
        
        PID:6076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62180.exe
        5⤵
        
        PID:11016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4118.exe
        5⤵
        
        PID:15316
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 15316 -s 464
        6⤵
        Program crash
        
        PID:15024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61545.exe
        5⤵
        
        PID:5160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19872.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19872.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8872.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6529.exe
        6⤵
        
        PID:5324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19653.exe
        7⤵
        
        PID:8544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39908.exe
        7⤵
        
        PID:12636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18179.exe
        7⤵
        
        PID:1840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11817.exe
        6⤵
        
        PID:8336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57921.exe
        7⤵
        
        PID:6960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35134.exe
        6⤵
        
        PID:11640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22458.exe
        6⤵
        
        PID:16316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27743.exe
        5⤵
        
        PID:5292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19161.exe
        6⤵
        
        PID:6872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58543.exe
        7⤵
        
        PID:9880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39933.exe
        7⤵
        
        PID:13596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23316.exe
        7⤵
        
        PID:16376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5211.exe
        6⤵
        
        PID:9756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58905.exe
        6⤵
        
        PID:13504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1894.exe
        5⤵
        
        PID:7768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13099.exe
        5⤵
        
        PID:10724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18895.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:14728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-408.exe
        5⤵
        
        PID:17680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57808.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57808.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:4352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27189.exe
        5⤵
        
        PID:1328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3426.exe
        6⤵
        
        PID:6148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57225.exe
        7⤵
        
        PID:7436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3805.exe
        7⤵
        
        PID:10472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22916.exe
        7⤵
        
        PID:14788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57168.exe
        7⤵
        
        PID:17272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45231.exe
        6⤵
        
        PID:8708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38617.exe
        6⤵
        
        PID:13672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34707.exe
        6⤵
        
        PID:16344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50250.exe
        5⤵
        
        PID:7104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29483.exe
        6⤵
        
        PID:12236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45876.exe
        6⤵
        
        PID:16132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51303.exe
        6⤵
        
        PID:17232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46575.exe
        5⤵
        
        PID:9036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57780.exe
        5⤵
        
        PID:14252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57081.exe
        5⤵
        
        PID:6304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61813.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61813.exe
      4⤵
      PID:4716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62118.exe
        5⤵
        
        PID:6896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41521.exe
        6⤵
        
        PID:11348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1282.exe
        6⤵
        
        PID:15276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17121.exe
        6⤵
        
        PID:3224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52413.exe
        5⤵
        
        PID:9776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63618.exe
        5⤵
        
        PID:13580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59411.exe
        5⤵
        
        PID:15000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50296.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50296.exe
      4⤵
      PID:6788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5834.exe
        5⤵
        
        PID:10020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56270.exe
        5⤵
        
        PID:13840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59881.exe
        5⤵
        
        PID:6316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23500.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23500.exe
      4⤵
      PID:9720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32006.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32006.exe
      4⤵
      PID:13392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60986.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60986.exe
      4⤵
      PID:16388
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8903.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8903.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53055.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53055.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21919.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55564.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1075.exe
        7⤵
        
        PID:5708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38751.exe
        8⤵
        
        PID:8008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53712.exe
        9⤵
        
        PID:16532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5751.exe
        8⤵
        
        PID:10632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44096.exe
        8⤵
        
        PID:14568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58617.exe
        8⤵
        
        PID:6180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3046.exe
        7⤵
        
        PID:7196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53385.exe
        8⤵
        
        PID:12916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58398.exe
        8⤵
        
        PID:5788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4984.exe
        7⤵
        
        PID:13208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23529.exe
        7⤵
        
        PID:15448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61093.exe
        7⤵
        
        PID:16460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54499.exe
        6⤵
        
        PID:5072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19161.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43467.exe
        8⤵
        
        PID:11560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29870.exe
        8⤵
        
        PID:14828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48424.exe
        8⤵
        
        PID:5408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39829.exe
        7⤵
        
        PID:7912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3674.exe
        7⤵
        
        PID:13604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7759.exe
        6⤵
        
        PID:7776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4434.exe
        6⤵
        
        PID:10732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35961.exe
        6⤵
        
        PID:14476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37616.exe
        6⤵
        
        PID:17672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56490.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49747.exe
        6⤵
        
        PID:3864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3810.exe
        7⤵
        
        PID:6424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5092.exe
        8⤵
        
        PID:9212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9233.exe
        8⤵
        
        PID:11520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13308.exe
        8⤵
        
        PID:16436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2907.exe
        7⤵
        
        PID:7808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60301.exe
        7⤵
        
        PID:12120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1885.exe
        7⤵
        
        PID:16240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13142.exe
        7⤵
        
        PID:15924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23607.exe
        6⤵
        
        PID:7056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47277.exe
        7⤵
        
        PID:5744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42865.exe
        7⤵
        
        PID:12452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39296.exe
        7⤵
        
        PID:15060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17410.exe
        6⤵
        
        PID:9372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59342.exe
        6⤵
        
        PID:13268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40065.exe
        6⤵
        
        PID:15568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60529.exe
        5⤵
        
        PID:5152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48351.exe
        6⤵
        
        PID:6264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14054.exe
        7⤵
        
        PID:8076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5751.exe
        7⤵
        
        PID:10640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13369.exe
        7⤵
        
        PID:15288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58617.exe
        7⤵
        
        PID:6512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24505.exe
        6⤵
        
        PID:6752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37625.exe
        7⤵
        
        PID:14148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43597.exe
        7⤵
        
        PID:6024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25682.exe
        6⤵
        
        PID:11844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22839.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1983.exe
        5⤵
        
        PID:6420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54485.exe
        6⤵
        
        PID:8068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24199.exe
        6⤵
        
        PID:11624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60563.exe
        6⤵
        
        PID:6128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57589.exe
        5⤵
        
        PID:9340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34141.exe
        5⤵
        
        PID:13248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40595.exe
        5⤵
        
        PID:15444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8836.exe
        5⤵
        
        PID:16404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32587.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32587.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-704.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64137.exe
        6⤵
        
        PID:1668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2658.exe
        7⤵
        
        PID:5680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57225.exe
        8⤵
        
        PID:7472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57433.exe
        9⤵
        
        PID:3928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28806.exe
        8⤵
        
        PID:12124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52840.exe
        8⤵
        
        PID:15480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21469.exe
        8⤵
        
        PID:16780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54848.exe
        7⤵
        
        PID:8052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57443.exe
        8⤵
        
        PID:6376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20847.exe
        8⤵
        
        PID:15416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22968.exe
        7⤵
        
        PID:11396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15247.exe
        7⤵
        
        PID:920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49482.exe
        6⤵
        
        PID:6432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49031.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11947.exe
        7⤵
        
        PID:11812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31590.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:16984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60389.exe
        6⤵
        
        PID:9348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59342.exe
        6⤵
        
        PID:13260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40065.exe
        6⤵
        
        PID:15676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49865.exe
        6⤵
        
        PID:2908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7323.exe
        5⤵
        
        PID:2928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9840.exe
        6⤵
        
        PID:6472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54677.exe
        7⤵
        
        PID:8832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9233.exe
        7⤵
        
        PID:11472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-480.exe
        7⤵
        
        PID:5332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62606.exe
        6⤵
        
        PID:9240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42787.exe
        6⤵
        
        PID:12920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34714.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:15380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47073.exe
        5⤵
        
        PID:6996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15564.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44018.exe
        6⤵
        
        PID:13560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62211.exe
        6⤵
        
        PID:15268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28128.exe
        5⤵
        
        PID:7788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28694.exe
        5⤵
        
        PID:14164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30431.exe
        5⤵
        
        PID:6292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51943.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51943.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4630.exe
        5⤵
        
        PID:4372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5564.exe
        6⤵
        
        PID:6692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47277.exe
        7⤵
        
        PID:6364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41417.exe
        7⤵
        
        PID:13680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21807.exe
        7⤵
        
        PID:15948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63374.exe
        6⤵
        
        PID:9632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45693.exe
        6⤵
        
        PID:12396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56472.exe
        5⤵
        
        PID:6832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18946.exe
        5⤵
        
        PID:9788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64770.exe
        5⤵
        
        PID:13340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9032.exe
        5⤵
        
        PID:3552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9025.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9025.exe
      4⤵
      PID:4972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14884.exe
        5⤵
        
        PID:7064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27319.exe
        6⤵
        
        PID:14292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18325.exe
        6⤵
        
        PID:5176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43914.exe
        5⤵
        
        PID:10116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3674.exe
        5⤵
        
        PID:13944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60355.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60355.exe
      4⤵
      PID:7888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14541.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14541.exe
      4⤵
      PID:10804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57403.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57403.exe
      4⤵
      PID:15004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6890.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6890.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4088
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11922.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11922.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52453.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52453.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55564.exe
        5⤵
        Executes dropped EXE
        
        PID:1212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36125.exe
        6⤵
        
        PID:5996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19161.exe
        7⤵
        
        PID:7080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43079.exe
        8⤵
        
        PID:13032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9773.exe
        8⤵
        
        PID:15900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55257.exe
        7⤵
        
        PID:11484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33790.exe
        7⤵
        
        PID:15260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12156.exe
        7⤵
        
        PID:3180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53696.exe
        6⤵
        
        PID:7864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3800.exe
        7⤵
        
        PID:13168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40805.exe
        7⤵
        
        PID:15536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33876.exe
        6⤵
        
        PID:10840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1.exe
        6⤵
        
        PID:15240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41313.exe
        6⤵
        
        PID:5860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54499.exe
        5⤵
        
        PID:1504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38367.exe
        6⤵
        
        PID:7188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12544.exe
        7⤵
        
        PID:12404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62979.exe
        7⤵
        
        PID:4520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40753.exe
        6⤵
        
        PID:10332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57151.exe
        6⤵
        
        PID:14544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33344.exe
        6⤵
        
        PID:5132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18833.exe
        5⤵
        
        PID:8252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21035.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14707.exe
        5⤵
        
        PID:12588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13714.exe
        5⤵
        
        PID:15460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21679.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21679.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47609.exe
        5⤵
        
        PID:1356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42705.exe
        6⤵
        
        PID:6408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20277.exe
        7⤵
        
        PID:7648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8657.exe
        7⤵
        
        PID:11548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54567.exe
        7⤵
        
        PID:14640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57168.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:17316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9731.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22968.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5254.exe
        6⤵
        
        PID:15776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37997.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64957.exe
        6⤵
        
        PID:10220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38179.exe
        6⤵
        
        PID:14264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1526.exe
        6⤵
        
        PID:2668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46575.exe
        5⤵
        
        PID:9148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57780.exe
        5⤵
        
        PID:14208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12156.exe
        5⤵
        
        PID:4748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25718.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25718.exe
      4⤵
      PID:5204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45611.exe
        5⤵
        
        PID:3344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30521.exe
        6⤵
        
        PID:16000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43914.exe
        5⤵
        
        PID:7260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30892.exe
        5⤵
        
        PID:13912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40448.exe
        5⤵
        
        PID:4880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34210.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34210.exe
      4⤵
      PID:7840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45467.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45467.exe
      4⤵
      PID:10488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11941.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11941.exe
      4⤵
      PID:14732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25172.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25172.exe
      4⤵
      PID:16688
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39936.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39936.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55564.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55564.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48569.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46535.exe
        6⤵
        
        PID:552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23877.exe
        6⤵
        
        PID:10252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59289.exe
        6⤵
        
        PID:10664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3194.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5455.exe
        5⤵
        
        PID:7532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61671.exe
        5⤵
        
        PID:12068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52840.exe
        5⤵
        
        PID:15504
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 15504 -s 80
        6⤵
        Program crash
        
        PID:15876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10587.exe
        5⤵
        
        PID:5848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58583.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58583.exe
      4⤵
      PID:1920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41527.exe
        5⤵
        
        PID:7164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63634.exe
        6⤵
        
        PID:4312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43914.exe
        5⤵
        
        PID:7744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61427.exe
        5⤵
        
        PID:13996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30126.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30126.exe
      4⤵
      PID:7936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49109.exe
        5⤵
        
        PID:13164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36799.exe
        5⤵
        
        PID:6116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31076.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31076.exe
      4⤵
      PID:10848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40337.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40337.exe
      4⤵
      PID:15120
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32614.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32614.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27189.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27189.exe
      4⤵
      PID:3320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49887.exe
        5⤵
        
        PID:6112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-935.exe
        5⤵
        
        PID:10180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54210.exe
        5⤵
        
        PID:15100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16747.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16747.exe
      4⤵
      PID:7544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34672.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34672.exe
      4⤵
      PID:12112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44175.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44175.exe
      4⤵
      PID:15472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3724.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3724.exe
      4⤵
      PID:16412
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41193.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41193.exe
    3⤵
    PID:5144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7894.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7894.exe
      4⤵
      PID:6376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45694.exe
        5⤵
        
        PID:9076
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6376 -s 628
        5⤵
        Program crash
        
        PID:10660
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5144 -s 636
      4⤵
      Program crash
      PID:9176
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61715.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61715.exe
    3⤵
    PID:7088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10520.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10520.exe
      4⤵
      PID:8196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-79.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-79.exe
      4⤵
      PID:3744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21807.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21807.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4832
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28612.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28612.exe
    3⤵
    PID:9796
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28617.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28617.exe
    3⤵
    PID:13532
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4411.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4411.exe
    3⤵
    PID:15136
- C:\Users\Admin\AppData\Local\Temp\Unicorn-44700.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-44700.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1636
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28769.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28769.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1420
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1420 -s 488
      4⤵
      Program crash
      PID:2812
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14523.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14523.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44285.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44285.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41545.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6529.exe
        6⤵
        
        PID:5356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42451.exe
        7⤵
        
        PID:7172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40753.exe
        7⤵
        
        PID:10340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57151.exe
        7⤵
        
        PID:14552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48730.exe
        7⤵
        
        PID:15396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48119.exe
        7⤵
        
        PID:15804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8884.exe
        6⤵
        
        PID:8280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4926.exe
        7⤵
        
        PID:14664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37567.exe
        7⤵
        
        PID:17248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8029.exe
        6⤵
        
        PID:11912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44175.exe
        6⤵
        
        PID:15572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38535.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27743.exe
        5⤵
        
        PID:1792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12964.exe
        6⤵
        
        PID:5876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62461.exe
        7⤵
        
        PID:9152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9233.exe
        7⤵
        
        PID:11528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57849.exe
        7⤵
        
        PID:15028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7488.exe
        6⤵
        
        PID:9700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39306.exe
        6⤵
        
        PID:13344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59325.exe
        5⤵
        
        PID:6932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15783.exe
        6⤵
        
        PID:8756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9233.exe
        6⤵
        
        PID:11460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-480.exe
        6⤵
        
        PID:5532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51480.exe
        5⤵
        
        PID:9256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1092.exe
        5⤵
        
        PID:12940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10548.exe
        5⤵
        
        PID:516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40153.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40153.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27189.exe
        5⤵
        
        PID:2212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15294.exe
        6⤵
        
        PID:5828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14246.exe
        7⤵
        
        PID:7488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28806.exe
        7⤵
        
        PID:12140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52840.exe
        7⤵
        
        PID:15544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40065.exe
        7⤵
        
        PID:15656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5133.exe
        7⤵
        
        PID:5548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6336.exe
        6⤵
        
        PID:8944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38617.exe
        6⤵
        
        PID:13732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35091.exe
        6⤵
        
        PID:2000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21085.exe
        5⤵
        
        PID:6760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50863.exe
        6⤵
        
        PID:13068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37515.exe
        6⤵
        
        PID:4824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5350.exe
        5⤵
        
        PID:9860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63618.exe
        5⤵
        
        PID:13540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28684.exe
        5⤵
        
        PID:16348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64613.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64613.exe
      4⤵
      PID:312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14884.exe
        5⤵
        
        PID:7044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43914.exe
        5⤵
        
        PID:9912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3674.exe
        5⤵
        
        PID:13936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17697.exe
        5⤵
        
        PID:15904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3483.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3483.exe
      4⤵
      PID:7920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5938.exe
        5⤵
        
        PID:12968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37515.exe
        5⤵
        
        PID:15368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31076.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31076.exe
      4⤵
      PID:10816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44613.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44613.exe
      4⤵
      PID:15044
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34070.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34070.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53797.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53797.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6529.exe
        5⤵
        
        PID:5240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52347.exe
        6⤵
        
        PID:9008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19731.exe
        6⤵
        
        PID:10364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30630.exe
        6⤵
        
        PID:3028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56331.exe
        5⤵
        
        PID:9056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8808.exe
        6⤵
        
        PID:17544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14635.exe
        5⤵
        
        PID:10856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46703.exe
        5⤵
        
        PID:2432
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13353.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13353.exe
      4⤵
      PID:1284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19379.exe
        5⤵
        
        PID:5832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57225.exe
        6⤵
        
        PID:7460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12165.exe
        6⤵
        
        PID:10440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22916.exe
        6⤵
        
        PID:14780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30343.exe
        5⤵
        
        PID:9128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22968.exe
        5⤵
        
        PID:11384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5254.exe
        5⤵
        
        PID:4908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26652.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26652.exe
      4⤵
      PID:6852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55808.exe
        5⤵
        
        PID:7580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62439.exe
        5⤵
        
        PID:11620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30666.exe
        5⤵
        
        PID:16116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48503.exe
        5⤵
        
        PID:17220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12995.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12995.exe
      4⤵
      PID:8004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13914.exe
        5⤵
        
        PID:12324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40805.exe
        5⤵
        
        PID:14740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53986.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53986.exe
      4⤵
      PID:13200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26734.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26734.exe
      4⤵
      PID:5668
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41280.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41280.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21159.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21159.exe
      4⤵
      PID:2892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26203.exe
        5⤵
        
        PID:6028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21621.exe
        6⤵
        
        PID:9020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60572.exe
        6⤵
        
        PID:9824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60371.exe
        6⤵
        
        PID:16556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16337.exe
        5⤵
        
        PID:8668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33274.exe
        5⤵
        
        PID:11876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59446.exe
        5⤵
        
        PID:15964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44027.exe
        5⤵
        
        PID:16060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5351.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5351.exe
      4⤵
      PID:5364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62871.exe
        5⤵
        
        PID:7212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23877.exe
        5⤵
        
        PID:9668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59289.exe
        5⤵
        
        PID:13916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16711.exe
        5⤵
        
        PID:17928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57893.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57893.exe
      4⤵
      PID:8440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11775.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11775.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:13896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57611.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57611.exe
      4⤵
      PID:6328
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18258.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18258.exe
    3⤵
    PID:4488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54957.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54957.exe
      4⤵
      PID:6488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49031.exe
        5⤵
        
        PID:8400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11947.exe
        5⤵
        
        PID:11828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60563.exe
        5⤵
        
        PID:5880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3675.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3675.exe
      4⤵
      PID:9380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41225.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41225.exe
      4⤵
      PID:13292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48730.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48730.exe
      4⤵
      PID:15416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60563.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60563.exe
      4⤵
      PID:1528
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35905.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35905.exe
    3⤵
    PID:6964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47277.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47277.exe
      4⤵
      PID:6708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41417.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41417.exe
      4⤵
      PID:13688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-401.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-401.exe
      4⤵
      PID:15700
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6780.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6780.exe
    3⤵
    PID:9444
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9064.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9064.exe
    3⤵
    PID:12956
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14409.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14409.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:15788
- C:\Users\Admin\AppData\Local\Temp\Unicorn-49281.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-49281.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1016
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53055.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53055.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13558.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13558.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10818.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64137.exe
        6⤵
        
        PID:4664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8304.exe
        7⤵
        
        PID:5792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18331.exe
        8⤵
        
        PID:7500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43941.exe
        9⤵
        
        PID:17212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28806.exe
        8⤵
        
        PID:12132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52840.exe
        8⤵
        
        PID:15496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6503.exe
        8⤵
        
        PID:1896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15761.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22968.exe
        7⤵
        
        PID:11424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59446.exe
        7⤵
        
        PID:15988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58226.exe
        7⤵
        
        PID:16508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34323.exe
        6⤵
        
        PID:5716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21621.exe
        7⤵
        
        PID:8932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31983.exe
        7⤵
        
        PID:12248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34722.exe
        7⤵
        
        PID:15668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14504.exe
        6⤵
        
        PID:8396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62466.exe
        6⤵
        
        PID:12428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14095.exe
        6⤵
        
        PID:15308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27743.exe
        5⤵
        
        PID:644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54189.exe
        6⤵
        
        PID:5568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58787.exe
        7⤵
        
        PID:7288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10214.exe
        8⤵
        
        PID:13144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32523.exe
        8⤵
        
        PID:5888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61671.exe
        7⤵
        
        PID:12032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52840.exe
        7⤵
        
        PID:15512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52518.exe
        6⤵
        
        PID:8368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39908.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:12612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43189.exe
        6⤵
        
        PID:15300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14095.exe
        6⤵
        
        PID:15708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4094.exe
        5⤵
        
        PID:6800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15564.exe
        6⤵
        
        PID:9840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44018.exe
        6⤵
        
        PID:13608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54043.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:15908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58278.exe
        5⤵
        
        PID:9768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54953.exe
        5⤵
        
        PID:13552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10011.exe
        5⤵
        
        PID:1168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21679.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21679.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29327.exe
        5⤵
        
        PID:3948
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3948 -s 720
        6⤵
        Program crash
        
        PID:4416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5351.exe
        5⤵
        
        PID:5060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61117.exe
        6⤵
        
        PID:7996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18195.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13369.exe
        6⤵
        
        PID:15256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56139.exe
        5⤵
        
        PID:8424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12159.exe
        5⤵
        
        PID:14136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8410.exe
        5⤵
        
        PID:624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-446.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-446.exe
      4⤵
      PID:4696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19571.exe
        5⤵
        
        PID:6344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8024.exe
        6⤵
        
        PID:7824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59036.exe
        6⤵
        
        PID:10824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59673.exe
        6⤵
        
        PID:15128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1745.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34427.exe
        5⤵
        
        PID:9096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8770.exe
        5⤵
        
        PID:10812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45397.exe
        5⤵
        
        PID:5868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28626.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28626.exe
      4⤵
      PID:6648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57303.exe
        5⤵
        
        PID:11496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40831.exe
        5⤵
        
        PID:14616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51303.exe
        5⤵
        
        PID:17296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16146.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16146.exe
      4⤵
      PID:10056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39569.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39569.exe
      4⤵
      PID:13516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9562.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9562.exe
      4⤵
      PID:16068
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20335.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20335.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2266.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2266.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:3912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49171.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39825.exe
        6⤵
        
        PID:5500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54703.exe
        7⤵
        
        PID:6924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23877.exe
        7⤵
        
        PID:10244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59289.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:14232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48434.exe
        6⤵
        
        PID:7736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26359.exe
        7⤵
        
        PID:12884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13010.exe
        7⤵
        
        PID:16328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26860.exe
        6⤵
        
        PID:12060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52840.exe
        6⤵
        
        PID:15520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41313.exe
        6⤵
        
        PID:16372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56716.exe
        5⤵
        
        PID:5636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45611.exe
        6⤵
        
        PID:5236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-935.exe
        6⤵
        
        PID:10192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65127.exe
        6⤵
        
        PID:13856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44340.exe
        6⤵
        
        PID:16748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28344.exe
        5⤵
        
        PID:7880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39742.exe
        5⤵
        
        PID:10784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56873.exe
        5⤵
        
        PID:15112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31967.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:17264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47588.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47588.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11044.exe
        5⤵
        
        PID:5656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45611.exe
        6⤵
        
        PID:7116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23609.exe
        7⤵
        
        PID:2556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55257.exe
        6⤵
        
        PID:11364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7147.exe
        6⤵
        
        PID:13216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8046.exe
        6⤵
        
        PID:17868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14609.exe
        5⤵
        
        PID:7872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33876.exe
        5⤵
        
        PID:10868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35430.exe
        5⤵
        
        PID:15040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42081.exe
        5⤵
        
        PID:15808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42439.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42439.exe
      4⤵
      PID:5968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27329.exe
        5⤵
        
        PID:5124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33053.exe
        6⤵
        
        PID:8200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55476.exe
        6⤵
        
        PID:13824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48973.exe
        6⤵
        
        PID:5644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5211.exe
        5⤵
        
        PID:9764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58905.exe
        5⤵
        
        PID:13356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1745.exe
        5⤵
        
        PID:6564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15927.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15927.exe
      4⤵
      PID:7708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12602.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12602.exe
      4⤵
      PID:10684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31513.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31513.exe
      4⤵
      PID:6052
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30946.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30946.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36727.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36727.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11044.exe
        5⤵
        
        PID:5648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19161.exe
        6⤵
        
        PID:6848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52809.exe
        7⤵
        
        PID:12336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59279.exe
        7⤵
        
        PID:5912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2881.exe
        6⤵
        
        PID:7916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28754.exe
        6⤵
        
        PID:14236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26058.exe
        6⤵
        
        PID:16520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53696.exe
        5⤵
        
        PID:7796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33876.exe
        5⤵
        
        PID:10832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35430.exe
        5⤵
        
        PID:15384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42081.exe
        5⤵
        
        PID:17492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12367.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12367.exe
      4⤵
      PID:5776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36229.exe
        5⤵
        
        PID:2216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23877.exe
        5⤵
        
        PID:9672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59289.exe
        5⤵
        
        PID:13872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37620.exe
        5⤵
        
        PID:4840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19190.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19190.exe
      4⤵
      PID:7848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26577.exe
        5⤵
        
        PID:11400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14189.exe
        5⤵
        
        PID:15292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2678.exe
        5⤵
        
        PID:17608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1999.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1999.exe
      4⤵
      PID:12084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44175.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44175.exe
      4⤵
      PID:15488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23529.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23529.exe
      4⤵
      PID:15696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65177.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65177.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6192
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16041.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16041.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41771.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41771.exe
      4⤵
      PID:5616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8854.exe
        5⤵
        
        PID:6756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56597.exe
        6⤵
        
        PID:9612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31957.exe
        6⤵
        
        PID:12688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21973.exe
        6⤵
        
        PID:16428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5211.exe
        5⤵
        
        PID:9868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58905.exe
        5⤵
        
        PID:12332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43389.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43389.exe
      4⤵
      PID:7560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25900.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25900.exe
      4⤵
      PID:10432
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61646.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61646.exe
      4⤵
      PID:14632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27890.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27890.exe
      4⤵
      PID:6124
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19218.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19218.exe
    3⤵
    PID:5796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45611.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45611.exe
      4⤵
      PID:6840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10214.exe
        5⤵
        
        PID:12580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22409.exe
        5⤵
        
        PID:1048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5211.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5211.exe
      4⤵
      PID:10040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58905.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58905.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:788
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9009.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9009.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:7832
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31607.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31607.exe
    3⤵
    PID:10772
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35872.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35872.exe
    3⤵
    PID:15016
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1555.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1555.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5212
- C:\Users\Admin\AppData\Local\Temp\Unicorn-48514.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-48514.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3632
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26003.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26003.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33569.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33569.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61807.exe
        5⤵
        
        PID:2800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19789.exe
        6⤵
        
        PID:6044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22969.exe
        7⤵
        
        PID:7728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57433.exe
        8⤵
        
        PID:16540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15402.exe
        7⤵
        
        PID:10668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4277.exe
        7⤵
        
        PID:15352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27053.exe
        6⤵
        
        PID:7668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17999.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:10520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29922.exe
        7⤵
        
        PID:16292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19486.exe
        6⤵
        
        PID:10604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4277.exe
        6⤵
        
        PID:15084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53566.exe
        6⤵
        
        PID:6088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44848.exe
        5⤵
        
        PID:3332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19653.exe
        6⤵
        
        PID:8560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39908.exe
        6⤵
        
        PID:12560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18179.exe
        6⤵
        
        PID:2012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55947.exe
        5⤵
        
        PID:8204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8029.exe
        5⤵
        
        PID:11940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44175.exe
        5⤵
        
        PID:15536
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 15536 -s 80
        6⤵
        Program crash
        
        PID:15904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30431.exe
        5⤵
        
        PID:15856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11023.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11023.exe
      4⤵
      PID:3952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26395.exe
        5⤵
        
        PID:5396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54703.exe
        6⤵
        
        PID:2796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62772.exe
        6⤵
        
        PID:9628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59289.exe
        6⤵
        
        PID:14520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15446.exe
        6⤵
        
        PID:16548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64770.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39908.exe
        5⤵
        
        PID:12628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20125.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:15784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61105.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61105.exe
      4⤵
      PID:5836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19893.exe
        5⤵
        
        PID:6276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61045.exe
        6⤵
        
        PID:17392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23877.exe
        5⤵
        
        PID:9676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28562.exe
        5⤵
        
        PID:13616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14749.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14749.exe
      4⤵
      PID:8288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64901.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64901.exe
      4⤵
      PID:11888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27639.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27639.exe
      4⤵
      PID:15624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39562.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39562.exe
      4⤵
      PID:16452
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1259.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1259.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26805.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26805.exe
      4⤵
      PID:2660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61205.exe
        5⤵
        
        PID:5432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14054.exe
        6⤵
        
        PID:8088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1667.exe
        6⤵
        
        PID:10652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63949.exe
        6⤵
        
        PID:15052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61933.exe
        6⤵
        
        PID:6060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42595.exe
        5⤵
        
        PID:9064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8770.exe
        5⤵
        
        PID:11060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53566.exe
        5⤵
        
        PID:5052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6529.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6529.exe
      4⤵
      PID:5276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54703.exe
        5⤵
        
        PID:6940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23877.exe
        5⤵
        
        PID:10268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59289.exe
        5⤵
        
        PID:6380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8543.exe
        5⤵
        
        PID:18076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12968.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12968.exe
      4⤵
      PID:8244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31242.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31242.exe
      4⤵
      PID:12568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27077.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27077.exe
      4⤵
      PID:4364
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8422.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8422.exe
    3⤵
    PID:744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61205.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61205.exe
      4⤵
      PID:5428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19653.exe
        5⤵
        
        PID:8552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3800.exe
        6⤵
        
        PID:13124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38091.exe
        6⤵
        
        PID:1140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39908.exe
        5⤵
        
        PID:12604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43189.exe
        5⤵
        
        PID:15272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10011.exe
        5⤵
        
        PID:3548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54656.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54656.exe
      4⤵
      PID:8128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2164.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2164.exe
      4⤵
      PID:11956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52840.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52840.exe
      4⤵
      PID:15552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1049.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1049.exe
      4⤵
      PID:5180
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36244.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36244.exe
    3⤵
    PID:1632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61117.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61117.exe
      4⤵
      PID:7984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50790.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50790.exe
      4⤵
      PID:12828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14095.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14095.exe
      4⤵
      PID:15752
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53531.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53531.exe
    3⤵
    PID:9044
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54972.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54972.exe
    3⤵
    PID:10764
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47849.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47849.exe
    3⤵
    PID:5540
- C:\Users\Admin\AppData\Local\Temp\Unicorn-43523.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-43523.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4672
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43683.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43683.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2108.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2108.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1698.exe
        5⤵
        
        PID:5560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54703.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62772.exe
        6⤵
        
        PID:9640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57151.exe
        6⤵
        
        PID:14560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33344.exe
        6⤵
        
        PID:1440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64770.exe
        5⤵
        
        PID:8228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39908.exe
        5⤵
        
        PID:12620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20125.exe
        5⤵
        
        PID:4340
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47946.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47946.exe
      4⤵
      PID:5864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5886.exe
        5⤵
        
        PID:8108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59036.exe
        5⤵
        
        PID:10748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59673.exe
        5⤵
        
        PID:15064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3194.exe
        5⤵
        
        PID:556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11214.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11214.exe
      4⤵
      PID:7944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28834.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28834.exe
      4⤵
      PID:11600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24144.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24144.exe
      4⤵
      PID:16040
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9461.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9461.exe
    3⤵
    PID:4648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18995.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18995.exe
      4⤵
      PID:5484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26307.exe
        5⤵
        
        PID:7976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63042.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51627.exe
        5⤵
        
        PID:2468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42403.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42403.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22968.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22968.exe
      4⤵
      PID:11432
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44027.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44027.exe
      4⤵
      PID:15464
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15962.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15962.exe
    3⤵
    PID:6628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39711.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39711.exe
      4⤵
      PID:7592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36976.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36976.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:13876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26354.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26354.exe
      4⤵
      PID:8584
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35362.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35362.exe
    3⤵
    PID:8116
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20168.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20168.exe
    3⤵
    PID:11592
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49100.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49100.exe
    3⤵
    PID:5288
- C:\Users\Admin\AppData\Local\Temp\Unicorn-48943.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-48943.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:828
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64137.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64137.exe
    3⤵
    PID:3096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29877.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29877.exe
      4⤵
      PID:6356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46125.exe
        5⤵
        
        PID:7760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9233.exe
        5⤵
        
        PID:11480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39375.exe
        5⤵
        
        PID:3156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31495.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31495.exe
      4⤵
      PID:9144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56601.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56601.exe
      4⤵
      PID:12412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34714.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34714.exe
      4⤵
      PID:3492
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9025.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9025.exe
    3⤵
    PID:6540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45331.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45331.exe
      4⤵
      PID:8320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-79.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-79.exe
      4⤵
      PID:12020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17531.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17531.exe
      4⤵
      PID:15980
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31800.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31800.exe
    3⤵
    PID:9892
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59534.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59534.exe
    3⤵
    PID:13588
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32768.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32768.exe
    3⤵
    PID:15952
- C:\Users\Admin\AppData\Local\Temp\Unicorn-37263.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-37263.exe
  2⤵
  PID:2112
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42705.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42705.exe
    3⤵
    PID:6400
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48.exe
      4⤵
      PID:6440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10598.exe
        5⤵
        
        PID:13916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45554.exe
        5⤵
        
        PID:11356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51303.exe
        5⤵
        
        PID:17304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34042.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34042.exe
      4⤵
      PID:12644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30630.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30630.exe
      4⤵
      PID:4848
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24505.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24505.exe
    3⤵
    PID:7968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61911.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61911.exe
      4⤵
      PID:14668
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25682.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25682.exe
    3⤵
    PID:11836
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45397.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45397.exe
    3⤵
    PID:5768
- C:\Users\Admin\AppData\Local\Temp\Unicorn-40184.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-40184.exe
  2⤵
  PID:7096
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15564.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15564.exe
    3⤵
    PID:9848
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44018.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44018.exe
    3⤵
    PID:13624
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54043.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54043.exe
    3⤵
    PID:15168
- C:\Users\Admin\AppData\Local\Temp\Unicorn-17439.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-17439.exe
  2⤵
  PID:7804
- C:\Users\Admin\AppData\Local\Temp\Unicorn-26979.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-26979.exe
  2⤵
  PID:14196
- C:\Users\Admin\AppData\Local\Temp\Unicorn-30344.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-30344.exe
  2⤵
  PID:220

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 1420 -ip 1420
1⤵
PID:4516

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 3948 -ip 3948
1⤵
PID:5200

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 5144 -ip 5144
1⤵
PID:8740

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 6376 -ip 6376
1⤵
PID:10480

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:6320

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-11922.exe

Filesize
468KB

MD5
d72bb37ba59f7a60c5e53c144db84134

SHA1
8f474f60d7110235c51fb08e7bafaf50ed8f78a7

SHA256
4f8cbeb59a6cd03338f16466636e0b6d8334d75d204ee73e19322fe433255f2c

SHA512
e9c1806bfea276fa1a8fdaa3dc58cfea797a3719479491f6d8f95807c84519cf328f5c99c8544e166a362b5365ea94d1dbf80a4d644a3fc4a04c7becd7b37992

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-13558.exe

Filesize
468KB

MD5
394353e6ca90ca0a0a44339cc1c195de

SHA1
26cd7ba3a5213d5d016a24c5fa1db31884dbc133

SHA256
50b36f7acefe608d71da1167ed61e5e504bb918f95ed0107ad0f31e869943834

SHA512
a4cc9a9e873e7880bbc9b7d98ffb71b0244511db5b4411eb50a0a4c583489be0ed50cfefcad091f2624bba0d30c59b860738dc59cc7e1f2b692f21d631d16c0b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-14523.exe

Filesize
468KB

MD5
70b34c5d3a24fb148491d1a1a052078f

SHA1
a77fa314da308769d1848fd486fd00525c90223e

SHA256
b8c50b8b8ede29a61f711c33f35f39cf24a69b5137f1c8a7f8db4e374ed566a3

SHA512
5bb04a28543907bea9c5a71d9c4348ac097679d7d6cff3141c0ecaf409fc2e3da68b558444ffcab2a04c8353ccf10c65cc4f0c4ad499311436ffbb78f3092824

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-15294.exe

Filesize
468KB

MD5
6dd068de170af5cccf6cdd73e5422978

SHA1
43d578c3a2329d56921174ef5fb295f8724d8e60

SHA256
5e9d6defb4cf524e594e7805cc74081fda368b85c793d71de1b4ad0d95166ef3

SHA512
d519f2df71f2661ded9a7d1b10a32e4ce5005292452ccc76d73fbfebce50cfd8b7ff7dd05b986894c8531f088d26d88666b809f6ad8e435995effab4ec1a2837

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-16364.exe

Filesize
468KB

MD5
b3f53db61b391f531c29a6b33629f15f

SHA1
849f84cc9bda2e3618f0e2bce94d1c4686f6f8a3

SHA256
9f29f3537dc77caa23f523dbba51174fac7f9815be997e87bda5b75baf59c66f

SHA512
7c9efbb70483a5f907044019c8b3565db7991c65a9a2a43c7a5ee59904665e5dc30b2baa3ef1e606b99ee64688f14576806fb78146ccb3dd2294c63b50267068

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-19064.exe

Filesize
468KB

MD5
d991eb81124408701b65ea8c6b08aa5d

SHA1
a692a8901a6dde5c7a71e79e73b29dd1fd889e31

SHA256
83d779ff1ca9c262d7236b6876ea014d6e88ab0eeb07a00f5c3ac30aab14632c

SHA512
c9fae1ae8ef65acc504c922fb3b3dc24fbd66d5d753b509095de039f9b7e6bc68ff1eb5ba93368e9355c0f81fd36104716a088aa3c0fb9db9bdb8c07d761c56e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-19872.exe

Filesize
468KB

MD5
81f4aeed66c0c108825d5e3df2c389da

SHA1
9c1f19b0b16a7b4142fdf420c34904a0366bb590

SHA256
e8b831af853a5dbb3ac8eea72c961edc0320207948163980ee110b58f051ff37

SHA512
35fb1e235c4a924c5090467356291bf74b7a29e551095eae773328ee27d47039b7c66742f727fc1127ced45ecb294ebb15cd4f6ca23ea3dd500e52b726f9ee94

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-20335.exe

Filesize
468KB

MD5
8b7d731a7f2987f9a4ceebfde28dc5e4

SHA1
b231da3c18978f53d9ce40afef6dce81a1c2aa76

SHA256
12a6c3066e237e1abf06772ba2c3ed0e08abc4410a048b5403035d0c4b6731f4

SHA512
ce63d47f5fbc66c3643d987c85b04f5fe6dde3a7d68df65163a4a5c480e47ca0dd38856c088951ba206af09fca56e1de137daf7217d69d81b227ad0919addb55

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-21919.exe

Filesize
468KB

MD5
0d1bf20de00e4e4ed54825ffa07e89d8

SHA1
e624117580ca5aaebdea58ffc2fcda4066dbcbaa

SHA256
2d107e1772180557f4b773d18d6442f87bf60b79510cabe5c3b12d0e60af1055

SHA512
700c13063d89bf3e926ab927ded5ad97f15c55a470f154185e23f7dab5a86735577bf752fc30efe6f199c553b530ea3db7205b96d727401bfc3385c35a4cfb75

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-2266.exe

Filesize
468KB

MD5
c7bcb18eae6fd48d09e17377d66153c8

SHA1
5c8ff5fa4d4b36f7fef72eaedfa48f8305cc207a

SHA256
d0f17bf763bcdd820d2dc70a45f1f131eb3fd693e2dd48d0aa3b7761d54a1d00

SHA512
7e25a4584f58cc3f92bdc0c4da0c67aeb377d2987320728d23b305ecb6742aa27fcf58cb96ab4f36600f5a49460ff66ed8dbe29ff4f95cf6937bb9a73763be44

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-25718.exe

Filesize
468KB

MD5
0fb36f4340a47c796b099beceefe0448

SHA1
ec8e7e34770a9edd264ae4932e60d8f851475368

SHA256
f35779683b9dae5dc4ff1c89a132a4199a7423d83037774114fa35b5ec0a5448

SHA512
9f2671164904394383829bd11e5ca747514f365cb997519727efeac25be82831530f297ad47919a7a98edd7f5558b65e293f8872e3c69fe0411775c887879d21

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-26003.exe

Filesize
468KB

MD5
507c464467cf0a9d2b1449528666228f

SHA1
6524acb98d47416e5acf5d2214c72a565fc7008f

SHA256
ca03cd0fe82900d87e9d6b6e6b66f31ba48acd1d58acf4e5bd2dee166cd4b41a

SHA512
1a211813a235a282325a9dcf204d7cbb623f4a812fcbb0286e39e96ac060f4cf4d7942c9d04d86714ee185c21b2f366dc59bd07151e709c647899f0328aa8c0d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-27539.exe

Filesize
468KB

MD5
432230d0ed4dc970a4856df83c3835ff

SHA1
2550891abff5873f0ae2d1a7ad4a203d4deed953

SHA256
f881261bb898771cfc3ec8710bbcf050dc61e12413908be892d91493179715e8

SHA512
ebc61de8a0606e4046a22d73b03628b2b8a3c3f8cccd8b931a4e854db605224523b6b503545016eda40ceb70514711efde4c748ced0d2af4c873cb16e24ca34e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-28769.exe

Filesize
468KB

MD5
465198d8839f635ce9e78e8567c9bf06

SHA1
ccf085fc9b1f370213d592e3e84ae73ea73dd570

SHA256
5db29ee394489af0aef4596e817e073fc20de40e570d1ba9c913c16e41869edd

SHA512
2c80aade38de465607910ad7eae8b277edd3a39ae626dccc987f7fe475f4dad317825262999cf726946b4d55a79305427a5ab26866df1c1737a95e07e9817e29

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-28913.exe

Filesize
468KB

MD5
4e5ef186ded61de84157fc156c4060b1

SHA1
49db23cdcd3fc8d2c99c2fcc592d22c9b0fcba5a

SHA256
949ad026862007a110e35a39a54b6af7c85a30f73208861010141638dae1aadb

SHA512
6af6d4b692fdab422c833ad11348e5fdd7f2f8e547bc60ea20f53bd08ec49aae08f2d443b67840131bcd7b7901ac4330f95c82ede6d01a9a8fac4795742e9e79

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-30946.exe

Filesize
468KB

MD5
31405dac0495f7df1ce189f5e9a89f3f

SHA1
080d8221918efd1e46b16b9a7ba2485b6dd42476

SHA256
1e996a598a86843b03d835b340ffc0428a74a25415618c700d27e228686424bc

SHA512
6ebeab6353ccd896b344fc3c25219ad9c912eff1420ae2e533d99e3008d05e6aae0339ca04c0414cb84dfe42753ff3a50ff06552d464253d0f68b6a0715796ef

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-3112.exe

Filesize
468KB

MD5
89c9c05223e817d41e3bbfbb16370ce5

SHA1
2952b738582e82a70f3acbf9bce70620edb15981

SHA256
167e1fcb8a3f4d22c62e04ffe5552630a9babc81f3a83194104bd70574f73bae

SHA512
c22dc88e9f27ca58a00fb481ac280aec5f0c46c17ea4c322a17fa199bb44a67c394d9843cb14cd7da261b05eac93b42b87b55a0c65948390b07c705e3e603f59

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-32587.exe

Filesize
468KB

MD5
a22d9c2b79071b93b694b8bdb46951f5

SHA1
f42e841c1601c14ffe6e2b4c04658f4626d4129c

SHA256
c2589b0e6a172776c28041481b4209c821d992a3e2fbb22e9355a1e7c5bc42fc

SHA512
c9449b2d27a8ad99f130bf1e5966747b3ece5cc2f58b476a1e0248f79627b9c8008bb5bfe12f405bd618e9ef3f87b87abea05ca5630977b6d466e0fac8a3cdfa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-32853.exe

Filesize
468KB

MD5
76bad59e33ecb1b7a9383eab6409b5bb

SHA1
ab2fa97b6cac01e12ff9b8a64cbea264e36921c7

SHA256
9922682d7330b43be71bbaf005fd4d0879e524d89e0cf46da269afda2590e7b9

SHA512
6a64439e7a4ed63ae4f17c65f21a5d887b12d35165a2eb42b57dffa8129bc2969443a1a1fa40879ea1ddb90e17aadc895a743d56e2cdc2a1d4510de9654c7fa9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-34070.exe

Filesize
468KB

MD5
b29481921c58ac7aa18207ad58dd0fbe

SHA1
3704d47852d93fa28a00b87480b8e381c3ef1af8

SHA256
d2c3fe1426e3de42d5ccf94eb184433f7da83fb7d2ea9af3730b0431c2365169

SHA512
b6489791a76faf4a7e0242a2c38eaca4ba6332e0a3498251ce46f4484f3133c635367f95114cd075e9c057363237bbe20ee9ddce1d2d37d65e0d549e0d78049d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-34123.exe

Filesize
468KB

MD5
fbb4d1d0799f7cfa161cc7418adfe3a8

SHA1
b59820735f4334d9bcd669f3f002f7c745706abc

SHA256
985af162acd81c89c8433310eabce24e6ba3b326780353cd1670f5171fa0031e

SHA512
30ce1e98c441054997fab6510432b36e0043517fa4897ca103b6c32140bfc124f1c7a0985de448796f13c78677d94043457cbc6524cd7f8e5f6e4406e165884e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-34171.exe

Filesize
468KB

MD5
4074cb04cf758c1c7f5d9475426abfaf

SHA1
314d6e8af45d6fc6e7cd5fb934896e3a3f26438d

SHA256
2167629d75fc8ae1bf3605f7a53c7dae23db96058760feb234845293456a8ec8

SHA512
7cfd4379fd4b3e728bded2424d1ee9abae028d2db72c328c26bd4f761356e17be7cc65250f951238a24c459325062aa7e2f936e053d9fa6c13f0feb4314259f4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-34861.exe

Filesize
468KB

MD5
b45156ae07c1f7809e98bf183c2e1dc8

SHA1
e83d9bb40249a37ac030af263de2c6cb981f34f4

SHA256
bca705cf7e7577f5965b200f73dc0f9238a595e8b2a4ed2bf1d6496a1712974b

SHA512
43b7e6009b51c28928840f9e1fb63d26c23c7505bfd5bff4a1ae96881d64b7b1bb726f4bdee542d1edf3bf7c479c2478bfc16bce71a309c8be84d47dd3851cf0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-3615.exe

Filesize
468KB

MD5
237f0865724519501c40a59c8aeebc12

SHA1
4bb940ee6c9f26c47e6ddada63c6f1542c33dc05

SHA256
ca160ad02693a817be3a6636b9402ccd6b580dd83eec104fb14f19da666ecc70

SHA512
7f09fe56cf32454b7260ebc78e31b3afcb9e4af1135bd7ecec5d3ebe450e09c7b3f54b527be65d253e761700f2219c1af064de51f9932d6576cd1cacc983303f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39936.exe

Filesize
468KB

MD5
6fe5807396766f3827ceb07424a64a73

SHA1
42c00a9fd1e7b08e572fb8e38a1f897e511a55ba

SHA256
cd655c7ec9b583d55d1027196e9c9a96ef6ed45bdf989b8fd63ab563fae5dac0

SHA512
a414956f8dde8cd7005df584ff4af04441af244296ca5f2af86b4d51855006a05aab271bbfb989c24d10beca3fe6f68485fa32d6298d20b77d9b9d1721208d9d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-4020.exe

Filesize
468KB

MD5
e65a7f15d2c077cf255d2b9ce830b0e7

SHA1
53634803a70785d77810a11946aa606a3a5473e6

SHA256
1d5d96c509f9ad7e1b645b3d2349b77834b0a8709c6da7cef55f64df0df5cc40

SHA512
9cdad71bdfb6b0dfcaad0e67fcf773d5fb2df6e7b2974b187e7d389d47013c710d66ef240dcdb1c2cf8463224c22d938776c1919ac8663b5c1477f0360b9c6b1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-43523.exe

Filesize
468KB

MD5
c37ba5ba026074ebc0d9fa8b6f7f14ab

SHA1
87f2c6cbf8497b557677c2a6e93639c5c2d92f19

SHA256
5203c59acf616f470fe84a5f25fcf1a428546fd64ece1ca20eaf04bdded6db7d

SHA512
9a8fa62344f7738d2125cc9cfbcfbe0aa93d200143b9269addfdcce145587b98975f3348bad1269dab9b1f7ecb5fae7c8a61e445be94fcd8ff7e3bb78ab6f275

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-44285.exe

Filesize
468KB

MD5
d112b067520ff8f4aee3da6c8388fd22

SHA1
f57d313434af9eac6e4344483ae52a67fe1f792f

SHA256
82edd5923837dbd024eb882bc9a98fe45925971897cb3ba58ab653bcbe20c58f

SHA512
043f8fb8116b9fdcdc52f8dae4182f03364ed06fb0bb201107eeeb6ed71cf3aadb2dfd7716f2dcbf9e7d7c36a1401344847739d3379ee5a83327d9dba72952cb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-44700.exe

Filesize
468KB

MD5
7958f0165bd4bb03881a9fc03a41696f

SHA1
0befb5b6bffe7c6aa378714767c28ed7ff73db13

SHA256
79f34e6e28246add86274b54d48c076bb7f6dd88fb38db1154f830230008257a

SHA512
98f1fa9ae8e423ae47f363c7da442aa52d5da85471fbbacee460c25df7d28157f28131c001bfc4fe73900caf94a35ae0bf155ed16660bee4843f76b96b1cec05

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-48514.exe

Filesize
468KB

MD5
c97919b87d2498e1faee62004dd589b3

SHA1
c0cde92db229d7e517dc725f686fa386b2bae34d

SHA256
b15cae2d1922ff2f69c4ceb8e3b479c38a1def89f67ebf4d60820330459eddff

SHA512
8b93bf74f56bb6441a736a17c4398061dd457b1304214931f2603b20a3cc1dfe874e0636c859d52516df2a4d6783373d2665ae55d3d2c908c16ff46984667f96

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-49281.exe

Filesize
468KB

MD5
e172c836e708afdd38413b3f70d9d12e

SHA1
88490a48988ab7a107682daf7c9e37dd21d20a1d

SHA256
2a85ab6c1e68ccc6500c3a274f96bd792abeff936459a50b172bcee6683b9891

SHA512
fb3730a82efc505f3d4cd1249a4008fed8908b464e8491727ae25fbb6435c80fe743411b3aed4a17dbf2098c6ba1f4fa51c5d1f08a71c1902f4af59c5d0722ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-52453.exe

Filesize
468KB

MD5
9544cc99622bab3fa9cf18b00646cc46

SHA1
da6ceb9b1487b0dba22f2e6113b0cd0bda4181d7

SHA256
eb3c4cd8693315ba40d0eb3ebe12171e939b1bd01941ab39b3867e6fd48d61f4

SHA512
f32c709e756639c4cc43dbf6509b94a891609ec3f2edcc3c945e4105d6461b98729268ebf60dd37811ca71178348116e57b2a3cd9c492e4f6a5fe313510f0fb2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-53055.exe

Filesize
468KB

MD5
3e0b572b9ad6917820a67dd772248725

SHA1
74a05088f5900af8180b5197c518ea7ce126da72

SHA256
efae75b87ec15adc2e6cf95dc2b94a119ce9b856f683422ba1149760ce187b2e

SHA512
bba630bdf6ec89b91a7e32891dbbcd5bf45b9a96136b4a2541d8159a27e7ed03f8ded0ecb47b453845bf10795bb01952566a64fff31166b831dca0eae612ec67

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-8903.exe

Filesize
468KB

MD5
d99d637b6a4bac65b911b5d56a0581b5

SHA1
d9e963dbf08ccd8e94f1f5c3a7cd1e3ec86914d1

SHA256
60f19ede782558dfa88ea744df0380cc15d40a124e096df68387b545215913df

SHA512
6e8e4e004dc30878026641b667b6d57d7084b25ea9fcfc1094902ebcc29df346f6b58f87f391c9497b3986eb23e74aa70c17c4ae369cecc0055fec04ca3a9279

Download Submit
memory/216-89-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/312-523-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/348-164-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/536-222-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/644-521-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/672-322-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/676-177-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/744-398-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/768-41-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/828-239-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/888-354-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1016-42-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1028-296-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1220-74-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1284-474-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1344-294-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1356-514-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1420-262-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1420-52-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1420-40-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1568-334-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1572-136-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1600-370-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1636-19-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1668-415-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1700-232-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1708-345-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1712-124-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1892-303-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1912-362-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1916-172-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1980-171-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2112-454-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2152-245-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2212-451-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2388-291-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2464-206-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2512-339-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2636-117-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2660-392-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2744-402-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2800-382-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2884-6-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2892-416-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2928-450-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2980-215-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3020-103-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3096-421-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3144-13-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3320-452-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3468-95-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3528-298-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3600-349-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3632-73-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3640-194-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3648-116-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3720-320-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3820-238-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3864-453-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3868-64-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3912-200-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3924-321-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3944-229-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3948-420-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3952-391-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4080-302-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4100-257-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4140-173-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4276-325-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4320-142-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4328-295-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4352-285-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4372-423-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4488-449-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4572-373-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4632-187-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4648-418-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4672-141-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4684-72-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4696-468-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4716-522-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4788-27-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4796-482-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4820-513-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4904-293-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4972-520-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5028-363-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5100-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5144-543-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5152-542-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5184-565-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5204-566-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5252-567-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5260-568-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5292-545-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5316-547-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads