70786bde2e8925efd679b718bd4f2bd5a5803d391c62eea20823e401a46461f5

Analysis

max time kernel
150s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
25/09/2024, 22:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

70786bde2e8925efd679b718bd4f2bd5a5803d391c62eea20823e401a46461f5.exe
Size

468KB
MD5

16288396698adbb4ebb2d81d57a5009c
SHA1

460afd00c771cd75d1ca1adc2a3f5f14c418742c
SHA256

70786bde2e8925efd679b718bd4f2bd5a5803d391c62eea20823e401a46461f5
SHA512

9f2921c4884fbeb1a5e2fb8ad1d0ff054079992cc186fdf6270a8cf067d7f08723d6e2dcfe210e1059a44e019c57e8448ac9f5e9089feb80a5d2ec3d5f58c015
SSDEEP

3072:tqopowLdjy8U6bYofz5jff5kCgjsIrBZmHegVpuoa+n0OmNDalZ:tq2oYLU6Tf1jffRyN7oaE7mND

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
4020	Unicorn-11576.exe
2792	Unicorn-284.exe
216	Unicorn-41871.exe
2760	Unicorn-52547.exe
5036	Unicorn-52547.exe
4900	Unicorn-63408.exe
3756	Unicorn-38249.exe
1352	Unicorn-40077.exe
3824	Unicorn-16127.exe
3864	Unicorn-58094.exe
4344	Unicorn-52229.exe
1192	Unicorn-58359.exe
1504	Unicorn-38493.exe
4848	Unicorn-4835.exe
3808	Unicorn-4835.exe
2696	Unicorn-2142.exe
4948	Unicorn-63403.exe
1940	Unicorn-57273.exe
4352	Unicorn-19033.exe
1376	Unicorn-38899.exe
3700	Unicorn-31042.exe
400	Unicorn-8840.exe
1680	Unicorn-14970.exe
4080	Unicorn-45697.exe
3528	Unicorn-45697.exe
816	Unicorn-32682.exe
1320	Unicorn-21747.exe
1968	Unicorn-23715.exe
2780	Unicorn-23715.exe
396	Unicorn-36059.exe
3196	Unicorn-42765.exe
3368	Unicorn-44711.exe
2212	Unicorn-15931.exe
4944	Unicorn-46657.exe
2316	Unicorn-42573.exe
1148	Unicorn-60855.exe
1688	Unicorn-44519.exe
224	Unicorn-9443.exe
2360	Unicorn-55380.exe
1620	Unicorn-20569.exe
2564	Unicorn-2116.exe
3212	Unicorn-54639.exe
4216	Unicorn-57439.exe
744	Unicorn-64746.exe
3952	Unicorn-61523.exe
1800	Unicorn-8893.exe
4228	Unicorn-16507.exe
3480	Unicorn-8338.exe
1312	Unicorn-8338.exe
2688	Unicorn-19199.exe
4004	Unicorn-16507.exe
2140	Unicorn-30440.exe
212	Unicorn-41565.exe
4612	Unicorn-43076.exe
3532	Unicorn-41203.exe
1368	Unicorn-2884.exe
876	Unicorn-2884.exe
3768	Unicorn-13745.exe
3288	Unicorn-13745.exe
2668	Unicorn-59988.exe
4916	Unicorn-27389.exe
2508	Unicorn-3439.exe
3560	Unicorn-64145.exe
1872	Unicorn-40195.exe

Program crash 33 IoCs

pid	pid_target	Process	procid_target
5700	4004	WerFault.exe	140
5284	1192	WerFault.exe	102
5916	3952	WerFault.exe	133
6340	4228	WerFault.exe	139
6764	1192	WerFault.exe	102
6736	4004	WerFault.exe	140
6664	3952	WerFault.exe	133
6908	5808	WerFault.exe	229
9548	3020	WerFault.exe	167
9620	5320	WerFault.exe	188
9760	2464	WerFault.exe	180
9744	5808	WerFault.exe	229
9168	5672	WerFault.exe	232
9004	6232	WerFault.exe	240
8308	2464	WerFault.exe	180
10236	7396	WerFault.exe	323
11028	7372	WerFault.exe	320
1736	5300	WerFault.exe	187
11048	6400	WerFault.exe	296
14256	6212	WerFault.exe	263
13992	9712	WerFault.exe	442
8860	5300	WerFault.exe	187
9296	12820	WerFault.exe	701
6296	6212	WerFault.exe	263
14892	6956	WerFault.exe	290
10628	12992	WerFault.exe	767
14596	9712	WerFault.exe	442
9436	14816	WerFault.exe	924
7384	8680	WerFault.exe	401
14752	7100	WerFault.exe	282
15128	7100	WerFault.exe	282
1616	6956	WerFault.exe	290
3344	15292	WerFault.exe	909

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31027.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36101.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39313.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10850.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41939.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6190.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54763.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51499.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50513.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40129.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5318.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4503.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53445.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52132.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20273.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23715.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13745.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50513.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48737.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23715.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2884.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21851.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17675.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26730.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54219.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38899.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52308.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9313.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48354.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36599.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26128.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25681.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11301.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10175.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36343.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38493.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50579.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56278.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25791.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28313.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37995.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51499.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19905.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10354.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64837.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1722.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58276.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51499.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32039.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64524.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47484.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58795.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28648.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22208.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	Process not Found
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	Process not Found
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	Process not Found
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	Process not Found

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Process not Found
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	Process not Found

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	Process not Found

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	6972	Process not Found
Token: SeChangeNotifyPrivilege	6972	Process not Found
Token: 33	6972	Process not Found
Token: SeIncBasePriorityPrivilege	6972	Process not Found

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
3012	70786bde2e8925efd679b718bd4f2bd5a5803d391c62eea20823e401a46461f5.exe
4020	Unicorn-11576.exe
2792	Unicorn-284.exe
216	Unicorn-41871.exe
2760	Unicorn-52547.exe
5036	Unicorn-52547.exe
4900	Unicorn-63408.exe
3756	Unicorn-38249.exe
3824	Unicorn-16127.exe
1352	Unicorn-40077.exe
4344	Unicorn-52229.exe
3864	Unicorn-58094.exe
1504	Unicorn-38493.exe
1192	Unicorn-58359.exe
3808	Unicorn-4835.exe
4848	Unicorn-4835.exe
2696	Unicorn-2142.exe
4948	Unicorn-63403.exe
1940	Unicorn-57273.exe
4352	Unicorn-19033.exe
1376	Unicorn-38899.exe
3700	Unicorn-31042.exe
3528	Unicorn-45697.exe
4080	Unicorn-45697.exe
816	Unicorn-32682.exe
400	Unicorn-8840.exe
1680	Unicorn-14970.exe
1320	Unicorn-21747.exe
1968	Unicorn-23715.exe
2780	Unicorn-23715.exe
396	Unicorn-36059.exe
3196	Unicorn-42765.exe
3368	Unicorn-44711.exe
2212	Unicorn-15931.exe
2316	Unicorn-42573.exe
4944	Unicorn-46657.exe
1148	Unicorn-60855.exe
1688	Unicorn-44519.exe
744	Unicorn-64746.exe
3952	Unicorn-61523.exe
2564	Unicorn-2116.exe
2688	Unicorn-19199.exe
2140	Unicorn-30440.exe
1800	Unicorn-8893.exe
3480	Unicorn-8338.exe
2360	Unicorn-55380.exe
4216	Unicorn-57439.exe
3212	Unicorn-54639.exe
1312	Unicorn-8338.exe
1620	Unicorn-20569.exe
4228	Unicorn-16507.exe
224	Unicorn-9443.exe
212	Unicorn-41565.exe
4004	Unicorn-16507.exe
4612	Unicorn-43076.exe
3532	Unicorn-41203.exe
876	Unicorn-2884.exe
1368	Unicorn-2884.exe
2668	Unicorn-59988.exe
3288	Unicorn-13745.exe
3768	Unicorn-13745.exe
4916	Unicorn-27389.exe
2508	Unicorn-3439.exe
3560	Unicorn-64145.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3012 wrote to memory of 4020	3012	70786bde2e8925efd679b718bd4f2bd5a5803d391c62eea20823e401a46461f5.exe	86
PID 3012 wrote to memory of 4020	3012	70786bde2e8925efd679b718bd4f2bd5a5803d391c62eea20823e401a46461f5.exe	86
PID 3012 wrote to memory of 4020	3012	70786bde2e8925efd679b718bd4f2bd5a5803d391c62eea20823e401a46461f5.exe	86
PID 4020 wrote to memory of 2792	4020	Unicorn-11576.exe	87
PID 4020 wrote to memory of 2792	4020	Unicorn-11576.exe	87
PID 4020 wrote to memory of 2792	4020	Unicorn-11576.exe	87
PID 3012 wrote to memory of 216	3012	70786bde2e8925efd679b718bd4f2bd5a5803d391c62eea20823e401a46461f5.exe	88
PID 3012 wrote to memory of 216	3012	70786bde2e8925efd679b718bd4f2bd5a5803d391c62eea20823e401a46461f5.exe	88
PID 3012 wrote to memory of 216	3012	70786bde2e8925efd679b718bd4f2bd5a5803d391c62eea20823e401a46461f5.exe	88
PID 216 wrote to memory of 2760	216	Unicorn-41871.exe	90
PID 216 wrote to memory of 2760	216	Unicorn-41871.exe	90
PID 216 wrote to memory of 2760	216	Unicorn-41871.exe	90
PID 2792 wrote to memory of 5036	2792	Unicorn-284.exe	89
PID 2792 wrote to memory of 5036	2792	Unicorn-284.exe	89
PID 2792 wrote to memory of 5036	2792	Unicorn-284.exe	89
PID 4020 wrote to memory of 4900	4020	Unicorn-11576.exe	91
PID 4020 wrote to memory of 4900	4020	Unicorn-11576.exe	91
PID 4020 wrote to memory of 4900	4020	Unicorn-11576.exe	91
PID 3012 wrote to memory of 3756	3012	70786bde2e8925efd679b718bd4f2bd5a5803d391c62eea20823e401a46461f5.exe	92
PID 3012 wrote to memory of 3756	3012	70786bde2e8925efd679b718bd4f2bd5a5803d391c62eea20823e401a46461f5.exe	92
PID 3012 wrote to memory of 3756	3012	70786bde2e8925efd679b718bd4f2bd5a5803d391c62eea20823e401a46461f5.exe	92
PID 5036 wrote to memory of 1352	5036	Unicorn-52547.exe	97
PID 5036 wrote to memory of 1352	5036	Unicorn-52547.exe	97
PID 5036 wrote to memory of 1352	5036	Unicorn-52547.exe	97
PID 2792 wrote to memory of 3824	2792	Unicorn-284.exe	98
PID 2792 wrote to memory of 3824	2792	Unicorn-284.exe	98
PID 2792 wrote to memory of 3824	2792	Unicorn-284.exe	98
PID 3012 wrote to memory of 3864	3012	70786bde2e8925efd679b718bd4f2bd5a5803d391c62eea20823e401a46461f5.exe	99
PID 3012 wrote to memory of 3864	3012	70786bde2e8925efd679b718bd4f2bd5a5803d391c62eea20823e401a46461f5.exe	99
PID 3012 wrote to memory of 3864	3012	70786bde2e8925efd679b718bd4f2bd5a5803d391c62eea20823e401a46461f5.exe	99
PID 4020 wrote to memory of 4344	4020	Unicorn-11576.exe	100
PID 4020 wrote to memory of 4344	4020	Unicorn-11576.exe	100
PID 4020 wrote to memory of 4344	4020	Unicorn-11576.exe	100
PID 216 wrote to memory of 1504	216	Unicorn-41871.exe	101
PID 216 wrote to memory of 1504	216	Unicorn-41871.exe	101
PID 216 wrote to memory of 1504	216	Unicorn-41871.exe	101
PID 4900 wrote to memory of 1192	4900	Unicorn-63408.exe	102
PID 4900 wrote to memory of 1192	4900	Unicorn-63408.exe	102
PID 4900 wrote to memory of 1192	4900	Unicorn-63408.exe	102
PID 3756 wrote to memory of 4848	3756	Unicorn-38249.exe	105
PID 3756 wrote to memory of 4848	3756	Unicorn-38249.exe	105
PID 3756 wrote to memory of 4848	3756	Unicorn-38249.exe	105
PID 2760 wrote to memory of 3808	2760	Unicorn-52547.exe	104
PID 2760 wrote to memory of 3808	2760	Unicorn-52547.exe	104
PID 2760 wrote to memory of 3808	2760	Unicorn-52547.exe	104
PID 3824 wrote to memory of 2696	3824	Unicorn-16127.exe	106
PID 3824 wrote to memory of 2696	3824	Unicorn-16127.exe	106
PID 3824 wrote to memory of 2696	3824	Unicorn-16127.exe	106
PID 1352 wrote to memory of 4948	1352	Unicorn-40077.exe	107
PID 1352 wrote to memory of 4948	1352	Unicorn-40077.exe	107
PID 1352 wrote to memory of 4948	1352	Unicorn-40077.exe	107
PID 2792 wrote to memory of 1940	2792	Unicorn-284.exe	108
PID 2792 wrote to memory of 1940	2792	Unicorn-284.exe	108
PID 2792 wrote to memory of 1940	2792	Unicorn-284.exe	108
PID 5036 wrote to memory of 4352	5036	Unicorn-52547.exe	109
PID 5036 wrote to memory of 4352	5036	Unicorn-52547.exe	109
PID 5036 wrote to memory of 4352	5036	Unicorn-52547.exe	109
PID 4344 wrote to memory of 1376	4344	Unicorn-52229.exe	110
PID 4344 wrote to memory of 1376	4344	Unicorn-52229.exe	110
PID 4344 wrote to memory of 1376	4344	Unicorn-52229.exe	110
PID 4020 wrote to memory of 3700	4020	Unicorn-11576.exe	111
PID 4020 wrote to memory of 3700	4020	Unicorn-11576.exe	111
PID 4020 wrote to memory of 3700	4020	Unicorn-11576.exe	111
PID 216 wrote to memory of 400	216	Unicorn-41871.exe	112

C:\Users\Admin\AppData\Local\Temp\70786bde2e8925efd679b718bd4f2bd5a5803d391c62eea20823e401a46461f5.exe
"C:\Users\Admin\AppData\Local\Temp\70786bde2e8925efd679b718bd4f2bd5a5803d391c62eea20823e401a46461f5.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3012
- C:\Users\Admin\AppData\Local\Temp\Unicorn-11576.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-11576.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4020
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-284.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-284.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52547.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52547.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:5036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40077.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63403.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42573.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6776.exe
        8⤵
        
        PID:4964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-300.exe
        9⤵
        
        PID:1660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17571.exe
        10⤵
        
        PID:7256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48401.exe
        11⤵
        
        PID:9848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44566.exe
        11⤵
        
        PID:11816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44461.exe
        11⤵
        
        PID:15152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16667.exe
        11⤵
        
        PID:14772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12216.exe
        11⤵
        
        PID:3228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9459.exe
        10⤵
        
        PID:10368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29775.exe
        9⤵
        
        PID:8816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20773.exe
        10⤵
        
        PID:9640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55038.exe
        10⤵
        
        PID:8044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57019.exe
        9⤵
        
        PID:13492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41661.exe
        9⤵
        
        PID:4900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36343.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:4880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27305.exe
        8⤵
        
        PID:5912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39889.exe
        9⤵
        
        PID:9016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10850.exe
        10⤵
        
        PID:9624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55827.exe
        11⤵
        
        PID:14856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63538.exe
        10⤵
        
        PID:14272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56083.exe
        10⤵
        
        PID:15720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64611.exe
        9⤵
        
        PID:12328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64524.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:1020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4010.exe
        9⤵
        
        PID:15928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59271.exe
        8⤵
        
        PID:8544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12988.exe
        9⤵
        
        PID:11972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16205.exe
        8⤵
        
        PID:13200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41661.exe
        8⤵
        
        PID:13948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39430.exe
        8⤵
        
        PID:15472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63678.exe
        7⤵
        
        PID:2896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51976.exe
        8⤵
        
        PID:6708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35443.exe
        9⤵
        
        PID:9524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58681.exe
        10⤵
        
        PID:12952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41529.exe
        9⤵
        
        PID:13356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40377.exe
        9⤵
        
        PID:14384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57647.exe
        8⤵
        
        PID:8648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36123.exe
        9⤵
        
        PID:6200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52132.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:13600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34002.exe
        8⤵
        
        PID:14752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18830.exe
        8⤵
        
        PID:15912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25856.exe
        7⤵
        
        PID:7072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37991.exe
        8⤵
        
        PID:7680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20773.exe
        9⤵
        
        PID:11104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56367.exe
        10⤵
        
        PID:8804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31815.exe
        10⤵
        
        PID:2312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19973.exe
        10⤵
        
        PID:15884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41939.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:10456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42167.exe
        8⤵
        
        PID:15216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30326.exe
        7⤵
        
        PID:8632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50513.exe
        8⤵
        
        PID:12164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3072.exe
        7⤵
        
        PID:12476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8893.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28313.exe
        7⤵
        
        PID:2096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5152.exe
        8⤵
        
        PID:6536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7264.exe
        9⤵
        
        PID:8016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51499.exe
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:10044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18395.exe
        9⤵
        
        PID:12128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39225.exe
        9⤵
        
        PID:14492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7217.exe
        8⤵
        
        PID:8808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57019.exe
        8⤵
        
        PID:13460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33300.exe
        8⤵
        
        PID:14492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32411.exe
        8⤵
        
        PID:15396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4529.exe
        7⤵
        
        PID:7116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3180.exe
        8⤵
        
        PID:7724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32039.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:12996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13734.exe
        9⤵
        
        PID:14748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54192.exe
        8⤵
        
        PID:11204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59271.exe
        7⤵
        
        PID:8864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6989.exe
        8⤵
        
        PID:7320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62325.exe
        7⤵
        
        PID:11900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25701.exe
        7⤵
        
        PID:10628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50579.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51421.exe
        7⤵
        
        PID:6384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15577.exe
        8⤵
        
        PID:9572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3258.exe
        9⤵
        
        PID:11868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3478.exe
        9⤵
        
        PID:2428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5453.exe
        8⤵
        
        PID:14300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37576.exe
        8⤵
        
        PID:14496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3133.exe
        7⤵
        
        PID:8840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22387.exe
        8⤵
        
        PID:14372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57019.exe
        7⤵
        
        PID:13484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46242.exe
        7⤵
        
        PID:14980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45875.exe
        7⤵
        
        PID:14840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51296.exe
        7⤵
        
        PID:15272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52308.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34539.exe
        7⤵
        
        PID:5812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4990.exe
        7⤵
        
        PID:14684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52848.exe
        7⤵
        
        PID:14376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8926.exe
        7⤵
        
        PID:15268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25848.exe
        6⤵
        
        PID:8012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11301.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:16232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56389.exe
        6⤵
        
        PID:3692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1392.exe
        6⤵
        
        PID:15312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32367.exe
        6⤵
        
        PID:9436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19033.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60855.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44265.exe
        7⤵
        
        PID:1384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10175.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37991.exe
        9⤵
        
        PID:7704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46429.exe
        10⤵
        
        PID:12220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52132.exe
        10⤵
        
        PID:14516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55003.exe
        10⤵
        
        PID:4680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58276.exe
        9⤵
        
        PID:11224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53049.exe
        8⤵
        
        PID:8496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6190.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:7652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2085.exe
        9⤵
        
        PID:14732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61941.exe
        8⤵
        
        PID:12832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55084.exe
        8⤵
        
        PID:15264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57541.exe
        8⤵
        
        PID:14832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33519.exe
        8⤵
        
        PID:14932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5323.exe
        7⤵
        
        PID:6032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52381.exe
        8⤵
        
        PID:7224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13590.exe
        9⤵
        
        PID:9892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44566.exe
        9⤵
        
        PID:5384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48354.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:10300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34552.exe
        8⤵
        
        PID:15740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63355.exe
        7⤵
        
        PID:8468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7150.exe
        8⤵
        
        PID:11292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61941.exe
        7⤵
        
        PID:14196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40475.exe
        7⤵
        
        PID:8720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37035.exe
        6⤵
        
        PID:3524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23051.exe
        7⤵
        
        PID:6168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5318.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:7420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30503.exe
        9⤵
        
        PID:10160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65187.exe
        8⤵
        
        PID:12424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29138.exe
        8⤵
        
        PID:14660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20638.exe
        8⤵
        
        PID:2132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3133.exe
        7⤵
        
        PID:8744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57019.exe
        7⤵
        
        PID:13476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28186.exe
        6⤵
        
        PID:6780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37991.exe
        7⤵
        
        PID:7688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52459.exe
        8⤵
        
        PID:11540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12172.exe
        8⤵
        
        PID:14788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17591.exe
        8⤵
        
        PID:14640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58276.exe
        7⤵
        
        PID:11196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11441.exe
        7⤵
        
        PID:2312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60301.exe
        6⤵
        
        PID:10136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56096.exe
        6⤵
        
        PID:14264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57439.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56709.exe
        6⤵
        
        PID:5208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12526.exe
        7⤵
        
        PID:5176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31359.exe
        8⤵
        
        PID:9656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21733.exe
        9⤵
        
        PID:11044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65125.exe
        8⤵
        
        PID:11912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9101.exe
        7⤵
        
        PID:9424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59003.exe
        8⤵
        
        PID:10784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46076.exe
        8⤵
        
        PID:14652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57149.exe
        7⤵
        
        PID:8044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4103.exe
        7⤵
        
        PID:15352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41944.exe
        6⤵
        
        PID:6288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30503.exe
        7⤵
        
        PID:9140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28648.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13677.exe
        6⤵
        
        PID:7036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1213.exe
        5⤵
        
        PID:5356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33523.exe
        6⤵
        
        PID:6932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34539.exe
        7⤵
        
        PID:11140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49093.exe
        7⤵
        
        PID:16252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65082.exe
        7⤵
        
        PID:15940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56522.exe
        6⤵
        
        PID:9592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25744.exe
        5⤵
        
        PID:8560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30093.exe
        6⤵
        
        PID:11884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32027.exe
        6⤵
        
        PID:16268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37107.exe
        5⤵
        
        PID:12364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15813.exe
        5⤵
        
        PID:4416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16127.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16127.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2142.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42765.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27389.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30451.exe
        8⤵
        
        PID:6072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39889.exe
        9⤵
        
        PID:9024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21733.exe
        10⤵
        
        PID:11344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49121.exe
        10⤵
        
        PID:1320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22208.exe
        9⤵
        
        PID:12884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31276.exe
        9⤵
        
        PID:15256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16170.exe
        9⤵
        
        PID:14688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36137.exe
        9⤵
        
        PID:12664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45536.exe
        8⤵
        
        PID:8900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58074.exe
        9⤵
        
        PID:7368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22208.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:12772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62308.exe
        7⤵
        
        PID:1028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39889.exe
        8⤵
        
        PID:9048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41961.exe
        9⤵
        
        PID:11348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58703.exe
        9⤵
        
        PID:3344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22208.exe
        8⤵
        
        PID:12788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55763.exe
        7⤵
        
        PID:8712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62325.exe
        7⤵
        
        PID:4872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2302.exe
        7⤵
        
        PID:16268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3439.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38619.exe
        7⤵
        
        PID:6052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50435.exe
        8⤵
        
        PID:6100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42563.exe
        9⤵
        
        PID:6040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49121.exe
        9⤵
        
        PID:14680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15689.exe
        9⤵
        
        PID:14588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52438.exe
        8⤵
        
        PID:10244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1327.exe
        8⤵
        
        PID:15340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31721.exe
        7⤵
        
        PID:9180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51499.exe
        8⤵
        
        PID:3068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54619.exe
        8⤵
        
        PID:14012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22208.exe
        7⤵
        
        PID:12876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63791.exe
        6⤵
        
        PID:5196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40129.exe
        7⤵
        
        PID:7372
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7372 -s 628
        8⤵
        Program crash
        
        PID:11028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36101.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:10400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42720.exe
        7⤵
        
        PID:15608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24104.exe
        6⤵
        
        PID:8252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5718.exe
        7⤵
        
        PID:3544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53748.exe
        7⤵
        
        PID:16084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47613.exe
        6⤵
        
        PID:11928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61498.exe
        6⤵
        
        PID:14860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57541.exe
        6⤵
        
        PID:5300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55380.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28313.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44768.exe
        7⤵
        
        PID:7796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51499.exe
        8⤵
        
        PID:11160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17513.exe
        8⤵
        
        PID:14368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59759.exe
        7⤵
        
        PID:10296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37292.exe
        7⤵
        
        PID:15612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25228.exe
        6⤵
        
        PID:9648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36123.exe
        7⤵
        
        PID:9420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52132.exe
        7⤵
        
        PID:14524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61130.exe
        6⤵
        
        PID:13348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37576.exe
        6⤵
        
        PID:3208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60885.exe
        5⤵
        
        PID:5368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41691.exe
        6⤵
        
        PID:368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33025.exe
        7⤵
        
        PID:3060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40263.exe
        7⤵
        
        PID:14556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37549.exe
        7⤵
        
        PID:15376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14913.exe
        6⤵
        
        PID:3220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42578.exe
        5⤵
        
        PID:8392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60819.exe
        6⤵
        
        PID:10960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31084.exe
        5⤵
        
        PID:13172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12105.exe
        5⤵
        
        PID:14532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57273.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57273.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44711.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64145.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45417.exe
        7⤵
        
        PID:6112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27301.exe
        8⤵
        
        PID:6048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34539.exe
        9⤵
        
        PID:11752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4990.exe
        9⤵
        
        PID:14648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49724.exe
        8⤵
        
        PID:4228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64524.exe
        8⤵
        
        PID:14676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42027.exe
        7⤵
        
        PID:7124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22208.exe
        7⤵
        
        PID:12804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50056.exe
        6⤵
        
        PID:680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33523.exe
        7⤵
        
        PID:7144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61229.exe
        8⤵
        
        PID:9288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56522.exe
        7⤵
        
        PID:9636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46251.exe
        7⤵
        
        PID:14752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28544.exe
        6⤵
        
        PID:8548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51499.exe
        7⤵
        
        PID:11248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62308.exe
        6⤵
        
        PID:12372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34002.exe
        6⤵
        
        PID:14916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40195.exe
        5⤵
        Executes dropped EXE
        
        PID:1872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45417.exe
        6⤵
        
        PID:6104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59017.exe
        7⤵
        
        PID:10152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38613.exe
        8⤵
        
        PID:16092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15759.exe
        7⤵
        
        PID:7884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7217.exe
        6⤵
        
        PID:8736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-191.exe
        7⤵
        
        PID:14464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51416.exe
        7⤵
        
        PID:1764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41304.exe
        7⤵
        
        PID:2176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57019.exe
        6⤵
        
        PID:12700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46242.exe
        6⤵
        
        PID:4232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63791.exe
        5⤵
        
        PID:5128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33523.exe
        6⤵
        
        PID:732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30503.exe
        7⤵
        
        PID:9072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19773.exe
        7⤵
        
        PID:15220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56522.exe
        6⤵
        
        PID:9608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34410.exe
        5⤵
        
        PID:8532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34177.exe
        6⤵
        
        PID:10980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31084.exe
        5⤵
        
        PID:10116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2316.exe
        5⤵
        
        PID:15052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9443.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9443.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9646.exe
        5⤵
        
        PID:5288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17763.exe
        6⤵
        
        PID:6556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34539.exe
        7⤵
        
        PID:11036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4990.exe
        7⤵
        
        PID:14624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24836.exe
        7⤵
        
        PID:11816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-803.exe
        7⤵
        
        PID:16036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41555.exe
        6⤵
        
        PID:9000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35153.exe
        7⤵
        
        PID:32
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19599.exe
        6⤵
        
        PID:14740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48947.exe
        6⤵
        
        PID:780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-995.exe
        5⤵
        
        PID:9148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26009.exe
        6⤵
        
        PID:11004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22208.exe
        5⤵
        
        PID:12860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43898.exe
        5⤵
        
        PID:15868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36119.exe
        5⤵
        
        PID:9716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19190.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19190.exe
      4⤵
      PID:5408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56657.exe
        5⤵
        
        PID:5900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40617.exe
        6⤵
        
        PID:9124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3533.exe
        6⤵
        
        PID:13704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21711.exe
        5⤵
        
        PID:10540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37087.exe
        5⤵
        
        PID:14796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29906.exe
        5⤵
        
        PID:14468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63070.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63070.exe
      4⤵
      PID:8728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43767.exe
        5⤵
        
        PID:14608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54749.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54749.exe
      4⤵
      PID:12716
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63408.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63408.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58359.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58359.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45697.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8338.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17815.exe
        7⤵
        
        PID:5240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60383.exe
        8⤵
        
        PID:6640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15577.exe
        9⤵
        
        PID:9684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31977.exe
        10⤵
        
        PID:13856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40839.exe
        10⤵
        
        PID:4908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55265.exe
        9⤵
        
        PID:13376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63317.exe
        9⤵
        
        PID:15172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43415.exe
        9⤵
        
        PID:16200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39313.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:8204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52459.exe
        9⤵
        
        PID:11316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50413.exe
        8⤵
        
        PID:11920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46321.exe
        8⤵
        
        PID:15020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12121.exe
        7⤵
        
        PID:7080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9402.exe
        8⤵
        
        PID:7348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26803.exe
        9⤵
        
        PID:9300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61260.exe
        9⤵
        
        PID:15164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39017.exe
        9⤵
        
        PID:15672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15986.exe
        8⤵
        
        PID:12596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3150.exe
        8⤵
        
        PID:7384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24460.exe
        7⤵
        
        PID:8596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10850.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:9692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15183.exe
        8⤵
        
        PID:14940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4939.exe
        7⤵
        
        PID:12300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16423.exe
        6⤵
        
        PID:5320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31385.exe
        7⤵
        
        PID:7100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50373.exe
        8⤵
        
        PID:9712
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9712 -s 636
        9⤵
        Program crash
        
        PID:13992
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9712 -s 636
        9⤵
        Program crash
        
        PID:14596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2443.exe
        8⤵
        
        PID:13428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40377.exe
        8⤵
        
        PID:14448
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7100 -s 664
        8⤵
        Program crash
        
        PID:14752
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7100 -s 624
        8⤵
        Program crash
        
        PID:15128
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5320 -s 664
        7⤵
        Program crash
        
        PID:9620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57133.exe
        6⤵
        
        PID:7860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46429.exe
        7⤵
        
        PID:12196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26730.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41565.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7700.exe
        6⤵
        
        PID:2464
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2464 -s 636
        7⤵
        Program crash
        
        PID:8308
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2464 -s 636
        7⤵
        Program crash
        
        PID:9760
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1192 -s 712
        5⤵
        Program crash
        
        PID:5284
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1192 -s 712
        5⤵
        Program crash
        
        PID:6764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21747.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21747.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44519.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25791.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26751.exe
        7⤵
        
        PID:5808
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5808 -s 724
        8⤵
        Program crash
        
        PID:6908
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5808 -s 724
        8⤵
        Program crash
        
        PID:9744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21851.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5672
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5672 -s 640
        7⤵
        Program crash
        
        PID:9168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55763.exe
        6⤵
        
        PID:8856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48712.exe
        5⤵
        
        PID:3020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8660.exe
        6⤵
        
        PID:6232
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6232 -s 616
        7⤵
        Program crash
        
        PID:9004
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3020 -s 708
        6⤵
        Program crash
        
        PID:9548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3682.exe
        5⤵
        
        PID:6212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59371.exe
        6⤵
        
        PID:6480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52459.exe
        7⤵
        
        PID:10872
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6212 -s 628
        6⤵
        Program crash
        
        PID:14256
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6212 -s 628
        6⤵
        Program crash
        
        PID:6296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18457.exe
        5⤵
        
        PID:7820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19408.exe
        5⤵
        
        PID:12892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61523.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61523.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3952
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3952 -s 640
        5⤵
        Program crash
        
        PID:5916
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3952 -s 652
        5⤵
        Program crash
        
        PID:6664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56444.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56444.exe
      4⤵
      PID:5188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16611.exe
        5⤵
        
        PID:6492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10725.exe
        5⤵
        
        PID:8680
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8680 -s 624
        6⤵
        Program crash
        
        PID:7384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43643.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43643.exe
      4⤵
      PID:6400
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6400 -s 628
        5⤵
        Program crash
        
        PID:11048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9313.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9313.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:9596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40847.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40847.exe
      4⤵
      PID:15124
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52229.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52229.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38899.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38899.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46657.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6776.exe
        6⤵
        
        PID:2776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47363.exe
        7⤵
        
        PID:4364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39889.exe
        8⤵
        
        PID:9064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5396.exe
        9⤵
        
        PID:11016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22208.exe
        8⤵
        
        PID:14088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44104.exe
        8⤵
        
        PID:14848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28334.exe
        8⤵
        
        PID:14352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42027.exe
        7⤵
        
        PID:8796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10850.exe
        8⤵
        
        PID:7356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64611.exe
        7⤵
        
        PID:12312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41887.exe
        6⤵
        
        PID:5220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39889.exe
        7⤵
        
        PID:9056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28474.exe
        8⤵
        
        PID:14724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37220.exe
        8⤵
        
        PID:15196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22208.exe
        7⤵
        
        PID:12844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1327.exe
        7⤵
        
        PID:2132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59271.exe
        6⤵
        
        PID:8592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5718.exe
        7⤵
        
        PID:12992
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 12992 -s 436
        8⤵
        Program crash
        
        PID:10628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16205.exe
        6⤵
        
        PID:13208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38854.exe
        6⤵
        
        PID:14412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4521.exe
        6⤵
        
        PID:15788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37035.exe
        5⤵
        
        PID:4196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50269.exe
        6⤵
        
        PID:6388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52381.exe
        7⤵
        
        PID:7244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53445.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:8000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56367.exe
        9⤵
        
        PID:15104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42427.exe
        8⤵
        
        PID:3528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9459.exe
        7⤵
        
        PID:10360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42027.exe
        6⤵
        
        PID:8656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51499.exe
        7⤵
        
        PID:9400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14310.exe
        7⤵
        
        PID:15028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22208.exe
        6⤵
        
        PID:12852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28186.exe
        5⤵
        
        PID:6772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58411.exe
        6⤵
        
        PID:7504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51115.exe
        7⤵
        
        PID:9408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41983.exe
        7⤵
        
        PID:14372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19773.exe
        7⤵
        
        PID:5028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30376.exe
        6⤵
        
        PID:12648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46251.exe
        6⤵
        
        PID:14696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25813.exe
        6⤵
        
        PID:544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65136.exe
        5⤵
        
        PID:8912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43683.exe
        6⤵
        
        PID:14840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20901.exe
        5⤵
        
        PID:13716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57541.exe
        5⤵
        
        PID:6244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20569.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20569.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36481.exe
        5⤵
        
        PID:4820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9236.exe
        6⤵
        
        PID:6516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23601.exe
        7⤵
        
        PID:7532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21733.exe
        8⤵
        
        PID:11136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13045.exe
        7⤵
        
        PID:11280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45937.exe
        7⤵
        
        PID:15204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43281.exe
        7⤵
        
        PID:1104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50509.exe
        7⤵
        
        PID:15956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4503.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19595.exe
        7⤵
        
        PID:11696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50413.exe
        6⤵
        
        PID:11988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25246.exe
        6⤵
        
        PID:14772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30595.exe
        5⤵
        
        PID:6888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37991.exe
        6⤵
        
        PID:7696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30093.exe
        7⤵
        
        PID:11372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17897.exe
        7⤵
        
        PID:14724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20340.exe
        7⤵
        
        PID:14956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58276.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49093.exe
        6⤵
        
        PID:16280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55844.exe
        6⤵
        
        PID:16220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9459.exe
        5⤵
        
        PID:10172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45989.exe
        5⤵
        
        PID:13340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32499.exe
        5⤵
        
        PID:8860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57596.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57596.exe
      4⤵
      PID:5592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37607.exe
        5⤵
        
        PID:6160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16689.exe
        6⤵
        
        PID:10516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17513.exe
        6⤵
        
        PID:15304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21711.exe
        5⤵
        
        PID:10276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7357.exe
        5⤵
        
        PID:14440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29828.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29828.exe
      4⤵
      PID:8444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50513.exe
        5⤵
        
        PID:12116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36535.exe
        5⤵
        
        PID:16188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14549.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14549.exe
      4⤵
      PID:12292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9983.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9983.exe
      4⤵
      PID:14580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59048.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59048.exe
      4⤵
      PID:15800
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31042.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31042.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15931.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15931.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53839.exe
        5⤵
        
        PID:4976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31027.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56418.exe
        7⤵
        
        PID:8940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30093.exe
        8⤵
        
        PID:10320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49121.exe
        8⤵
        
        PID:4080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22208.exe
        7⤵
        
        PID:12748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59864.exe
        7⤵
        
        PID:5480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36459.exe
        6⤵
        
        PID:10104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19787.exe
        7⤵
        
        PID:12080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19459.exe
        7⤵
        
        PID:14408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22043.exe
        6⤵
        
        PID:13416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2302.exe
        6⤵
        
        PID:2024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64254.exe
        5⤵
        
        PID:5236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33523.exe
        6⤵
        
        PID:6816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30503.exe
        7⤵
        
        PID:10132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56522.exe
        6⤵
        
        PID:9820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46242.exe
        6⤵
        
        PID:14688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15148.exe
        6⤵
        
        PID:14560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51296.exe
        6⤵
        
        PID:2612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24460.exe
        5⤵
        
        PID:8608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19905.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20273.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:15324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57541.exe
        5⤵
        
        PID:15036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38789.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38789.exe
      4⤵
      PID:2052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10175.exe
        5⤵
        
        PID:6944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48982.exe
        6⤵
        
        PID:9792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36123.exe
        7⤵
        
        PID:11476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3478.exe
        7⤵
        
        PID:15364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29198.exe
        6⤵
        
        PID:13708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46321.exe
        6⤵
        
        PID:9436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14730.exe
        5⤵
        
        PID:9156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5396.exe
        6⤵
        
        PID:9700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28074.exe
        5⤵
        
        PID:12820
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 12820 -s 472
        6⤵
        Program crash
        
        PID:9296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18614.exe
        5⤵
        
        PID:3980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35587.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35587.exe
      4⤵
      PID:5888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40129.exe
        5⤵
        
        PID:7380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23103.exe
        6⤵
        
        PID:10668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15489.exe
        5⤵
        
        PID:10508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58914.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58914.exe
      4⤵
      PID:8132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5718.exe
        5⤵
        
        PID:14248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52298.exe
        5⤵
        
        PID:15196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11726.exe
        5⤵
        
        PID:3896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47613.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47613.exe
      4⤵
      PID:9552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61498.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61498.exe
      4⤵
      PID:14788
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54639.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54639.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56470.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56470.exe
      4⤵
      PID:6184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7264.exe
        5⤵
        
        PID:7600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64903.exe
        6⤵
        
        PID:10948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45037.exe
        6⤵
        
        PID:14868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23465.exe
        5⤵
        
        PID:11180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1327.exe
        5⤵
        
        PID:7864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47595.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47595.exe
      4⤵
      PID:8776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47415.exe
        5⤵
        
        PID:10468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7358.exe
        6⤵
        
        PID:15008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24877.exe
        6⤵
        
        PID:16104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25681.exe
        5⤵
        
        PID:14356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62884.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62884.exe
      4⤵
      PID:12732
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37465.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37465.exe
    3⤵
    PID:5388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12526.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12526.exe
      4⤵
      PID:6444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43912.exe
        5⤵
        
        PID:8584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14170.exe
        5⤵
        
        PID:9780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9101.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9101.exe
      4⤵
      PID:7868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36689.exe
        5⤵
        
        PID:1528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44897.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44897.exe
      4⤵
      PID:6180
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53410.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53410.exe
    3⤵
    PID:6476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34539.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34539.exe
      4⤵
      PID:10352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61783.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61783.exe
      4⤵
      PID:1104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23316.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23316.exe
      4⤵
      PID:14340
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4848.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4848.exe
    3⤵
    PID:9304
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33723.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33723.exe
    3⤵
    PID:14924
- C:\Users\Admin\AppData\Local\Temp\Unicorn-41871.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-41871.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:216
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52547.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52547.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4835.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4835.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23715.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41203.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42895.exe
        7⤵
        
        PID:5892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21847.exe
        8⤵
        
        PID:6680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17675.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:9880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44566.exe
        9⤵
        
        PID:12456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13734.exe
        9⤵
        
        PID:14632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52438.exe
        8⤵
        
        PID:10260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20638.exe
        8⤵
        
        PID:14356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33859.exe
        7⤵
        
        PID:8824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57019.exe
        7⤵
        
        PID:13452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46242.exe
        7⤵
        
        PID:15308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8639.exe
        6⤵
        
        PID:5992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39889.exe
        7⤵
        
        PID:9032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64903.exe
        8⤵
        
        PID:12272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22208.exe
        7⤵
        
        PID:12812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63355.exe
        6⤵
        
        PID:8476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50513.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:12108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31382.exe
        7⤵
        
        PID:16132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14878.exe
        6⤵
        
        PID:12192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2892.exe
        6⤵
        
        PID:9432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31957.exe
        6⤵
        
        PID:15540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13745.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55405.exe
        6⤵
        
        PID:6704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46543.exe
        7⤵
        
        PID:8184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56953.exe
        8⤵
        
        PID:5024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3533.exe
        8⤵
        
        PID:1544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48737.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:15296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18395.exe
        7⤵
        
        PID:12136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61628.exe
        6⤵
        
        PID:8832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47415.exe
        7⤵
        
        PID:5660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25681.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:15268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37220.exe
        7⤵
        
        PID:2128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54219.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:12676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49053.exe
        6⤵
        
        PID:15244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16700.exe
        6⤵
        
        PID:15204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53462.exe
        6⤵
        
        PID:14996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42955.exe
        6⤵
        
        PID:3344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51478.exe
        6⤵
        
        PID:16328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10506.exe
        5⤵
        
        PID:4016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39889.exe
        6⤵
        
        PID:9040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22208.exe
        6⤵
        
        PID:12796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60385.exe
        6⤵
        
        PID:3344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61628.exe
        5⤵
        
        PID:8704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30093.exe
        6⤵
        
        PID:12256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54219.exe
        5⤵
        
        PID:12692
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36059.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36059.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2884.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40517.exe
        6⤵
        
        PID:6628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7264.exe
        7⤵
        
        PID:7608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61229.exe
        8⤵
        
        PID:10028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54986.exe
        8⤵
        
        PID:14152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38467.exe
        8⤵
        
        PID:1772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27549.exe
        7⤵
        
        PID:11124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25101.exe
        8⤵
        
        PID:14588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39417.exe
        7⤵
        
        PID:15280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53049.exe
        6⤵
        
        PID:8196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7534.exe
        7⤵
        
        PID:12208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47484.exe
        7⤵
        
        PID:2640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56278.exe
        6⤵
        
        PID:4180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16580.exe
        6⤵
        
        PID:15276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40475.exe
        6⤵
        
        PID:14816
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 14816 -s 276
        7⤵
        Program crash
        
        PID:9436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10585.exe
        5⤵
        
        PID:6084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2796.exe
        6⤵
        
        PID:1324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21733.exe
        7⤵
        
        PID:11176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36599.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:12492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34002.exe
        6⤵
        
        PID:14412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24476.exe
        6⤵
        
        PID:16064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59271.exe
        5⤵
        
        PID:7836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20773.exe
        6⤵
        
        PID:11232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21659.exe
        5⤵
        
        PID:13052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59988.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59988.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61369.exe
        5⤵
        
        PID:5932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35661.exe
        6⤵
        
        PID:6460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6190.exe
        7⤵
        
        PID:9840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52210.exe
        7⤵
        
        PID:15296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2368.exe
        7⤵
        
        PID:1616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31249.exe
        6⤵
        
        PID:9960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19599.exe
        6⤵
        
        PID:15108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19546.exe
        5⤵
        
        PID:9896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64384.exe
        5⤵
        
        PID:11728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19574.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19574.exe
      4⤵
      PID:6000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33523.exe
        5⤵
        
        PID:6672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6190.exe
        6⤵
        
        PID:5672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19773.exe
        6⤵
        
        PID:15292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14913.exe
        5⤵
        
        PID:9704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57011.exe
        5⤵
        
        PID:4884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9209.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9209.exe
      4⤵
      PID:8576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51499.exe
        5⤵
        
        PID:11240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19808.exe
        5⤵
        
        PID:12820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11770.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11770.exe
      4⤵
      PID:12428
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38493.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38493.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45697.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45697.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16507.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54763.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30233.exe
        7⤵
        
        PID:6800
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4228 -s 632
        6⤵
        Program crash
        
        PID:6340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20507.exe
        5⤵
        
        PID:5300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45775.exe
        6⤵
        
        PID:6956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42563.exe
        7⤵
        
        PID:8312
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6956 -s 648
        7⤵
        Program crash
        
        PID:14892
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6956 -s 668
        7⤵
        Program crash
        
        PID:1616
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5300 -s 736
        6⤵
        Program crash
        
        PID:1736
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5300 -s 736
        6⤵
        Program crash
        
        PID:8860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40797.exe
        5⤵
        
        PID:8340
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19199.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19199.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37995.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40129.exe
        6⤵
        
        PID:7396
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7396 -s 608
        7⤵
        Program crash
        
        PID:10236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5453.exe
        6⤵
        
        PID:14252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53049.exe
        5⤵
        
        PID:7528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64903.exe
        6⤵
        
        PID:10996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45037.exe
        6⤵
        
        PID:13260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46225.exe
        6⤵
        
        PID:14752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37220.exe
        6⤵
        
        PID:16368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56278.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:11936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12496.exe
        5⤵
        
        PID:14884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46697.exe
        5⤵
        
        PID:14472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60885.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60885.exe
      4⤵
      PID:5376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22065.exe
        5⤵
        
        PID:6336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63263.exe
        6⤵
        
        PID:7848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51499.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:10380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19808.exe
        7⤵
        
        PID:14964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3045.exe
        6⤵
        
        PID:10500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42167.exe
        6⤵
        
        PID:1584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39313.exe
        5⤵
        
        PID:8220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20773.exe
        6⤵
        
        PID:10272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50413.exe
        5⤵
        
        PID:12012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51732.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51732.exe
      4⤵
      PID:6760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61613.exe
        5⤵
        
        PID:9708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58162.exe
        5⤵
        
        PID:14828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42185.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42185.exe
      4⤵
      PID:10112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46467.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46467.exe
      4⤵
      PID:14428
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8840.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8840.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:400
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8338.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8338.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41935.exe
        5⤵
        
        PID:4816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12936.exe
        6⤵
        
        PID:4392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36045.exe
        7⤵
        
        PID:7444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61613.exe
        8⤵
        
        PID:6500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57710.exe
        8⤵
        
        PID:10000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7321.exe
        7⤵
        
        PID:10636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42167.exe
        7⤵
        
        PID:14624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32222.exe
        7⤵
        
        PID:16032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16947.exe
        6⤵
        
        PID:7592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64903.exe
        7⤵
        
        PID:12236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19459.exe
        7⤵
        
        PID:14372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31938.exe
        6⤵
        
        PID:11852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3150.exe
        6⤵
        
        PID:15352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30403.exe
        5⤵
        
        PID:6316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25931.exe
        6⤵
        
        PID:2520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63559.exe
        7⤵
        
        PID:9884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27435.exe
        7⤵
        
        PID:14808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62655.exe
        7⤵
        
        PID:15140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56522.exe
        6⤵
        
        PID:9816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10326.exe
        7⤵
        
        PID:14704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58823.exe
        6⤵
        
        PID:15568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62570.exe
        6⤵
        
        PID:1772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9459.exe
        5⤵
        
        PID:10180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34177.exe
        6⤵
        
        PID:11776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57125.exe
        5⤵
        
        PID:13776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29141.exe
        5⤵
        
        PID:15988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53372.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53372.exe
      4⤵
      PID:2540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32755.exe
        5⤵
        
        PID:6884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39827.exe
        6⤵
        
        PID:8604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44897.exe
        6⤵
        
        PID:1736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43898.exe
        6⤵
        
        PID:15852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9101.exe
        5⤵
        
        PID:9228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44897.exe
        5⤵
        
        PID:12396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21955.exe
        5⤵
        
        PID:14592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18392.exe
        5⤵
        
        PID:14860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58503.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58503.exe
      4⤵
      PID:7776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1312.exe
        5⤵
        
        PID:11764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17897.exe
        5⤵
        
        PID:14588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55003.exe
        5⤵
        
        PID:10464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11838.exe
        5⤵
        
        PID:15900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-87.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-87.exe
      4⤵
      PID:5560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60512.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60512.exe
      4⤵
      PID:15292
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 15292 -s 472
        5⤵
        Program crash
        
        PID:3344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10006.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10006.exe
      4⤵
      PID:14920
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30440.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30440.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11784.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11784.exe
      4⤵
      PID:4552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60383.exe
        5⤵
        
        PID:6612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11348.exe
        6⤵
        
        PID:7556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10850.exe
        7⤵
        
        PID:9844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50482.exe
        8⤵
        
        PID:13992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43319.exe
        7⤵
        
        PID:15204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29687.exe
        6⤵
        
        PID:10728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42167.exe
        6⤵
        
        PID:1168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39313.exe
        5⤵
        
        PID:6756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49745.exe
        6⤵
        
        PID:10332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17862.exe
        6⤵
        
        PID:3208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15689.exe
        6⤵
        
        PID:16252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50413.exe
        5⤵
        
        PID:11956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21161.exe
        5⤵
        
        PID:15232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57011.exe
        5⤵
        
        PID:14804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44497.exe
        5⤵
        
        PID:14448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33117.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33117.exe
      4⤵
      PID:4792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3180.exe
        5⤵
        
        PID:7716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16689.exe
        6⤵
        
        PID:212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58276.exe
        5⤵
        
        PID:11216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53049.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53049.exe
      4⤵
      PID:8504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50513.exe
        5⤵
        
        PID:12172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47484.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28074.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28074.exe
      4⤵
      PID:12760
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58085.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58085.exe
    3⤵
    PID:5344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47337.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47337.exe
      4⤵
      PID:5804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58795.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1722.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59532.exe
        6⤵
        
        PID:14620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15689.exe
        6⤵
        
        PID:16344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7705.exe
        5⤵
        
        PID:11440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10725.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10725.exe
      4⤵
      PID:8876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57019.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57019.exe
      4⤵
      PID:12836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47612.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47612.exe
      4⤵
      PID:15208
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23023.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23023.exe
    3⤵
    PID:6576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14550.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14550.exe
      4⤵
      PID:1896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3533.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3533.exe
      4⤵
      PID:12656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54986.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54986.exe
      4⤵
      PID:4680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10354.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10354.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3896
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26379.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26379.exe
    3⤵
    PID:8136
- C:\Users\Admin\AppData\Local\Temp\Unicorn-38249.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-38249.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3756
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4835.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4835.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23715.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23715.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2884.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28505.exe
        6⤵
        
        PID:6020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23217.exe
        7⤵
        
        PID:6016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14550.exe
        8⤵
        
        PID:1172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40865.exe
        8⤵
        
        PID:14388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13734.exe
        8⤵
        
        PID:14568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14913.exe
        7⤵
        
        PID:8752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4503.exe
        6⤵
        
        PID:8244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51499.exe
        7⤵
        
        PID:11144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50413.exe
        6⤵
        
        PID:13108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50056.exe
        5⤵
        
        PID:5328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53943.exe
        6⤵
        
        PID:5836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48785.exe
        7⤵
        
        PID:7992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44461.exe
        7⤵
        
        PID:3300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37000.exe
        7⤵
        
        PID:10464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14913.exe
        6⤵
        
        PID:4248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46242.exe
        6⤵
        
        PID:14624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14154.exe
        5⤵
        
        PID:8296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51499.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21275.exe
        5⤵
        
        PID:11944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29785.exe
        5⤵
        
        PID:14516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13745.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13745.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5946.exe
        5⤵
        
        PID:5960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53943.exe
        6⤵
        
        PID:5968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6190.exe
        7⤵
        
        PID:5668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17862.exe
        7⤵
        
        PID:7880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14913.exe
        6⤵
        
        PID:6648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-419.exe
        5⤵
        
        PID:8284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50513.exe
        6⤵
        
        PID:12156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47484.exe
        6⤵
        
        PID:4800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50413.exe
        5⤵
        
        PID:11996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21161.exe
        5⤵
        
        PID:15240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14316.exe
        5⤵
        
        PID:16140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63791.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63791.exe
      4⤵
      PID:5308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40129.exe
        5⤵
        
        PID:7388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56953.exe
        6⤵
        
        PID:3168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65187.exe
        5⤵
        
        PID:12620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6596.exe
        5⤵
        
        PID:10628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61218.exe
        5⤵
        
        PID:14496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53460.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53460.exe
      4⤵
      PID:8764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30093.exe
        5⤵
        
        PID:10940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49121.exe
        5⤵
        
        PID:1764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54219.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54219.exe
      4⤵
      PID:12684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22411.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22411.exe
      4⤵
      PID:15000
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43076.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43076.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11592.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11592.exe
      4⤵
      PID:5524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47337.exe
        5⤵
        
        PID:6420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15577.exe
        6⤵
        
        PID:9556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15318.exe
        7⤵
        
        PID:11060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2172.exe
        6⤵
        
        PID:13252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64524.exe
        6⤵
        
        PID:14612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28334.exe
        6⤵
        
        PID:2284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10725.exe
        5⤵
        
        PID:8720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52459.exe
        6⤵
        
        PID:9176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56792.exe
        6⤵
        
        PID:14712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20262.exe
        5⤵
        
        PID:12544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28623.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28623.exe
      4⤵
      PID:6432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30503.exe
        5⤵
        
        PID:9132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49610.exe
        5⤵
        
        PID:14416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8882.exe
        5⤵
        
        PID:15312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28648.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28648.exe
      4⤵
      PID:9516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25133.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25133.exe
      4⤵
      PID:15692
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2662.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2662.exe
    3⤵
    PID:5508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32755.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32755.exe
      4⤵
      PID:7160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40897.exe
        5⤵
        
        PID:7336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50513.exe
        6⤵
        
        PID:12100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17897.exe
        6⤵
        
        PID:14668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18203.exe
        5⤵
        
        PID:11836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4887.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4887.exe
      4⤵
      PID:7540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34177.exe
        5⤵
        
        PID:10972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22208.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22208.exe
      4⤵
      PID:12868
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39167.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39167.exe
    3⤵
    PID:7764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51499.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51499.exe
      4⤵
      PID:11152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49413.exe
        5⤵
        
        PID:11564
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57489.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57489.exe
    3⤵
    PID:10340
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64142.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64142.exe
    3⤵
    PID:15892
- C:\Users\Admin\AppData\Local\Temp\Unicorn-58094.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-58094.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3864
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14970.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14970.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16507.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16507.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4004
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4004 -s 608
        5⤵
        Program crash
        
        PID:5700
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4004 -s 608
        5⤵
        Program crash
        
        PID:6736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8255.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8255.exe
      4⤵
      PID:5420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6880.exe
        5⤵
        
        PID:6292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10850.exe
        6⤵
        
        PID:9760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39958.exe
        6⤵
        
        PID:4376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3472.exe
        6⤵
        
        PID:14972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52438.exe
        5⤵
        
        PID:10252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1902.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1902.exe
      4⤵
      PID:8424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37675.exe
        5⤵
        
        PID:3812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39750.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39750.exe
      4⤵
      PID:11772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38947.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38947.exe
      4⤵
      PID:14980
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21798.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21798.exe
    3⤵
    PID:4728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28889.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28889.exe
      4⤵
      PID:5432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48489.exe
        5⤵
        
        PID:6688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30455.exe
        6⤵
        
        PID:11308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14913.exe
        5⤵
        
        PID:6896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35753.exe
        5⤵
        
        PID:12992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29775.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29775.exe
      4⤵
      PID:8848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44291.exe
        5⤵
        
        PID:12284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49121.exe
        5⤵
        
        PID:7364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5453.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5453.exe
      4⤵
      PID:13588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36137.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36137.exe
      4⤵
      PID:15204
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26486.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26486.exe
    3⤵
    PID:5796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33523.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33523.exe
      4⤵
      PID:6744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30503.exe
        5⤵
        
        PID:10216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56522.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56522.exe
      4⤵
      PID:9740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46242.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46242.exe
      4⤵
      PID:1104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15148.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15148.exe
      4⤵
      PID:14580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51296.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51296.exe
      4⤵
      PID:15220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35087.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35087.exe
      4⤵
      PID:15204
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52963.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52963.exe
    3⤵
    PID:8668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27955.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27955.exe
      4⤵
      PID:11436
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-927.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-927.exe
    3⤵
    PID:12564
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39477.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39477.exe
    3⤵
    PID:15196
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36010.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36010.exe
    3⤵
    PID:1740
- C:\Users\Admin\AppData\Local\Temp\Unicorn-32682.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-32682.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:816
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2116.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2116.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9262.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9262.exe
      4⤵
      PID:3796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26751.exe
        5⤵
        
        PID:5816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40129.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26803.exe
        7⤵
        
        PID:9416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50300.exe
        6⤵
        
        PID:10488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32374.exe
        5⤵
        
        PID:10120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26641.exe
        6⤵
        
        PID:14588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17948.exe
        6⤵
        
        PID:14932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15759.exe
        5⤵
        
        PID:12452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51775.exe
        5⤵
        
        PID:14828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64890.exe
        5⤵
        
        PID:4784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36739.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36739.exe
      4⤵
      PID:7148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15577.exe
        5⤵
        
        PID:9564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13045.exe
        5⤵
        
        PID:10164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40221.exe
        5⤵
        
        PID:9784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24104.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24104.exe
      4⤵
      PID:8236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16689.exe
        5⤵
        
        PID:1840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47613.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47613.exe
      4⤵
      PID:5484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61498.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61498.exe
      4⤵
      PID:14840
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36843.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36843.exe
    3⤵
    PID:5180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53943.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53943.exe
      4⤵
      PID:5832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34539.exe
        5⤵
        
        PID:10476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4990.exe
        5⤵
        
        PID:14688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14913.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14913.exe
      4⤵
      PID:3900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64524.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64524.exe
      4⤵
      PID:7828
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59271.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59271.exe
    3⤵
    PID:8688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5718.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5718.exe
      4⤵
      PID:10236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-130.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-130.exe
      4⤵
      PID:15612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6833.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6833.exe
      4⤵
      PID:2612
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26128.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26128.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:12552
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29785.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29785.exe
    3⤵
    PID:7328
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34002.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34002.exe
    3⤵
    PID:13344
- C:\Users\Admin\AppData\Local\Temp\Unicorn-64746.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-64746.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:744
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3040.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3040.exe
    3⤵
    PID:2964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4576.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4576.exe
      4⤵
      PID:6220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52381.exe
        5⤵
        
        PID:7236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34539.exe
        6⤵
        
        PID:9536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48354.exe
        5⤵
        
        PID:10288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19599.exe
        5⤵
        
        PID:14420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48947.exe
        5⤵
        
        PID:15408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19277.exe
        5⤵
        
        PID:15852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4503.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4503.exe
      4⤵
      PID:8228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2682.exe
        5⤵
        
        PID:10308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-705.exe
        6⤵
        
        PID:14644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50413.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50413.exe
      4⤵
      PID:11968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14747.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14747.exe
      4⤵
      PID:15336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16170.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16170.exe
      4⤵
      PID:14468
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42463.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42463.exe
    3⤵
    PID:6748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17331.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17331.exe
      4⤵
      PID:7916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20773.exe
        5⤵
        
        PID:11112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41757.exe
        5⤵
        
        PID:15552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57019.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57019.exe
      4⤵
      PID:12780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45858.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45858.exe
      4⤵
      PID:15288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1327.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1327.exe
      4⤵
      PID:1104
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59271.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59271.exe
    3⤵
    PID:8884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50513.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50513.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:12148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60300.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60300.exe
      4⤵
      PID:14472
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16205.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16205.exe
    3⤵
    PID:13192
- C:\Users\Admin\AppData\Local\Temp\Unicorn-64837.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-64837.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3440
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32755.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32755.exe
    3⤵
    PID:6860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43912.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43912.exe
      4⤵
      PID:8456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53689.exe
        5⤵
        
        PID:15008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64218.exe
        5⤵
        
        PID:15688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14170.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14170.exe
      4⤵
      PID:6248
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9101.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9101.exe
    3⤵
    PID:8332
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57149.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57149.exe
    3⤵
    PID:3540
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21750.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21750.exe
    3⤵
    PID:2440
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31274.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31274.exe
    3⤵
    PID:16152
- C:\Users\Admin\AppData\Local\Temp\Unicorn-34702.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-34702.exe
  2⤵
  PID:7752
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34539.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34539.exe
    3⤵
    PID:11188
- C:\Users\Admin\AppData\Local\Temp\Unicorn-30623.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-30623.exe
  2⤵
  PID:9620
- C:\Users\Admin\AppData\Local\Temp\Unicorn-12613.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-12613.exe
  2⤵
  PID:10464
- C:\Users\Admin\AppData\Local\Temp\Unicorn-51154.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-51154.exe
  2⤵
  PID:712

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 3952 -ip 3952
1⤵
PID:4864

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 4004 -ip 4004
1⤵
PID:5584

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 1192 -ip 1192
1⤵
PID:5668

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 4228 -ip 4228
1⤵
PID:5956

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 3952 -ip 3952
1⤵
PID:6256

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4004 -ip 4004
1⤵
PID:6300

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 1192 -ip 1192
1⤵
PID:6400

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 2464 -ip 2464
1⤵
PID:7200

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 4228 -ip 4228
1⤵
PID:7568

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 5808 -ip 5808
1⤵
PID:7940

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 6232 -ip 6232
1⤵
PID:8028

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 688 -p 5672 -ip 5672
1⤵
PID:5472

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 696 -p 6800 -ip 6800
1⤵
PID:7360

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 716 -p 6492 -ip 6492
1⤵
PID:8992

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 4180 -ip 4180
1⤵
PID:7868

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 676 -p 212 -ip 212
1⤵
PID:8696

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 3068 -ip 3068
1⤵
PID:6764

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 3020 -ip 3020
1⤵
PID:9288

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 6800 -ip 6800
1⤵
PID:9404

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 4180 -ip 4180
1⤵
PID:10040

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 212 -ip 212
1⤵
PID:10208

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 672 -p 6492 -ip 6492
1⤵
PID:7428

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 3068 -ip 3068
1⤵
PID:6312

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 3020 -ip 3020
1⤵
PID:8572

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 692 -p 5320 -ip 5320
1⤵
PID:9872

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 700 -p 2464 -ip 2464
1⤵
PID:9536

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 5808 -ip 5808
1⤵
PID:9580

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 696 -p 5672 -ip 5672
1⤵
PID:9708

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 6232 -ip 6232
1⤵
PID:9732

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 6400 -ip 6400
1⤵
PID:9176

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 7396 -ip 7396
1⤵
PID:7648

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 7372 -ip 7372
1⤵
PID:9456

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 6400 -ip 6400
1⤵
PID:1736

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 7372 -ip 7372
1⤵
PID:9012

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 5300 -ip 5300
1⤵
PID:10656

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 5320 -ip 5320
1⤵
PID:10868

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 744 -p 8712 -ip 8712
1⤵
PID:10392

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 8712 -ip 8712
1⤵
PID:12032

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 724 -p 6212 -ip 6212
1⤵
PID:11816

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 8856 -ip 8856
1⤵
PID:12984

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 704 -p 8340 -ip 8340
1⤵
PID:13612

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 696 -p 7820 -ip 7820
1⤵
PID:14156

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 3528 -ip 3528
1⤵
PID:11840

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 7396 -ip 7396
1⤵
PID:11916

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 1688 -ip 1688
1⤵
PID:12308

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 5188 -ip 5188
1⤵
PID:13188

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 768 -p 8340 -ip 8340
1⤵
PID:14272

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 8856 -ip 8856
1⤵
PID:14264

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 3528 -ip 3528
1⤵
PID:12988

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 804 -p 1688 -ip 1688
1⤵
PID:13048

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 732 -p 5188 -ip 5188
1⤵
PID:14232

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 816 -p 7820 -ip 7820
1⤵
PID:13372

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 700 -p 9712 -ip 9712
1⤵
PID:14304

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 5300 -ip 5300
1⤵
PID:12656

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 692 -p 6212 -ip 6212
1⤵
PID:3224

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 752 -p 7860 -ip 7860
1⤵
PID:14464

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 6480 -ip 6480
1⤵
PID:14756

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 696 -p 8876 -ip 8876
1⤵
PID:14484

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 732 -p 8720 -ip 8720
1⤵
PID:5820

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 816 -p 12992 -ip 12992
1⤵
PID:13372

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 716 -p 12492 -ip 12492
1⤵
PID:14864

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 9712 -ip 9712
1⤵
PID:10628

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 740 -p 14816 -ip 14816
1⤵
PID:14700

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 700 -p 8680 -ip 8680
1⤵
PID:14684

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 732 -p 7100 -ip 7100
1⤵
PID:15352

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 15128 -ip 15128
1⤵
PID:8684

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:8056

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 672 -p 15292 -ip 15292
1⤵
PID:3752

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-11576.exe

Filesize
468KB

MD5
303aae1d98d45adf8c76e0193f07fd92

SHA1
9f7642acfde0bd9a8211e83180a555642b0d56bd

SHA256
cb2cc9226f332815bb3e9aae89aaee220ebd9f79fff78b3769d7bededcb35109

SHA512
6bbab7b7ab56963e0471d443c4248d8d76b4102bd885659a2ef12e826460eb4b06272ed27b6d1c3c19a256614899c5306416bc5e499dd7b140ab3a6f3eba5481

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-14970.exe

Filesize
468KB

MD5
ab4fbcc27f11a04d39a6997a7917cb06

SHA1
e279992aaae42674dc50c522f62eb745d7b651c0

SHA256
cac14d9cadd78cf294abb99f728d3201f0a92dc2dad0bf9336a4a0a237b47099

SHA512
81c96194395f7aced89cbe8eb0efcc72fabb85ffef8dacf86a98eb86c2ef8a8d472fd42efcdee12de1b321c3b62fa7df8fd17bdbad01f3368fd13a12c6c3fd02

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-16127.exe

Filesize
468KB

MD5
97d173c80549b06a0a0d7df7fa363f2d

SHA1
c2825dbc93921fdb2252f836cd27ac62f6a58372

SHA256
d440e8fcc92c59a81c613ff842e3ab1180642e0b3e25051c00c94ae2a6209e69

SHA512
9761b1d220b2d2a1d8f6352ebac141284e8f2b7895829e99491d78ecd180e6d347d75f9244926c524f821a88644fd58c60e831481d6d5201091e43c7321e8361

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-19033.exe

Filesize
468KB

MD5
884ea810662e7190c1288df7af5d48b3

SHA1
b01a2288656b874ca922e353d8e57514b046f7cc

SHA256
924e2d93e324c1dbbc5046344b8e41dc4159688f4436a7be785ac46819feb431

SHA512
1f745e07af6c75f2d730db0c99622f4078554a4f08417a4e77cd3755e8e56d16d8fdc39c467c5369c7ef7e1c9d2b72d2ec5b22da9d3c90fc855541f1d1e38a66

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-2142.exe

Filesize
468KB

MD5
8b2226917c8bb1491267e83c2581e9a5

SHA1
53654d18b076378ded49feb49f7d64bae16f0bc5

SHA256
1ed5d2274222a7639a0c86e5a6ac1fcaf42e62a278437b24140562df19cb8e6c

SHA512
aef99795a0808cd94f11a1254bf294e718907e2c7a9af7812fa452173c6913531a4f812fedc438f1ffbe3e5b4d42e1f0b378ba5babb91e2cffca7d46adf95419

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-21747.exe

Filesize
468KB

MD5
fec1d663e0002dfb173aebeca861c213

SHA1
8f90e28be96cee43a24148520080a3d8d26b1de7

SHA256
ddbba4588dda65fb1b4a1a092cb06e0ca250c2e8f3f720fdf7ceddb56dc6e9ed

SHA512
1faab1e2bcf3fe7e3572da82060086cfd160d5144ae14910ec8ed17efec16a6f29fdfc869d56c5a14230f81f4b5568a2f4aaee0da6026ed393e3aac2a403a76d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-23715.exe

Filesize
468KB

MD5
f2d49da4cd9bb2c020ef9ff149a67524

SHA1
4b1196b13a4ebdaad8f9743d88a31e27fc66524e

SHA256
62fb174c1bbbba032d6d40bd5bf3355631b499d0d5b52a372c5b892d073767b0

SHA512
eb1b2ae15261c840656eeeb41438978090300cd28e10c25132ae43f4fa885ae8ceb0b5a37538f7d27ce2b7217ee44e7e9a8b568ae1da83fafb7bd14e38ed3d09

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-27301.exe

Filesize
468KB

MD5
930618292d9547880f9f0c9c08c88847

SHA1
9c225664886c9f18eee64efb54ebaf18b100a00f

SHA256
b91c0ea1f273027df2ac7b39a501032cc61b668029184ac2510017a2c21fffb3

SHA512
76afd10592ac6cc74f8bf319959d0c5652cb2e2a07e581a9f26ad36e1952d523b6b1534f27a91588be51b75e3721a9a95f03563c3c5575093a055c1bc1c09e95

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-284.exe

Filesize
468KB

MD5
8ff40d0c5e5db6395a304449e19f730b

SHA1
9ff2180feda4475661a3f93292987caa3f0ab4d4

SHA256
5ba518669cfcd31e51e2db399c9cb58ff35e8aebc81652d018276d562e21c961

SHA512
0d4864aaf10bede66d7c5a02456d57d7d354f7f9197536ed3ee45a6a99e87bd52804affb66bda561b1f22e61750193a76f4fea5a75a0f2f9336931153797dbeb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-31042.exe

Filesize
468KB

MD5
a134de680e058e7e4a17db7bd6fc10c1

SHA1
fc906470b3ae52031879a5cbcb79b853aba4c686

SHA256
8965fd7472e16f34ebb201f53e75b02db549564fa26d96a0bef0a3ed4eec7417

SHA512
3bdee5718d61362d62e1295bb22dd8c1fe146a21ddf93e7e737b8b8efa6d74606fb0531b85cdb9a126d25a6de9cc15d340a9c5bb2ca0b3d54fc64fff7e74ec3b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-32682.exe

Filesize
468KB

MD5
7d670e92244cfb34b828c2f9ba1f1d8d

SHA1
b1ec8117cc40fd18e474b9cc72e62dac425c4a31

SHA256
317293a9b58b3f2640cbdba8a0f814053a9fe1c665fda1df82d7420f96e9681f

SHA512
49d2278318108ccf539136e2558641e6d9f80142ce27a3fade47a07681f93048d68a5249f9e21615d7831bce87edf64cf732141b2f1c9908df8ec5582fe47cde

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-36059.exe

Filesize
468KB

MD5
08d4f97c18b903ef4d9fc8ad4949f1e5

SHA1
567dc0132be6912bbabeb3152adb23339c86798c

SHA256
229035d0f312702752c3e94a65856dbee35ea93bb7fa08374c01488606e9730a

SHA512
3a2c295c456c7ededaef285191a4bab8b5fb21e5b21dbd86b095b161adbcf93b8f6607a5add095b0f87e27a422ab0c426caa766edd89f33bac502d5f2bf477f8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-38249.exe

Filesize
468KB

MD5
4afc137d4e427deaf98718296d7eeddb

SHA1
a189fab0518f0ef0a6093a76d055b9c7d2861a9a

SHA256
05dcaa2132386696ab3b77baeb5b4031f30dda2fc874c876ffe41ae3723f2f2e

SHA512
9d5048dc3bfa37af70fb457cd1c819b20cbbd973257d1875361cce7d4e4db2d9b4ece15de2d8f041b418abd7d0d00891a219cbb1e39d1b0140ca371d3726bcbc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-38493.exe

Filesize
468KB

MD5
0c607e53219a294a558b67512bdede41

SHA1
7c14cd78d2a3d8714c49355e50887627828402e3

SHA256
fec461aea909883a29343d72a1bb330507196b6a98d24f6d4cad89592b48f6ac

SHA512
e0c0187277e2482cb8a1ff5881cb34a19ed1878f43740c2541d83e89efc5f882d9994997933097c9965eccd08bab0cb8ebfce91f375d175d3d38f9df04ffa582

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-38899.exe

Filesize
468KB

MD5
4ee272920d92922a078dd071224b7e36

SHA1
426dcc8788857ca82b0e5f091a0ff55fbcf7e167

SHA256
17e54b81a66bfdfbba0b60400cec522004e5c4d87dd1ef0f23d8a38b4bacac56

SHA512
0cbc9e69371aa175e6e38499670884cce24427bd81b0ede620b44bd28aa4960f76ad62c54f11d6874f64886cb40b45a8df10e7a872930c9a2712badd2eb0a062

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-40077.exe

Filesize
468KB

MD5
0b8dfff648f4b0d97b40c6d06e984a3d

SHA1
7daf26859fbedd6d5ca5a94a83c53eb1af2206f0

SHA256
0d0536b27b6c438bc33068d9ce0ff084bbfc0edb4db87829a96ab2d5fa93dfa1

SHA512
d44849ab23c7a84c18a0cfefb43070538df7f73f59c422c46508859f83de09dfcddabcd96d1e6edcb405d8fe44f23517219f7ac8608dcc3cdbb2dabb5e6bc150

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-41871.exe

Filesize
468KB

MD5
0b6aa2fbb00342d89a9a2cb8c9ba0b50

SHA1
89ae17d11c9550d652e4aba63b2ea14eaa0eb214

SHA256
a1c2c709c07399342c8a960f31925ddce632678084a1cecee3f38cf54cbaaa3e

SHA512
5f082305fed9249b1df0a217502da69995d397b0489e5e995e079f73d4baa80822bfdb2efaa3c634ddc02163946c7dda94ecc4b170a67af95447782343ce3882

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-42765.exe

Filesize
468KB

MD5
e2476fd40159bd3d9462f9d74f829e7e

SHA1
f347481fbe5f9c390b25cbef87010c9745168a67

SHA256
89fd6d460f70a1a895d67faec5b3fd8a9669a2283b2b726d16c4dda0328778ce

SHA512
d5f0f486ad074291820e22a738c3cef833056d1524a42f4d4f2c7c3497e5a1055ffd53525fa7c7a54ee24e40abb18a0a174dadef1baa9f68350a91456ec82759

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-44711.exe

Filesize
468KB

MD5
196475bccfb8fd8bfa7da9be2e96f0e4

SHA1
ba109c44651d85bc6953ce470e0e9b9478a13cd3

SHA256
985cf6b362966b37a7f0afd4b07b2ccaf8b69796d88f6e1ef783332567446c44

SHA512
2f2e46d2175176afcac6714c8338a0b9a369ff3160557f6fcb7d1bd426434d8e2589beecc6804ca7849e7fd347df9f1cb00c2709cb3b0f1af9a13ab70043c137

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-45697.exe

Filesize
468KB

MD5
a998e2605cd84d743eb3dd980cda2967

SHA1
792f03119f3a005e8832054b45800fd71843cec8

SHA256
87b7cfa1592833befe347bc0c12d09c5f90d5c9c6d02aecb97f6258afdb223e4

SHA512
759a9d8de25a8ab05e954525be9ecb1dccac29cf74c5fb05c698838fd32fe3a9f712532fd9773a8ec76fc46154864f260c8622001fbd77e299f351f3bcab0130

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-46076.exe

Filesize
468KB

MD5
d2ca443b96ad3d44f1794d73af8cd421

SHA1
3977c3f13b03742b2acfedf1ef4717cff173d4f9

SHA256
05b24ab4b6b0c3d57faaf30d1264b204c5e401678df7993aa855bfce8595e04a

SHA512
8fed95595c18f75d5c7fa6257c3c2a254b58f5c43c0f9966a43faeccd7c7db55739905ed68a6dbc6a4a27fe1071ee7e121184ef01593925d3cc25acef6334635

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-4835.exe

Filesize
468KB

MD5
9b8dfa26d7840d09ffe0e39e77a89893

SHA1
f2149f1f30bbca6655fdf78585e4bfa77d1d9bbd

SHA256
d99c98269724d842a99760ef64536f313b58d07f4d4b9539cdbcc369852f6f1b

SHA512
3e165489a49659d98eca2e205cefa1aee8bbe074e0db3a0614193b19351746281f7eedd6024f1616bcabcbf771309ce1b8ef0705cccc93d63470031ea8b50941

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-48785.exe

Filesize
468KB

MD5
a724eff0a52cad4338e080121d77312b

SHA1
b415d2c0f1a9ef3fdf76ce64c4b925f7b9220d10

SHA256
7b562e1726c537f70052faa26c541a477c994a4e343ae034071967154e2f87eb

SHA512
07555534ed85e9ad86bf38e2359851559694a5c6e22f69f86a20591e4920d5d7e822cd83de71a54fa889db68db205504748e6dba0d4ea82ce705cd641aef6602

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-52229.exe

Filesize
468KB

MD5
5b14abefd9dc29ab77ef00d78ae5e3d8

SHA1
94b84da19b9d3480b2ea686def63e4e43459123f

SHA256
82b3cc8549d93203be5a0a8088aad91b220e2d8d9e70f68d6d8ae53633128578

SHA512
d54719fdab7b51cdbfdf19f7c4faa4dfe47736d3eb8c6c5745d5bad27b37e6a8299949f7d0a7e9869cad721e2d402466e1e2a101b78a6ced245f57d9519942d4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-52547.exe

Filesize
468KB

MD5
d123062ff72fa0a76edc01173661ea11

SHA1
ae2e449f21996423e5113774c0f3233356bf3d20

SHA256
46bd55c84a764081c7e158fcf1bf1f05c004c4113f06d49174926de82406d912

SHA512
cf3bbce524708e9eb99109e94a5140eee4dc79b1e31e423dcd3c04637a32a268b741b168849e4f8128d043bc52b60b3730e94d9b66724fee8e637e5e15047295

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5396.exe

Filesize
468KB

MD5
223fb99cbc578f3d52742b07ceaeb522

SHA1
1a33086c07312844bf3edd9454a1a6629c6f24b6

SHA256
2e6d2dbbdb295323e94ea6f56ec9f3e5b7695874e50d16e0ccb5ebc06d4839be

SHA512
27eed3e7e761be034e3e09954323bfbca95eef2b04abebba9bda58e4749559428747c0cf41bf0e35d87a80fb193633fe67af943b9c2f5ad2a31ced10512ba5ba

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-57273.exe

Filesize
468KB

MD5
9a5568885b5f00a6bcc099ca0c33d0be

SHA1
2e61993d7757f1ce28ae77790018837802b11b31

SHA256
e69e7c7b44286dcbb971aea0a8b23d41473edda2483ac3e39cd0b7fe8e5043b7

SHA512
7df9673b524b3e6e77002e10e0e3f8442cdff33f28e80312118bfa3bd81eb5b4ce4f86084a2c4e47132f08d4a32095fe61b918bce837308d3ca9854afaa2c624

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-58094.exe

Filesize
468KB

MD5
9b5b039fe120f863e6646699b1f62656

SHA1
c50a2cd5c2f7e83883700e06f9b0e89d6dc177d0

SHA256
6216014f55bd1c0aeefa3cad7eca9f7eb86ce9300e1a7d59150355f5fe48dc19

SHA512
b4bb22e2fb4ac0574619ecd286c8025e762f0b546d6de3fe3e69461d34b5399f7f6c6bfe2e4ac13cafe0dbbc39f1def823edfcb69ba5c628c5fc04180d8e7a91

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-58359.exe

Filesize
468KB

MD5
28dbb1f3fef397aa2bbd7d76a2668dd4

SHA1
1dfb2fda74da7363d034c85997c9efebdd96f953

SHA256
d9a2ebea5a781f6e78f59e4d336b134b5b0e3c17e0f3d98c45b3a54982664357

SHA512
76eecc54f62a681da340d05901d41571a98d9f516f54d74fd61d4a19046884400c214e5f24c4dc5aa9a224d8141cbd4185a15432620f3a342497f94d0f07a08c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-63403.exe

Filesize
468KB

MD5
6e20f04cc391eddf005609872dad7e03

SHA1
0615e11e125a5e8e61c705f07dc707e2fb045d04

SHA256
b93bcbcb4b9c5c80421b0de12faac95c99b2b744717eb84c8ca7fba3c50cb74a

SHA512
9e48935dc21b3541a95ff6b45ffd94c7abfdb56020f679f8c5ee214e036b89b05c0aae3bc8652029f9b7f9bf11d291e23d49c21701ea55e8ebec74eadbee37dc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-63408.exe

Filesize
468KB

MD5
f91d0ce6c04c36f3b5c388238e2ac4ad

SHA1
83a7a481fd1e991f2d755f4d12d5cf647666a15f

SHA256
97222db46d7a2948f3f9a1f7f35af93cd6c4f5acf61845c95c51845b402a08b0

SHA512
d1a750c1225dfe010f19ace81cfcba08d0625da3e0f761ff92ebefc718bb0782596d709aaf658359217b4b5267517e824c6575fe6b9dac1a452e08bcdfafcc5e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-8840.exe

Filesize
468KB

MD5
01248a4b3fc304bde097d20082e4e5ff

SHA1
686062e4c9fd6a6846d19d9200de3aa18ea769a2

SHA256
efe77026078aa0c250db9fd8a55285157dd567612286900b91a0f1c511e6430a

SHA512
7e04655496f3271189d38979c966983e8d502795ef8354bb7993ac5f644e2098f726bd33521ee29262273717cb04a8e193cb41b1913acb887e75307efd0c8365

Download Submit
memory/212-315-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/216-19-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/224-256-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/396-208-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/400-168-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/744-271-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/816-174-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/876-340-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1148-241-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1192-87-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1320-185-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1352-53-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1368-339-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1376-142-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1384-394-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1504-92-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1620-267-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1680-171-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1688-255-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1772-3392-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1800-293-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1872-372-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1940-123-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1968-196-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2052-406-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2140-320-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2212-227-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2316-234-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2360-257-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2464-500-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2508-370-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2540-499-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2564-268-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2668-354-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2688-310-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2696-112-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2760-29-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2792-13-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2896-432-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2964-422-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3012-3660-0x00007FFB346A0000-0x00007FFB346F9000-memory.dmp

Filesize
356KB

Download
memory/3012-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3020-423-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3068-407-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3196-213-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3212-269-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3288-346-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3368-220-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3440-498-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3480-302-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3524-430-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3528-173-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3532-332-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3560-371-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3700-143-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3756-46-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3768-345-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3796-408-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3824-60-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3864-83-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3952-292-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4020-6-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4080-172-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4180-452-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4216-270-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4228-316-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4344-93-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4352-139-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4552-496-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4612-327-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4728-395-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4816-421-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4820-445-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4848-101-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4900-35-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4916-369-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4944-229-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4948-121-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4964-382-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4976-380-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5032-440-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5188-501-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5200-510-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5208-511-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5240-539-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5288-541-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5300-543-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5320-580-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5344-647-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5356-648-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5368-649-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5376-650-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5408-651-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5524-652-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5892-653-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5960-654-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5992-655-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/6000-656-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/6040-3148-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/6212-2320-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/7320-2900-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/9436-2815-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/14152-2841-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/14356-2491-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/14372-2847-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/14608-2902-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/14676-2670-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/15220-3407-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/15352-2899-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/15612-3805-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/15740-3782-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/15800-3804-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/15988-3874-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/16032-3882-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/16252-3681-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads