90638c4ed09f8bce6e2657ec37a62e1d26661c99e4d5dd7a8b294dd6479eb99a

Analysis

max time kernel
150s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
25-09-2024 23:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

90638c4ed09f8bce6e2657ec37a62e1d26661c99e4d5dd7a8b294dd6479eb99a.exe
Size

468KB
MD5

f690bae5ef57348f4fe4cc7c86319d24
SHA1

b77cfde044c023432a2259367adbe7c72608342b
SHA256

90638c4ed09f8bce6e2657ec37a62e1d26661c99e4d5dd7a8b294dd6479eb99a
SHA512

cb80ceb62b18f6a736591d9f4cf038c18d297a32ee1bf538bd8928e29154bb8dc921943ea026a4dac1fa5db6abed5924286643ae84feedc3757d6bf24a9b467a
SSDEEP

3072:ibzoogIdId5UtbYHPztjcf8/sCtvP3pkhmHegVhXRov8cE2uGslz:ibcowbUtoPJjcfyZ0yRokF2uG

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
1496	Unicorn-1378.exe
2752	Unicorn-18675.exe
2156	Unicorn-23313.exe
2656	Unicorn-9676.exe
3176	Unicorn-9676.exe
3716	Unicorn-40957.exe
1684	Unicorn-58777.exe
1892	Unicorn-7320.exe
1524	Unicorn-7320.exe
1708	Unicorn-57076.exe
2488	Unicorn-42685.exe
1372	Unicorn-1098.exe
4188	Unicorn-1098.exe
2864	Unicorn-48253.exe
2896	Unicorn-54118.exe
388	Unicorn-59427.exe
3172	Unicorn-49697.exe
2284	Unicorn-52390.exe
1452	Unicorn-35307.exe
4884	Unicorn-29176.exe
4384	Unicorn-35307.exe
2540	Unicorn-57865.exe
4136	Unicorn-31969.exe
4436	Unicorn-42905.exe
2304	Unicorn-35307.exe
1280	Unicorn-35307.exe
3084	Unicorn-61949.exe
2876	Unicorn-51570.exe
4996	Unicorn-45705.exe
2388	Unicorn-31969.exe
4412	Unicorn-31969.exe
2452	Unicorn-28291.exe
4616	Unicorn-22261.exe
2688	Unicorn-55680.exe
2948	Unicorn-14092.exe
3296	Unicorn-18731.exe
2768	Unicorn-32466.exe
4872	Unicorn-45203.exe
1220	Unicorn-30050.exe
4428	Unicorn-55125.exe
4824	Unicorn-8062.exe
1964	Unicorn-8617.exe
1836	Unicorn-28483.exe
3288	Unicorn-18268.exe
644	Unicorn-18369.exe
3228	Unicorn-18369.exe
1688	Unicorn-40927.exe
2040	Unicorn-65431.exe
3484	Unicorn-37397.exe
4856	Unicorn-30621.exe
2060	Unicorn-57263.exe
1228	Unicorn-56998.exe
2120	Unicorn-30235.exe
4720	Unicorn-23583.exe
1876	Unicorn-37319.exe
3916	Unicorn-55436.exe
1660	Unicorn-55701.exe
4480	Unicorn-49571.exe
1188	Unicorn-854.exe
2612	Unicorn-48280.exe
3552	Unicorn-31288.exe
4976	Unicorn-2608.exe
2312	Unicorn-2608.exe
2396	Unicorn-10968.exe

Program crash 9 IoCs

pid	pid_target	Process	procid_target
5764	1700	WerFault.exe	164
7524	15220	WerFault.exe	824
7760	16124	WerFault.exe	804
8364	16948	WerFault.exe	881
9568	17180	WerFault.exe	920
5616	18012	WerFault.exe	954
9228	3284	WerFault.exe	626
13132	16516	WerFault.exe	918
10028	10768	Process not Found	539

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28229.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23087.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59820.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18847.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39861.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23333.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15279.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61949.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15592.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13620.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27129.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48575.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46222.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34714.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47755.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19411.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2240.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24367.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22372.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46075.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29947.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62826.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53943.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57663.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30829.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14253.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42138.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32697.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56189.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3027.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11523.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55333.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34357.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20836.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1098.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21820.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12805.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35083.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55952.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2608.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18041.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58327.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5310.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26261.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47807.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8035.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58109.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63349.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55592.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33769.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28218.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32023.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28037.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15348.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24367.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63399.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45390.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-963.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13267.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27928.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11411.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18268.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47165.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe

Modifies data under HKEY_USERS 16 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	18172	dwm.exe
Token: SeChangeNotifyPrivilege	18172	dwm.exe
Token: 33	18172	dwm.exe
Token: SeIncBasePriorityPrivilege	18172	dwm.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
3312	90638c4ed09f8bce6e2657ec37a62e1d26661c99e4d5dd7a8b294dd6479eb99a.exe
1496	Unicorn-1378.exe
2752	Unicorn-18675.exe
2156	Unicorn-23313.exe
3176	Unicorn-9676.exe
2656	Unicorn-9676.exe
3716	Unicorn-40957.exe
1684	Unicorn-58777.exe
1524	Unicorn-7320.exe
1892	Unicorn-7320.exe
1708	Unicorn-57076.exe
1372	Unicorn-1098.exe
2864	Unicorn-48253.exe
2488	Unicorn-42685.exe
4188	Unicorn-1098.exe
2896	Unicorn-54118.exe
388	Unicorn-59427.exe
3172	Unicorn-49697.exe
2284	Unicorn-52390.exe
1452	Unicorn-35307.exe
2876	Unicorn-51570.exe
2540	Unicorn-57865.exe
4436	Unicorn-42905.exe
4136	Unicorn-31969.exe
4384	Unicorn-35307.exe
4884	Unicorn-29176.exe
4996	Unicorn-45705.exe
3084	Unicorn-61949.exe
1280	Unicorn-35307.exe
4412	Unicorn-31969.exe
2388	Unicorn-31969.exe
2304	Unicorn-35307.exe
2452	Unicorn-28291.exe
4616	Unicorn-22261.exe
2688	Unicorn-55680.exe
2948	Unicorn-14092.exe
3296	Unicorn-18731.exe
2768	Unicorn-32466.exe
4872	Unicorn-45203.exe
1220	Unicorn-30050.exe
4428	Unicorn-55125.exe
4824	Unicorn-8062.exe
1836	Unicorn-28483.exe
1964	Unicorn-8617.exe
3288	Unicorn-18268.exe
3228	Unicorn-18369.exe
644	Unicorn-18369.exe
1688	Unicorn-40927.exe
3484	Unicorn-37397.exe
2040	Unicorn-65431.exe
4856	Unicorn-30621.exe
2060	Unicorn-57263.exe
1228	Unicorn-56998.exe
2120	Unicorn-30235.exe
1660	Unicorn-55701.exe
4720	Unicorn-23583.exe
1876	Unicorn-37319.exe
4480	Unicorn-49571.exe
3916	Unicorn-55436.exe
1188	Unicorn-854.exe
2612	Unicorn-48280.exe
4976	Unicorn-2608.exe
3552	Unicorn-31288.exe
2312	Unicorn-2608.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3312 wrote to memory of 1496	3312	90638c4ed09f8bce6e2657ec37a62e1d26661c99e4d5dd7a8b294dd6479eb99a.exe	84
PID 3312 wrote to memory of 1496	3312	90638c4ed09f8bce6e2657ec37a62e1d26661c99e4d5dd7a8b294dd6479eb99a.exe	84
PID 3312 wrote to memory of 1496	3312	90638c4ed09f8bce6e2657ec37a62e1d26661c99e4d5dd7a8b294dd6479eb99a.exe	84
PID 1496 wrote to memory of 2752	1496	Unicorn-1378.exe	87
PID 1496 wrote to memory of 2752	1496	Unicorn-1378.exe	87
PID 1496 wrote to memory of 2752	1496	Unicorn-1378.exe	87
PID 3312 wrote to memory of 2156	3312	90638c4ed09f8bce6e2657ec37a62e1d26661c99e4d5dd7a8b294dd6479eb99a.exe	88
PID 3312 wrote to memory of 2156	3312	90638c4ed09f8bce6e2657ec37a62e1d26661c99e4d5dd7a8b294dd6479eb99a.exe	88
PID 3312 wrote to memory of 2156	3312	90638c4ed09f8bce6e2657ec37a62e1d26661c99e4d5dd7a8b294dd6479eb99a.exe	88
PID 2156 wrote to memory of 2656	2156	Unicorn-23313.exe	92
PID 2156 wrote to memory of 2656	2156	Unicorn-23313.exe	92
PID 2156 wrote to memory of 2656	2156	Unicorn-23313.exe	92
PID 2752 wrote to memory of 3176	2752	Unicorn-18675.exe	91
PID 2752 wrote to memory of 3176	2752	Unicorn-18675.exe	91
PID 2752 wrote to memory of 3176	2752	Unicorn-18675.exe	91
PID 1496 wrote to memory of 3716	1496	Unicorn-1378.exe	93
PID 1496 wrote to memory of 3716	1496	Unicorn-1378.exe	93
PID 1496 wrote to memory of 3716	1496	Unicorn-1378.exe	93
PID 3312 wrote to memory of 1684	3312	90638c4ed09f8bce6e2657ec37a62e1d26661c99e4d5dd7a8b294dd6479eb99a.exe	94
PID 3312 wrote to memory of 1684	3312	90638c4ed09f8bce6e2657ec37a62e1d26661c99e4d5dd7a8b294dd6479eb99a.exe	94
PID 3312 wrote to memory of 1684	3312	90638c4ed09f8bce6e2657ec37a62e1d26661c99e4d5dd7a8b294dd6479eb99a.exe	94
PID 2656 wrote to memory of 1892	2656	Unicorn-9676.exe	96
PID 2656 wrote to memory of 1892	2656	Unicorn-9676.exe	96
PID 2656 wrote to memory of 1892	2656	Unicorn-9676.exe	96
PID 3176 wrote to memory of 1524	3176	Unicorn-9676.exe	97
PID 3176 wrote to memory of 1524	3176	Unicorn-9676.exe	97
PID 3176 wrote to memory of 1524	3176	Unicorn-9676.exe	97
PID 2156 wrote to memory of 1708	2156	Unicorn-23313.exe	98
PID 2156 wrote to memory of 1708	2156	Unicorn-23313.exe	98
PID 2156 wrote to memory of 1708	2156	Unicorn-23313.exe	98
PID 2752 wrote to memory of 2488	2752	Unicorn-18675.exe	99
PID 2752 wrote to memory of 2488	2752	Unicorn-18675.exe	99
PID 2752 wrote to memory of 2488	2752	Unicorn-18675.exe	99
PID 1684 wrote to memory of 1372	1684	Unicorn-58777.exe	101
PID 3716 wrote to memory of 4188	3716	Unicorn-40957.exe	100
PID 1684 wrote to memory of 1372	1684	Unicorn-58777.exe	101
PID 1684 wrote to memory of 1372	1684	Unicorn-58777.exe	101
PID 3716 wrote to memory of 4188	3716	Unicorn-40957.exe	100
PID 3716 wrote to memory of 4188	3716	Unicorn-40957.exe	100
PID 1496 wrote to memory of 2864	1496	Unicorn-1378.exe	103
PID 1496 wrote to memory of 2864	1496	Unicorn-1378.exe	103
PID 1496 wrote to memory of 2864	1496	Unicorn-1378.exe	103
PID 3312 wrote to memory of 2896	3312	90638c4ed09f8bce6e2657ec37a62e1d26661c99e4d5dd7a8b294dd6479eb99a.exe	104
PID 3312 wrote to memory of 2896	3312	90638c4ed09f8bce6e2657ec37a62e1d26661c99e4d5dd7a8b294dd6479eb99a.exe	104
PID 3312 wrote to memory of 2896	3312	90638c4ed09f8bce6e2657ec37a62e1d26661c99e4d5dd7a8b294dd6479eb99a.exe	104
PID 1708 wrote to memory of 388	1708	Unicorn-57076.exe	106
PID 1708 wrote to memory of 388	1708	Unicorn-57076.exe	106
PID 1708 wrote to memory of 388	1708	Unicorn-57076.exe	106
PID 1892 wrote to memory of 3172	1892	Unicorn-7320.exe	107
PID 1892 wrote to memory of 3172	1892	Unicorn-7320.exe	107
PID 1892 wrote to memory of 3172	1892	Unicorn-7320.exe	107
PID 2656 wrote to memory of 2284	2656	Unicorn-9676.exe	108
PID 2656 wrote to memory of 2284	2656	Unicorn-9676.exe	108
PID 2656 wrote to memory of 2284	2656	Unicorn-9676.exe	108
PID 2864 wrote to memory of 1452	2864	Unicorn-48253.exe	110
PID 2864 wrote to memory of 1452	2864	Unicorn-48253.exe	110
PID 2864 wrote to memory of 1452	2864	Unicorn-48253.exe	110
PID 1372 wrote to memory of 4384	1372	Unicorn-1098.exe	111
PID 1372 wrote to memory of 4384	1372	Unicorn-1098.exe	111
PID 1372 wrote to memory of 4384	1372	Unicorn-1098.exe	111
PID 2156 wrote to memory of 4884	2156	Unicorn-23313.exe	109
PID 2156 wrote to memory of 4884	2156	Unicorn-23313.exe	109
PID 2156 wrote to memory of 4884	2156	Unicorn-23313.exe	109
PID 1524 wrote to memory of 2540	1524	Unicorn-7320.exe	114

C:\Users\Admin\AppData\Local\Temp\90638c4ed09f8bce6e2657ec37a62e1d26661c99e4d5dd7a8b294dd6479eb99a.exe
"C:\Users\Admin\AppData\Local\Temp\90638c4ed09f8bce6e2657ec37a62e1d26661c99e4d5dd7a8b294dd6479eb99a.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3312
- C:\Users\Admin\AppData\Local\Temp\Unicorn-1378.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-1378.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1496
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18675.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18675.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9676.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9676.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7320.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57865.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26261.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38125.exe
        8⤵
        
        PID:5976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54025.exe
        9⤵
        
        PID:7740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3880.exe
        10⤵
        
        PID:14440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2643.exe
        11⤵
        
        PID:13392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44137.exe
        10⤵
        
        PID:18740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10911.exe
        9⤵
        
        PID:12628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25967.exe
        9⤵
        
        PID:19076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35083.exe
        8⤵
        
        PID:8636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52789.exe
        8⤵
        
        PID:14132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23333.exe
        8⤵
        
        PID:15260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33146.exe
        7⤵
        
        PID:6960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31213.exe
        8⤵
        
        PID:9336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22895.exe
        8⤵
        
        PID:16316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62826.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:11188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61697.exe
        7⤵
        
        PID:16864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26182.exe
        6⤵
        
        PID:4068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38125.exe
        7⤵
        
        PID:5724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46267.exe
        8⤵
        
        PID:8044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25202.exe
        9⤵
        
        PID:9516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57206.exe
        8⤵
        
        PID:11308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25611.exe
        8⤵
        
        PID:2720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8503.exe
        7⤵
        
        PID:7528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21564.exe
        8⤵
        
        PID:18892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36515.exe
        7⤵
        
        PID:1948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50307.exe
        7⤵
        
        PID:19016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39012.exe
        6⤵
        
        PID:6944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6324.exe
        7⤵
        
        PID:9716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10849.exe
        7⤵
        
        PID:13992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32023.exe
        7⤵
        
        PID:17544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59999.exe
        6⤵
        
        PID:10612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55628.exe
        6⤵
        
        PID:2536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31969.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26261.exe
        6⤵
        
        PID:4044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13620.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15733.exe
        8⤵
        
        PID:7928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27487.exe
        9⤵
        
        PID:10972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42792.exe
        9⤵
        
        PID:17772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24013.exe
        9⤵
        
        PID:18784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18616.exe
        8⤵
        
        PID:12616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41973.exe
        8⤵
        
        PID:18012
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 18012 -s 464
        9⤵
        Program crash
        
        PID:5616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15109.exe
        7⤵
        
        PID:8236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24344.exe
        8⤵
        
        PID:4140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62994.exe
        8⤵
        
        PID:6572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30484.exe
        7⤵
        
        PID:2816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37838.exe
        8⤵
        
        PID:10812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37313.exe
        7⤵
        
        PID:16916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47537.exe
        6⤵
        
        PID:6420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57855.exe
        7⤵
        
        PID:10060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7149.exe
        7⤵
        
        PID:14612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56554.exe
        7⤵
        
        PID:3028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58742.exe
        6⤵
        
        PID:11124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45394.exe
        6⤵
        
        PID:11628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37319.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64985.exe
        6⤵
        
        PID:3216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26641.exe
        7⤵
        
        PID:6788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37051.exe
        8⤵
        
        PID:9700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57720.exe
        8⤵
        
        PID:14340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10835.exe
        8⤵
        
        PID:16752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32074.exe
        7⤵
        
        PID:12536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23167.exe
        7⤵
        
        PID:18884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15877.exe
        7⤵
        
        PID:17264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7927.exe
        6⤵
        
        PID:5668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60635.exe
        6⤵
        
        PID:12040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31833.exe
        6⤵
        
        PID:18872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18041.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29163.exe
        6⤵
        
        PID:6740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61939.exe
        7⤵
        
        PID:10160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8697.exe
        7⤵
        
        PID:15576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21243.exe
        6⤵
        
        PID:9244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33769.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:14784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3628.exe
        6⤵
        
        PID:16812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21384.exe
        5⤵
        
        PID:7376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2724.exe
        5⤵
        
        PID:13052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57231.exe
        5⤵
        
        PID:16620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42685.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42685.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35307.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18369.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28229.exe
        7⤵
        
        PID:1400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62245.exe
        8⤵
        
        PID:5960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34207.exe
        9⤵
        
        PID:7920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43007.exe
        9⤵
        
        PID:11856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19387.exe
        9⤵
        
        PID:17680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23277.exe
        8⤵
        
        PID:7512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64144.exe
        8⤵
        
        PID:12156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12695.exe
        8⤵
        
        PID:17448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28949.exe
        7⤵
        
        PID:6496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15130.exe
        8⤵
        
        PID:9180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-889.exe
        9⤵
        
        PID:13440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53698.exe
        8⤵
        
        PID:12876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55952.exe
        8⤵
        
        PID:17160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63401.exe
        7⤵
        
        PID:8852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24344.exe
        8⤵
        
        PID:1848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47772.exe
        7⤵
        
        PID:13952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-410.exe
        7⤵
        
        PID:888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47642.exe
        6⤵
        
        PID:5288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47637.exe
        7⤵
        
        PID:6700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47807.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:10588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33229.exe
        8⤵
        
        PID:4080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36131.exe
        7⤵
        
        PID:10228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24869.exe
        7⤵
        
        PID:16492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65217.exe
        6⤵
        
        PID:7292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64480.exe
        7⤵
        
        PID:7824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25468.exe
        6⤵
        
        PID:12188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39338.exe
        6⤵
        
        PID:17596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37397.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9562.exe
        6⤵
        
        PID:5084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23735.exe
        7⤵
        
        PID:5144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62603.exe
        8⤵
        
        PID:6408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37708.exe
        9⤵
        
        PID:11268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43007.exe
        8⤵
        
        PID:11912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29467.exe
        8⤵
        
        PID:6148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27917.exe
        8⤵
        
        PID:11276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36297.exe
        7⤵
        
        PID:7848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41597.exe
        8⤵
        
        PID:15080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13628.exe
        8⤵
        
        PID:3620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63349.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:12812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2284.exe
        7⤵
        
        PID:18672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19411.exe
        6⤵
        
        PID:6928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4570.exe
        7⤵
        
        PID:10048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17467.exe
        7⤵
        
        PID:15256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3322.exe
        7⤵
        
        PID:6568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65129.exe
        6⤵
        
        PID:11076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12695.exe
        6⤵
        
        PID:17232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21906.exe
        5⤵
        
        PID:5172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15348.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30829.exe
        7⤵
        
        PID:9440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14549.exe
        7⤵
        
        PID:14248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23087.exe
        7⤵
        
        PID:16556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47423.exe
        6⤵
        
        PID:12124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20592.exe
        6⤵
        
        PID:16248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16235.exe
        5⤵
        
        PID:8212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27684.exe
        5⤵
        
        PID:10524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12112.exe
        5⤵
        
        PID:16956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45705.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45705.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28483.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34451.exe
        6⤵
        
        PID:2780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56189.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29947.exe
        8⤵
        
        PID:13808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9352.exe
        8⤵
        
        PID:16584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13267.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:12116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8697.exe
        7⤵
        
        PID:4520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37475.exe
        6⤵
        
        PID:7436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59199.exe
        7⤵
        
        PID:10940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24841.exe
        7⤵
        
        PID:15568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27578.exe
        6⤵
        
        PID:10604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37313.exe
        6⤵
        
        PID:16948
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 16948 -s 444
        7⤵
        Program crash
        
        PID:8364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8171.exe
        5⤵
        
        PID:5180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3096.exe
        6⤵
        
        PID:7184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10408.exe
        7⤵
        
        PID:9856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20387.exe
        7⤵
        
        PID:13672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55952.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:17100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41471.exe
        6⤵
        
        PID:11028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3027.exe
        7⤵
        
        PID:10908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52087.exe
        6⤵
        
        PID:17468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64349.exe
        6⤵
        
        PID:12644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63655.exe
        5⤵
        
        PID:8304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34458.exe
        6⤵
        
        PID:11620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57154.exe
        5⤵
        
        PID:12744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41642.exe
        5⤵
        
        PID:18972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56998.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56998.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28037.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29163.exe
        6⤵
        
        PID:6780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57855.exe
        7⤵
        
        PID:10132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4819.exe
        7⤵
        
        PID:14916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11629.exe
        7⤵
        
        PID:3184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39141.exe
        6⤵
        
        PID:11132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48194.exe
        6⤵
        
        PID:12276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10449.exe
        5⤵
        
        PID:7316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9057.exe
        6⤵
        
        PID:7804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6775.exe
        5⤵
        
        PID:12852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34651.exe
        5⤵
        
        PID:18696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9376.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9376.exe
      4⤵
      PID:5332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33823.exe
        5⤵
        
        PID:6284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57663.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29023.exe
        7⤵
        
        PID:12576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61049.exe
        7⤵
        
        PID:17476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57528.exe
        6⤵
        
        PID:14300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17467.exe
        6⤵
        
        PID:13160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19899.exe
        5⤵
        
        PID:9764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41305.exe
        5⤵
        
        PID:14728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41284.exe
        5⤵
        
        PID:17756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9509.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9509.exe
      4⤵
      PID:8224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36208.exe
        5⤵
        
        PID:17764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48918.exe
        5⤵
        
        PID:12520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28215.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28215.exe
      4⤵
      PID:10756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52571.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52571.exe
      4⤵
      PID:16704
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40957.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40957.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1098.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1098.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:4188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61949.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55701.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32697.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45115.exe
        8⤵
        
        PID:6644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6324.exe
        9⤵
        
        PID:9692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6446.exe
        10⤵
        
        PID:15616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34777.exe
        9⤵
        
        PID:13108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17467.exe
        9⤵
        
        PID:13524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24367.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:10548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39067.exe
        8⤵
        
        PID:16224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7927.exe
        7⤵
        
        PID:7632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2362.exe
        8⤵
        
        PID:15548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26961.exe
        8⤵
        
        PID:14428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6775.exe
        7⤵
        
        PID:3284
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3284 -s 608
        8⤵
        Program crash
        
        PID:9228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38762.exe
        7⤵
        
        PID:16656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19053.exe
        6⤵
        
        PID:5396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45115.exe
        7⤵
        
        PID:6636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8270.exe
        8⤵
        
        PID:9592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47030.exe
        8⤵
        
        PID:6472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17467.exe
        8⤵
        
        PID:14612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38133.exe
        8⤵
        
        PID:6384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39255.exe
        7⤵
        
        PID:12160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37838.exe
        8⤵
        
        PID:11204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39067.exe
        7⤵
        
        PID:16140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21662.exe
        6⤵
        
        PID:8184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64075.exe
        7⤵
        
        PID:10372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15816.exe
        6⤵
        
        PID:10900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25106.exe
        6⤵
        
        PID:19044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26182.exe
        5⤵
        
        PID:4012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5021.exe
        6⤵
        
        PID:7012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36475.exe
        7⤵
        
        PID:8544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18847.exe
        8⤵
        
        PID:14680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20836.exe
        8⤵
        
        PID:15492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24013.exe
        8⤵
        
        PID:12524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42383.exe
        7⤵
        
        PID:1112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27412.exe
        6⤵
        
        PID:9948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26750.exe
        6⤵
        
        PID:14588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8637.exe
        6⤵
        
        PID:12268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39012.exe
        5⤵
        
        PID:6936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20475.exe
        6⤵
        
        PID:9896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55403.exe
        6⤵
        
        PID:1516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30834.exe
        5⤵
        
        PID:9964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21969.exe
        5⤵
        
        PID:14736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56806.exe
        5⤵
        
        PID:13676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1376.exe
        5⤵
        
        PID:2712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31969.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31969.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40927.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28229.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26641.exe
        7⤵
        
        PID:6660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48727.exe
        8⤵
        
        PID:8436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28171.exe
        8⤵
        
        PID:13972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19003.exe
        8⤵
        
        PID:16484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48488.exe
        7⤵
        
        PID:9968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20884.exe
        7⤵
        
        PID:14620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58143.exe
        7⤵
        
        PID:15224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29467.exe
        7⤵
        
        PID:4760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7927.exe
        6⤵
        
        PID:6204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46245.exe
        6⤵
        
        PID:12092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43727.exe
        6⤵
        
        PID:17696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45966.exe
        6⤵
        
        PID:5932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8171.exe
        5⤵
        
        PID:5188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45115.exe
        6⤵
        
        PID:6624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2603.exe
        7⤵
        
        PID:8976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41907.exe
        7⤵
        
        PID:13932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61817.exe
        7⤵
        
        PID:17204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35083.exe
        6⤵
        
        PID:8616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7111.exe
        7⤵
        
        PID:10700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5726.exe
        6⤵
        
        PID:14324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23333.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21662.exe
        5⤵
        
        PID:8168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57741.exe
        6⤵
        
        PID:14760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24344.exe
        6⤵
        
        PID:13820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-963.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53152.exe
        5⤵
        
        PID:17084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49571.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49571.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34403.exe
        5⤵
        
        PID:5208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50351.exe
        6⤵
        
        PID:3796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60673.exe
        7⤵
        
        PID:13684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42216.exe
        7⤵
        
        PID:17072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53506.exe
        6⤵
        
        PID:10724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44442.exe
        6⤵
        
        PID:18984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45236.exe
        6⤵
        
        PID:18800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64423.exe
        5⤵
        
        PID:7968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48986.exe
        5⤵
        
        PID:12796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41642.exe
        5⤵
        
        PID:18992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30486.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30486.exe
      4⤵
      PID:5444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3096.exe
        5⤵
        
        PID:6852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12328.exe
        6⤵
        
        PID:11768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63239.exe
        6⤵
        
        PID:14876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13267.exe
        5⤵
        
        PID:12100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27532.exe
        6⤵
        
        PID:10824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59652.exe
        5⤵
        
        PID:3744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60855.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60855.exe
      4⤵
      PID:8272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16752.exe
        5⤵
        
        PID:15524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24013.exe
        5⤵
        
        PID:12604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15233.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15233.exe
      4⤵
      PID:12328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20817.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20817.exe
      4⤵
      PID:16644
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48253.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48253.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35307.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35307.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55125.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37959.exe
        6⤵
        
        PID:1436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38125.exe
        7⤵
        
        PID:5880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17490.exe
        8⤵
        
        PID:9484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12359.exe
        8⤵
        
        PID:14712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23027.exe
        8⤵
        
        PID:3516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35083.exe
        7⤵
        
        PID:7916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3027.exe
        8⤵
        
        PID:9576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5726.exe
        7⤵
        
        PID:14264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43945.exe
        7⤵
        
        PID:14992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19411.exe
        6⤵
        
        PID:6952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37051.exe
        7⤵
        
        PID:10020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7149.exe
        7⤵
        
        PID:14632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50332.exe
        7⤵
        
        PID:4324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38133.exe
        7⤵
        
        PID:7064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27988.exe
        6⤵
        
        PID:10620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5897.exe
        6⤵
        
        PID:448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14009.exe
        5⤵
        
        PID:5028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23735.exe
        6⤵
        
        PID:5732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64549.exe
        7⤵
        
        PID:8020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35567.exe
        8⤵
        
        PID:15140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45917.exe
        8⤵
        
        PID:16328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8197.exe
        7⤵
        
        PID:11796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38133.exe
        7⤵
        
        PID:7008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8503.exe
        6⤵
        
        PID:7556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56888.exe
        7⤵
        
        PID:13140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16313.exe
        6⤵
        
        PID:12804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47506.exe
        6⤵
        
        PID:17152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18756.exe
        5⤵
        
        PID:7052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54181.exe
        6⤵
        
        PID:9168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41688.exe
        7⤵
        
        PID:4820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42213.exe
        6⤵
        
        PID:12892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10835.exe
        6⤵
        
        PID:16764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55068.exe
        5⤵
        
        PID:9488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29286.exe
        6⤵
        
        PID:10296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57965.exe
        5⤵
        
        PID:13648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54899.exe
        5⤵
        
        PID:4592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8617.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8617.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34451.exe
        5⤵
        
        PID:1952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47637.exe
        6⤵
        
        PID:6748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47165.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:9632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12795.exe
        7⤵
        
        PID:14232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14919.exe
        7⤵
        
        PID:16848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36619.exe
        6⤵
        
        PID:10392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47235.exe
        6⤵
        
        PID:16276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20755.exe
        5⤵
        
        PID:7352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64075.exe
        6⤵
        
        PID:12496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5788.exe
        5⤵
        
        PID:10468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47427.exe
        5⤵
        
        PID:16668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44465.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44465.exe
      4⤵
      PID:5212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8742.exe
        5⤵
        
        PID:6880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39189.exe
        6⤵
        
        PID:8968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57528.exe
        6⤵
        
        PID:14284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25827.exe
        6⤵
        
        PID:2824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9593.exe
        5⤵
        
        PID:10004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20884.exe
        5⤵
        
        PID:14596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17494.exe
        5⤵
        
        PID:8796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62338.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62338.exe
      4⤵
      PID:8176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34458.exe
        5⤵
        
        PID:3456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32382.exe
        5⤵
        
        PID:3148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53751.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53751.exe
      4⤵
      PID:12016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65205.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65205.exe
      4⤵
      PID:16464
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51570.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51570.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45203.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45203.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15592.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51363.exe
        6⤵
        
        PID:5204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-382.exe
        7⤵
        
        PID:6864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37051.exe
        8⤵
        
        PID:9800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63239.exe
        9⤵
        
        PID:2140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64134.exe
        8⤵
        
        PID:14036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19003.exe
        8⤵
        
        PID:16520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14253.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:10676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52881.exe
        7⤵
        
        PID:16148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20755.exe
        6⤵
        
        PID:7104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49827.exe
        7⤵
        
        PID:13548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42216.exe
        7⤵
        
        PID:17036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57271.exe
        7⤵
        
        PID:2516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10859.exe
        6⤵
        
        PID:12600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12695.exe
        6⤵
        
        PID:18060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50548.exe
        5⤵
        
        PID:5520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9510.exe
        6⤵
        
        PID:7700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4736.exe
        7⤵
        
        PID:11932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50987.exe
        7⤵
        
        PID:14720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55358.exe
        7⤵
        
        PID:11332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55592.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:13072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53152.exe
        6⤵
        
        PID:17024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54911.exe
        5⤵
        
        PID:7196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2194.exe
        5⤵
        
        PID:10460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17475.exe
        5⤵
        
        PID:16544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9339.exe
        5⤵
        
        PID:6804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54850.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54850.exe
      4⤵
      PID:1780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49801.exe
        5⤵
        
        PID:5128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10688.exe
        6⤵
        
        PID:6272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26745.exe
        7⤵
        
        PID:9468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52881.exe
        7⤵
        
        PID:16076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38757.exe
        6⤵
        
        PID:10032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39067.exe
        6⤵
        
        PID:16116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7927.exe
        5⤵
        
        PID:8064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3027.exe
        6⤵
        
        PID:10832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21932.exe
        5⤵
        
        PID:11776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21360.exe
        5⤵
        
        PID:17504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64283.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64283.exe
      4⤵
      PID:5384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14772.exe
        5⤵
        
        PID:6220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39381.exe
        6⤵
        
        PID:10040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3027.exe
        7⤵
        
        PID:9916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38080.exe
        6⤵
        
        PID:14076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3322.exe
        6⤵
        
        PID:6580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20667.exe
        5⤵
        
        PID:11092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13292.exe
        5⤵
        
        PID:13676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61817.exe
        5⤵
        
        PID:17212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54170.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54170.exe
      4⤵
      PID:3124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15234.exe
        5⤵
        
        PID:10768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60499.exe
        5⤵
        
        PID:752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47529.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47529.exe
      4⤵
      PID:12140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61697.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61697.exe
      4⤵
      PID:5000
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30050.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30050.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31737.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31737.exe
      4⤵
      PID:1284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49801.exe
        5⤵
        
        PID:5136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23325.exe
        6⤵
        
        PID:7684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40725.exe
        7⤵
        
        PID:10964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62956.exe
        7⤵
        
        PID:14980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63300.exe
        7⤵
        
        PID:16880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13267.exe
        6⤵
        
        PID:12084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47016.exe
        6⤵
        
        PID:16180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45260.exe
        5⤵
        
        PID:7396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6775.exe
        5⤵
        
        PID:9060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12119.exe
        5⤵
        
        PID:16816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65435.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65435.exe
      4⤵
      PID:6356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40621.exe
        5⤵
        
        PID:6992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4736.exe
        6⤵
        
        PID:11916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34458.exe
        6⤵
        
        PID:11648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24013.exe
        6⤵
        
        PID:11172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5867.exe
        5⤵
        
        PID:12204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44442.exe
        5⤵
        
        PID:19024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57076.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57076.exe
      4⤵
      PID:7284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48144.exe
        5⤵
        
        PID:10672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2988.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2988.exe
      4⤵
      PID:10388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12112.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12112.exe
      4⤵
      PID:16932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59883.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59883.exe
      4⤵
      PID:12728
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41081.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41081.exe
    3⤵
    PID:1700
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1700 -s 720
      4⤵
      Program crash
      PID:5764
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62013.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62013.exe
    3⤵
    PID:5420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24887.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24887.exe
      4⤵
      PID:7028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47165.exe
        5⤵
        
        PID:9640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12795.exe
        5⤵
        
        PID:14208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31447.exe
        5⤵
        
        PID:17968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24367.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24367.exe
      4⤵
      PID:10560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55403.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55403.exe
      4⤵
      PID:4420
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63399.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63399.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:8104
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27607.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27607.exe
    3⤵
    PID:11884
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52012.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52012.exe
    3⤵
    PID:16516
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 16516 -s 580
      4⤵
      Program crash
      PID:13132
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12812.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12812.exe
    3⤵
    PID:17920
- C:\Users\Admin\AppData\Local\Temp\Unicorn-23313.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-23313.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2156
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9676.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9676.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7320.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7320.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49697.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22261.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2608.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59484.exe
        8⤵
        
        PID:5904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53287.exe
        9⤵
        
        PID:8640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27928.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:14108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8829.exe
        9⤵
        
        PID:11588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22238.exe
        8⤵
        
        PID:7532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29947.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:13696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22372.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:17180
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 17180 -s 464
        10⤵
        Program crash
        
        PID:9568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2194.exe
        8⤵
        
        PID:10936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36616.exe
        8⤵
        
        PID:16988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58140.exe
        7⤵
        
        PID:6128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4850.exe
        8⤵
        
        PID:7344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22661.exe
        9⤵
        
        PID:9812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7149.exe
        9⤵
        
        PID:14580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40026.exe
        9⤵
        
        PID:15124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38133.exe
        9⤵
        
        PID:6432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38822.exe
        9⤵
        
        PID:16732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20972.exe
        8⤵
        
        PID:12212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46223.exe
        8⤵
        
        PID:18776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63655.exe
        7⤵
        
        PID:8312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18847.exe
        8⤵
        
        PID:15028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61958.exe
        9⤵
        
        PID:13364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16508.exe
        8⤵
        
        PID:19184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38104.exe
        7⤵
        
        PID:12448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59156.exe
        7⤵
        
        PID:18664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56640.exe
        6⤵
        
        PID:4164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14175.exe
        7⤵
        
        PID:5368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45857.exe
        8⤵
        
        PID:8904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2362.exe
        9⤵
        
        PID:15480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10911.exe
        8⤵
        
        PID:12620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44442.exe
        8⤵
        
        PID:19000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28590.exe
        7⤵
        
        PID:8820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27928.exe
        7⤵
        
        PID:14096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14667.exe
        7⤵
        
        PID:15236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34357.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:11232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47755.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58327.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27129.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:10096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38080.exe
        8⤵
        
        PID:4600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47807.exe
        7⤵
        
        PID:11040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2502.exe
        7⤵
        
        PID:16868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46962.exe
        6⤵
        
        PID:8160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24344.exe
        7⤵
        
        PID:14624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62994.exe
        7⤵
        
        PID:6312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53187.exe
        7⤵
        
        PID:17072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4133.exe
        6⤵
        
        PID:12976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39292.exe
        6⤵
        
        PID:16612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18731.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15052.exe
        6⤵
        
        PID:3068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63615.exe
        7⤵
        
        PID:6036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11264.exe
        8⤵
        
        PID:6212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30829.exe
        9⤵
        
        PID:9448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35316.exe
        10⤵
        
        PID:12544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57541.exe
        9⤵
        
        PID:15220
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 15220 -s 472
        10⤵
        Program crash
        
        PID:7524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32535.exe
        8⤵
        
        PID:10356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61049.exe
        8⤵
        
        PID:16204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37475.exe
        7⤵
        
        PID:8096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63541.exe
        7⤵
        
        PID:12580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50307.exe
        7⤵
        
        PID:18956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64746.exe
        6⤵
        
        PID:5160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37907.exe
        7⤵
        
        PID:6332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16775.exe
        8⤵
        
        PID:10864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14562.exe
        8⤵
        
        PID:4900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10745.exe
        7⤵
        
        PID:11044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49757.exe
        7⤵
        
        PID:17716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63655.exe
        6⤵
        
        PID:8264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40434.exe
        6⤵
        
        PID:12320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53152.exe
        6⤵
        
        PID:17016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33426.exe
        5⤵
        
        PID:2552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32889.exe
        6⤵
        
        PID:6052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29691.exe
        7⤵
        
        PID:8460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62489.exe
        8⤵
        
        PID:10336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20858.exe
        9⤵
        
        PID:1584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35627.exe
        9⤵
        
        PID:5736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42216.exe
        8⤵
        
        PID:17004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41175.exe
        7⤵
        
        PID:10464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52087.exe
        7⤵
        
        PID:404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37475.exe
        6⤵
        
        PID:7416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63541.exe
        6⤵
        
        PID:12588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3027.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:10836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60229.exe
        6⤵
        
        PID:18768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18809.exe
        5⤵
        
        PID:5148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20803.exe
        6⤵
        
        PID:6192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22661.exe
        7⤵
        
        PID:9820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49744.exe
        7⤵
        
        PID:14212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17057.exe
        7⤵
        
        PID:17292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49064.exe
        6⤵
        
        PID:10692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39067.exe
        6⤵
        
        PID:16132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53673.exe
        5⤵
        
        PID:8116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31099.exe
        6⤵
        
        PID:14696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40654.exe
        6⤵
        
        PID:17252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2597.exe
        5⤵
        
        PID:11808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18871.exe
        5⤵
        
        PID:17340
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52390.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52390.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14092.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39557.exe
        6⤵
        
        PID:4728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6246.exe
        7⤵
        
        PID:6012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-382.exe
        8⤵
        
        PID:6872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61939.exe
        9⤵
        
        PID:10124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17467.exe
        9⤵
        
        PID:824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43225.exe
        8⤵
        
        PID:11176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58500.exe
        8⤵
        
        PID:2300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45260.exe
        7⤵
        
        PID:7388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2362.exe
        8⤵
        
        PID:15500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6775.exe
        7⤵
        
        PID:12068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43422.exe
        7⤵
        
        PID:17992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7490.exe
        6⤵
        
        PID:5884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43911.exe
        7⤵
        
        PID:7984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35567.exe
        8⤵
        
        PID:14076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42216.exe
        8⤵
        
        PID:17368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37745.exe
        7⤵
        
        PID:12340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55952.exe
        7⤵
        
        PID:17220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54684.exe
        6⤵
        
        PID:8564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63803.exe
        6⤵
        
        PID:14080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59175.exe
        6⤵
        
        PID:17108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11523.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22583.exe
        6⤵
        
        PID:6064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-382.exe
        7⤵
        
        PID:6856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28883.exe
        8⤵
        
        PID:9756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25586.exe
        9⤵
        
        PID:13436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52881.exe
        8⤵
        
        PID:16068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64349.exe
        8⤵
        
        PID:12700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10169.exe
        7⤵
        
        PID:10760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47235.exe
        7⤵
        
        PID:16284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25876.exe
        6⤵
        
        PID:8540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57682.exe
        7⤵
        
        PID:9752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12805.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:13232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33307.exe
        6⤵
        
        PID:17260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5763.exe
        5⤵
        
        PID:6348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20201.exe
        6⤵
        
        PID:7568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55644.exe
        6⤵
        
        PID:12348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32023.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:17524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4062.exe
        5⤵
        
        PID:1700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20836.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:15508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48097.exe
        5⤵
        
        PID:12860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45898.exe
        5⤵
        
        PID:17748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32466.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32466.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10968.exe
        5⤵
        Executes dropped EXE
        
        PID:2396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4492.exe
        6⤵
        
        PID:5984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53667.exe
        7⤵
        
        PID:6340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37051.exe
        8⤵
        
        PID:9788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64134.exe
        8⤵
        
        PID:4964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23087.exe
        8⤵
        
        PID:16548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24367.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:10540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63904.exe
        8⤵
        
        PID:10580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61049.exe
        7⤵
        
        PID:16216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7927.exe
        6⤵
        
        PID:7648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6775.exe
        6⤵
        
        PID:13060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12695.exe
        6⤵
        
        PID:17440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37527.exe
        5⤵
        
        PID:6080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46075.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27129.exe
        7⤵
        
        PID:10152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48528.exe
        8⤵
        
        PID:14016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48194.exe
        7⤵
        
        PID:4560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47807.exe
        6⤵
        
        PID:10656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37313.exe
        6⤵
        
        PID:16888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10370.exe
        5⤵
        
        PID:8204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-697.exe
        6⤵
        
        PID:428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40434.exe
        5⤵
        
        PID:12308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-410.exe
        5⤵
        
        PID:4400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-143.exe
        5⤵
        
        PID:6708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39292.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39292.exe
      4⤵
      PID:3668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6246.exe
        5⤵
        
        PID:6020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3096.exe
        6⤵
        
        PID:5680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59609.exe
        7⤵
        
        PID:9728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34777.exe
        7⤵
        
        PID:13416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55952.exe
        7⤵
        
        PID:17064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40895.exe
        6⤵
        
        PID:10740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52881.exe
        6⤵
        
        PID:16084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49920.exe
        5⤵
        
        PID:8256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24747.exe
        6⤵
        
        PID:12136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64775.exe
        6⤵
        
        PID:17140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40599.exe
        5⤵
        
        PID:10480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16700.exe
        5⤵
        
        PID:16692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64349.exe
        5⤵
        
        PID:12528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26096.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26096.exe
      4⤵
      PID:4252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14772.exe
        5⤵
        
        PID:6276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39189.exe
        6⤵
        
        PID:9220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41922.exe
        7⤵
        
        PID:9892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57528.exe
        6⤵
        
        PID:14316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11411.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41804.exe
        5⤵
        
        PID:11984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43422.exe
        5⤵
        
        PID:18048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45881.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45881.exe
      4⤵
      PID:7300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42391.exe
        5⤵
        
        PID:13836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20618.exe
        5⤵
        
        PID:17740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53187.exe
        5⤵
        
        PID:13336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34245.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34245.exe
      4⤵
      PID:10752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16199.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16199.exe
      4⤵
      PID:17780
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57076.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57076.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59427.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59427.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28291.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-854.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36589.exe
        7⤵
        
        PID:5596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3096.exe
        8⤵
        
        PID:7176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12328.exe
        9⤵
        
        PID:11672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58403.exe
        10⤵
        
        PID:12028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37940.exe
        9⤵
        
        PID:16372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48575.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:12508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50307.exe
        8⤵
        
        PID:19008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49920.exe
        7⤵
        
        PID:8280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40599.exe
        7⤵
        
        PID:10440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21360.exe
        7⤵
        
        PID:16744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6417.exe
        6⤵
        
        PID:5656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3096.exe
        7⤵
        
        PID:6840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55333.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:9504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25160.exe
        8⤵
        
        PID:15260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39067.exe
        8⤵
        
        PID:16108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34786.exe
        7⤵
        
        PID:11300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39635.exe
        7⤵
        
        PID:15048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15279.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:10780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60500.exe
        7⤵
        
        PID:17168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63655.exe
        6⤵
        
        PID:8288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5310.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:17908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46464.exe
        6⤵
        
        PID:10492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20287.exe
        6⤵
        
        PID:16572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48280.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12660.exe
        6⤵
        
        PID:5964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3096.exe
        7⤵
        
        PID:7164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24799.exe
        8⤵
        
        PID:9744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10849.exe
        8⤵
        
        PID:13968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41562.exe
        8⤵
        
        PID:16736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6085.exe
        7⤵
        
        PID:10728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26239.exe
        7⤵
        
        PID:16012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49920.exe
        6⤵
        
        PID:8296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12624.exe
        7⤵
        
        PID:14816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10530.exe
        7⤵
        
        PID:1288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40599.exe
        6⤵
        
        PID:12720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61817.exe
        6⤵
        
        PID:17128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10422.exe
        5⤵
        
        PID:3740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24887.exe
        6⤵
        
        PID:7036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27129.exe
        7⤵
        
        PID:10144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17467.exe
        7⤵
        
        PID:2588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47807.exe
        6⤵
        
        PID:11284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21168.exe
        6⤵
        
        PID:17704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64284.exe
        5⤵
        
        PID:8012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2240.exe
        6⤵
        
        PID:9980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4831.exe
        6⤵
        
        PID:14860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38133.exe
        6⤵
        
        PID:6392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35302.exe
        5⤵
        
        PID:10568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55628.exe
        5⤵
        
        PID:16360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55680.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55680.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2608.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59484.exe
        6⤵
        
        PID:5856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14554.exe
        7⤵
        
        PID:8588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53657.exe
        8⤵
        
        PID:14804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19274.exe
        8⤵
        
        PID:16368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35415.exe
        7⤵
        
        PID:12652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11193.exe
        7⤵
        
        PID:18836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1372.exe
        6⤵
        
        PID:7244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39740.exe
        6⤵
        
        PID:1548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37527.exe
        5⤵
        
        PID:6088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59697.exe
        6⤵
        
        PID:7080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39957.exe
        7⤵
        
        PID:8524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23869.exe
        7⤵
        
        PID:13928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47976.exe
        7⤵
        
        PID:17484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47807.exe
        6⤵
        
        PID:11256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52087.exe
        6⤵
        
        PID:17460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56473.exe
        5⤵
        
        PID:6264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21502.exe
        6⤵
        
        PID:13456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62608.exe
        5⤵
        
        PID:11872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18341.exe
        5⤵
        
        PID:17392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15877.exe
        5⤵
        
        PID:12920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31288.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31288.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8834.exe
        5⤵
        
        PID:6772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57855.exe
        6⤵
        
        PID:10108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17467.exe
        6⤵
        
        PID:13788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38133.exe
        6⤵
        
        PID:6368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38822.exe
        6⤵
        
        PID:6804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12307.exe
        6⤵
        
        PID:6292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40844.exe
        5⤵
        
        PID:9276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30969.exe
        5⤵
        
        PID:14620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43964.exe
        5⤵
        
        PID:17044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57128.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57128.exe
      4⤵
      PID:6100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59697.exe
        5⤵
        
        PID:7088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6324.exe
        6⤵
        
        PID:9708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10849.exe
        6⤵
        
        PID:14000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23087.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:16600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15347.exe
        6⤵
        
        PID:12556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2498.exe
        5⤵
        
        PID:12192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39067.exe
        5⤵
        
        PID:16124
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 16124 -s 436
        6⤵
        Program crash
        
        PID:7760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31690.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31690.exe
      4⤵
      PID:7360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18847.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:14664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3732.exe
        5⤵
        
        PID:14088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51990.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51990.exe
      4⤵
      PID:10488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20817.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20817.exe
      4⤵
      PID:16628
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29176.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29176.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18369.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18369.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34451.exe
        5⤵
        
        PID:3404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38125.exe
        6⤵
        
        PID:5768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24045.exe
        7⤵
        
        PID:9192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34458.exe
        8⤵
        
        PID:4712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3039.exe
        7⤵
        
        PID:13756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8035.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:16720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38051.exe
        6⤵
        
        PID:7288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16752.exe
        7⤵
        
        PID:15540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39037.exe
        6⤵
        
        PID:12776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31833.exe
        6⤵
        
        PID:4628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19411.exe
        5⤵
        
        PID:6984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55333.exe
        6⤵
        
        PID:9524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20387.exe
        6⤵
        
        PID:13664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42138.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:16472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3292.exe
        5⤵
        
        PID:10512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44216.exe
        5⤵
        
        PID:16168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46993.exe
        5⤵
        
        PID:18224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6609.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6609.exe
      4⤵
      PID:5300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26641.exe
        5⤵
        
        PID:6676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18385.exe
        6⤵
        
        PID:8144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17494.exe
        6⤵
        
        PID:5024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29538.exe
        6⤵
        
        PID:13000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32343.exe
        5⤵
        
        PID:7980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14562.exe
        5⤵
        
        PID:15600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21662.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21662.exe
      4⤵
      PID:8124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7225.exe
        5⤵
        
        PID:8596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-963.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-963.exe
      4⤵
      PID:12048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53728.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53728.exe
      4⤵
      PID:17560
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55436.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55436.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53117.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53117.exe
      4⤵
      PID:5360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21187.exe
        5⤵
        
        PID:7428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29947.exe
        6⤵
        
        PID:13800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31910.exe
        6⤵
        
        PID:16776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13267.exe
        5⤵
        
        PID:12108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59652.exe
        5⤵
        
        PID:16304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58664.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58664.exe
      4⤵
      PID:8244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35567.exe
        5⤵
        
        PID:14088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1760.exe
        5⤵
        
        PID:17532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1896.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1896.exe
      4⤵
      PID:12868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61817.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61817.exe
      4⤵
      PID:17048
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21820.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21820.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6220.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6220.exe
      4⤵
      PID:6616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25437.exe
        5⤵
        
        PID:7384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39739.exe
        6⤵
        
        PID:10920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32294.exe
        6⤵
        
        PID:17796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39499.exe
        5⤵
        
        PID:12676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25967.exe
        5⤵
        
        PID:18896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45390.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45390.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:8812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32098.exe
        5⤵
        
        PID:19068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5726.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5726.exe
      4⤵
      PID:14216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56171.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56171.exe
      4⤵
      PID:17192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64349.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64349.exe
      4⤵
      PID:12612
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2327.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2327.exe
    3⤵
    PID:8148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37051.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37051.exe
      4⤵
      PID:9676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1734.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1734.exe
      4⤵
      PID:16060
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25719.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25719.exe
    3⤵
    PID:10592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3027.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3027.exe
      4⤵
      PID:10816
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48606.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48606.exe
    3⤵
    PID:16036
- C:\Users\Admin\AppData\Local\Temp\Unicorn-58777.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-58777.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1684
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1098.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1098.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35307.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35307.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57263.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46272.exe
        6⤵
        
        PID:5920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15733.exe
        7⤵
        
        PID:7936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18616.exe
        7⤵
        
        PID:12304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51511.exe
        7⤵
        
        PID:16804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54911.exe
        6⤵
        
        PID:7204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49425.exe
        7⤵
        
        PID:4800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11653.exe
        6⤵
        
        PID:10960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12119.exe
        6⤵
        
        PID:16828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13328.exe
        5⤵
        
        PID:6076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54051.exe
        6⤵
        
        PID:7640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2240.exe
        7⤵
        
        PID:9652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57541.exe
        7⤵
        
        PID:468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55094.exe
        6⤵
        
        PID:10504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52881.exe
        6⤵
        
        PID:16048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61971.exe
        5⤵
        
        PID:8980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20260.exe
        6⤵
        
        PID:3168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24013.exe
        6⤵
        
        PID:12668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42451.exe
        5⤵
        
        PID:10428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35592.exe
        5⤵
        
        PID:17688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26182.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26182.exe
      4⤵
      PID:1512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23735.exe
        5⤵
        
        PID:5308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40045.exe
        6⤵
        
        PID:7992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-889.exe
        7⤵
        
        PID:13404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43007.exe
        6⤵
        
        PID:11892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3436.exe
        6⤵
        
        PID:17480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8503.exe
        5⤵
        
        PID:7548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16934.exe
        6⤵
        
        PID:16256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-553.exe
        5⤵
        
        PID:12948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53152.exe
        5⤵
        
        PID:17120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24622.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24622.exe
      4⤵
      PID:7020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55333.exe
        5⤵
        
        PID:9496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51114.exe
        5⤵
        
        PID:6404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15880.exe
        5⤵
        
        PID:16688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65150.exe
        5⤵
        
        PID:9540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15451.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15451.exe
      4⤵
      PID:11292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28218.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28218.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:15532
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31969.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31969.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8062.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8062.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11316.exe
        5⤵
        
        PID:1984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38125.exe
        6⤵
        
        PID:5704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58109.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:9200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3027.exe
        8⤵
        
        PID:10848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25301.exe
        7⤵
        
        PID:12768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29667.exe
        7⤵
        
        PID:18688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35083.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6727.exe
        7⤵
        
        PID:9548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5726.exe
        6⤵
        
        PID:14332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51511.exe
        6⤵
        
        PID:16788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19411.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6324.exe
        6⤵
        
        PID:9780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31099.exe
        7⤵
        
        PID:14784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44765.exe
        7⤵
        
        PID:11572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64134.exe
        6⤵
        
        PID:14064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46222.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62799.exe
        5⤵
        
        PID:10660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5897.exe
        5⤵
        
        PID:4908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14009.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14009.exe
      4⤵
      PID:3608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23735.exe
        5⤵
        
        PID:3204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27793.exe
        6⤵
        
        PID:8132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19234.exe
        7⤵
        
        PID:6812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55260.exe
        6⤵
        
        PID:11464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15495.exe
        6⤵
        
        PID:17492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10003.exe
        5⤵
        
        PID:8560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31099.exe
        6⤵
        
        PID:14984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63239.exe
        6⤵
        
        PID:14608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55949.exe
        5⤵
        
        PID:13224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47427.exe
        5⤵
        
        PID:16680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18756.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18756.exe
      4⤵
      PID:7044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47165.exe
        5⤵
        
        PID:9580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4781.exe
        6⤵
        
        PID:7812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10273.exe
        5⤵
        
        PID:13816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48168.exe
        5⤵
        
        PID:4132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33854.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33854.exe
      4⤵
      PID:10644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32340.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32340.exe
      4⤵
      PID:16348
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18268.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18268.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:3288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58955.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58955.exe
      4⤵
      PID:1932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38125.exe
        5⤵
        
        PID:6060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36091.exe
        6⤵
        
        PID:9012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8584.exe
        7⤵
        
        PID:15944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64388.exe
        6⤵
        
        PID:12752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19003.exe
        6⤵
        
        PID:16636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19323.exe
        5⤵
        
        PID:8828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5726.exe
        5⤵
        
        PID:14272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39861.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:14584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19749.exe
        5⤵
        
        PID:17636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19411.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19411.exe
      4⤵
      PID:6968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61939.exe
        5⤵
        
        PID:10116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40026.exe
        5⤵
        
        PID:15132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34978.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34978.exe
      4⤵
      PID:10232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28647.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28647.exe
      4⤵
      PID:16904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22390.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22390.exe
      4⤵
      PID:10372
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27772.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27772.exe
    3⤵
    PID:5196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52105.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52105.exe
      4⤵
      PID:7140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51441.exe
        5⤵
        
        PID:9252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1013.exe
        6⤵
        
        PID:17604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8269.exe
        6⤵
        
        PID:15612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57528.exe
        5⤵
        
        PID:14292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17467.exe
        5⤵
        
        PID:456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41804.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41804.exe
      4⤵
      PID:11980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16203.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16203.exe
      4⤵
      PID:16508
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13600.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13600.exe
    3⤵
    PID:8032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28428.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28428.exe
      4⤵
      PID:1656
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50044.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50044.exe
    3⤵
    PID:12356
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53682.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53682.exe
    3⤵
    PID:17172
- C:\Users\Admin\AppData\Local\Temp\Unicorn-54118.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-54118.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2896
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35307.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35307.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30621.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30621.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60709.exe
        5⤵
        
        PID:4440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58545.exe
        6⤵
        
        PID:5440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55011.exe
        7⤵
        
        PID:7580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55644.exe
        7⤵
        
        PID:12364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15303.exe
        7⤵
        
        PID:18216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38783.exe
        6⤵
        
        PID:8936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43797.exe
        7⤵
        
        PID:13168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38132.exe
        7⤵
        
        PID:1912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55949.exe
        6⤵
        
        PID:10424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28953.exe
        6⤵
        
        PID:16532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39831.exe
        5⤵
        
        PID:7072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11202.exe
        6⤵
        
        PID:8620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58896.exe
        7⤵
        
        PID:8348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51718.exe
        7⤵
        
        PID:11184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42213.exe
        6⤵
        
        PID:13328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62558.exe
        6⤵
        
        PID:17724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61647.exe
        5⤵
        
        PID:9608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32396.exe
        5⤵
        
        PID:13920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63842.exe
        5⤵
        
        PID:17732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63978.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63978.exe
      4⤵
      PID:5340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26641.exe
        5⤵
        
        PID:6728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30829.exe
        6⤵
        
        PID:9456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26239.exe
        6⤵
        
        PID:16196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32535.exe
        5⤵
        
        PID:10364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52881.exe
        5⤵
        
        PID:16156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21662.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21662.exe
      4⤵
      PID:8084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45603.exe
        5⤵
        
        PID:8816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33201.exe
        5⤵
        
        PID:16096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45007.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45007.exe
      4⤵
      PID:10528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60838.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60838.exe
      4⤵
      PID:1492
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23583.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23583.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1970.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1970.exe
      4⤵
      PID:5280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41607.exe
        5⤵
        
        PID:6760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30829.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57528.exe
        6⤵
        
        PID:14308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11629.exe
        6⤵
        
        PID:11596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12115.exe
        5⤵
        
        PID:9944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39067.exe
        5⤵
        
        PID:16188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57704.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57704.exe
      4⤵
      PID:7448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63431.exe
        5⤵
        
        PID:11608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3458.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3458.exe
      4⤵
      PID:11448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11412.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11412.exe
      4⤵
      PID:18788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34423.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34423.exe
      4⤵
      PID:10252
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32788.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32788.exe
    3⤵
    PID:5388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26641.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26641.exe
      4⤵
      PID:6720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2240.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14562.exe
        5⤵
        
        PID:15588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24367.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24367.exe
      4⤵
      PID:10532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61049.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61049.exe
      4⤵
      PID:16028
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27528.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27528.exe
    3⤵
    PID:8076
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53943.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53943.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:11844
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33222.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33222.exe
    3⤵
    PID:13888
- C:\Users\Admin\AppData\Local\Temp\Unicorn-42905.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-42905.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4436
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-65431.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-65431.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1970.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1970.exe
      4⤵
      PID:5272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59889.exe
        5⤵
        
        PID:6712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11202.exe
        6⤵
        
        PID:9008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38542.exe
        7⤵
        
        PID:15168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42213.exe
        6⤵
        
        PID:12956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44442.exe
        6⤵
        
        PID:18924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47912.exe
        5⤵
        
        PID:9616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34714.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26530.exe
        5⤵
        
        PID:13948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28953.exe
        5⤵
        
        PID:16592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41175.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41175.exe
      4⤵
      PID:7148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45814.exe
        5⤵
        
        PID:7228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10859.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10859.exe
      4⤵
      PID:13176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53152.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53152.exe
      4⤵
      PID:16972
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33940.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33940.exe
    3⤵
    PID:6028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35743.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35743.exe
      4⤵
      PID:9208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59155.exe
        5⤵
        
        PID:14796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28915.exe
        5⤵
        
        PID:17928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61885.exe
        5⤵
        
        PID:7884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53698.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53698.exe
      4⤵
      PID:12884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44442.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44442.exe
      4⤵
      PID:19032
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54684.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54684.exe
    3⤵
    PID:8504
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2926.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2926.exe
    3⤵
    PID:14196
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26886.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26886.exe
    3⤵
    PID:16504
- C:\Users\Admin\AppData\Local\Temp\Unicorn-30235.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-30235.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2120
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12276.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12276.exe
    3⤵
    PID:5428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45115.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45115.exe
      4⤵
      PID:6668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53195.exe
        5⤵
        
        PID:9164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59820.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14562.exe
        5⤵
        
        PID:15896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41804.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41804.exe
      4⤵
      PID:11972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16587.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16587.exe
      4⤵
      PID:17612
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7927.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7927.exe
    3⤵
    PID:1980
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56743.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56743.exe
    3⤵
    PID:11828
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4832.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4832.exe
    3⤵
    PID:17788
- C:\Users\Admin\AppData\Local\Temp\Unicorn-57161.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-57161.exe
  2⤵
  PID:5480
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29163.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29163.exe
    3⤵
    PID:6796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27129.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27129.exe
      4⤵
      PID:10084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7149.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7149.exe
      4⤵
      PID:14604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38080.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38080.exe
      4⤵
      PID:14280
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8415.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8415.exe
    3⤵
    PID:11160
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64722.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64722.exe
    3⤵
    PID:14728
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49448.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49448.exe
    3⤵
    PID:13040
- C:\Users\Admin\AppData\Local\Temp\Unicorn-384.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-384.exe
  2⤵
  PID:7256
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39118.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39118.exe
    3⤵
    PID:15604
- C:\Users\Admin\AppData\Local\Temp\Unicorn-42189.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-42189.exe
  2⤵
  PID:10872
- C:\Users\Admin\AppData\Local\Temp\Unicorn-11172.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-11172.exe
  2⤵
  PID:17432

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1700 -ip 1700
1⤵
PID:5764

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:18172

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 692 -p 16048 -ip 16048
1⤵
PID:7904

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 688 -p 15124 -ip 15124
1⤵
PID:6508

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
PID:6148

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 17180 -ip 17180
1⤵
PID:18920

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
1⤵
PID:6432

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 3284 -ip 3284
1⤵
PID:10272

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-1098.exe

Filesize
468KB

MD5
4ee808faf82365ca5631e31adccb50da

SHA1
6ea96f88647896bade2b493a808bf9de47b5d18c

SHA256
597c49e449b63a97f72cf47a5bfb98a7b1635c225d0ae2b692103a1cbf0ab76f

SHA512
b8fb316d2354b3f6d3de7e528a8dd94cd490ce9191a6dfeae2c3308982bf994b0e63aea343ea394b981d033aa8bab8d9f572f9a578d827606a3f83ce608d4022

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-1378.exe

Filesize
468KB

MD5
4ac2e0873b86ac07d39b24a2bb96063f

SHA1
9c238c2453841e43034a5587b1027d0c81b26ec3

SHA256
5961a47ad0ea77ce8b1a8597beb6b9de3d71bbac5afedd6cf6c6e2a36fd4fa14

SHA512
cd5fd17ea4732df2f623bb3c4fce9e9ab93777b36e22acef605f99f4b354d343168820db977979fce187c7ac7bb11a2b70a413b5010e1075ad885c3c21fd7297

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-14092.exe

Filesize
468KB

MD5
1177e8953a3c7dd7899806f510ae4c0c

SHA1
717a3fbc6001c49d24ea5f8d542bd9aaa4fe64c8

SHA256
91e785527c549986c477f4e4a6641bdca7d2b4d803ce46316313409e3ba9ad4e

SHA512
eff472a0fc70c1bc64b1c012f26db8c79f60aee414eccc7d1df21be02ae5ab73841d404fc5e6a7b02a5e5802cb3b39e8a41a389fa6cd07eb3169bfbcfdf79559

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-15239.exe

Filesize
468KB

MD5
7b2178c160d28717edbaf4b81b78c97a

SHA1
4cc824833ed45ce6eae2531303eff8f6f317ba8d

SHA256
01582d17a4b26824b8cf4549f65e2b76964b5b5e8388e2bdb6052108c630026b

SHA512
70f8b15340ff46571053ae8fbcd956619183e3663364ca0394887edb40bc75f3e8c09bb84f47e07b9d4ac0741dbec8639f357da183da4d76a7daf437b7426a24

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-18675.exe

Filesize
468KB

MD5
c7fc0d5ffdad8326aee0c560d31935f9

SHA1
5f2b62d789e544b6a928bb3f13794360af1f67f0

SHA256
13c49a0867367b535aa8c27ec1876c08db85cc06d0040c847db1a6cffa71e259

SHA512
343e869a40dc7184ebd2ac3975c7d4fb2401c8ad81bd7bf6c493d48242bd6c2da2eaeecaf15d7fe48783f25c47e8106988dd44aad2a5d5cfa9b4f7bf9197d398

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-22261.exe

Filesize
468KB

MD5
9d17d9e274486498c2442dc8563010bc

SHA1
c6e3dec5f09b5ef8c7ac0ac8936ef24e00a87ba1

SHA256
d87a3d40ab38669657fe3a69ead8f20664a942d91be62185b97fd22ea133d5fc

SHA512
81a31ad20359fd1592d6d3b2a4dcdb956a0b52108b53ae9e45b24895b92398a66e007436caff663c171b225f2f76e24c5e7940922a8ca2091926101035f1bdb9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-23313.exe

Filesize
468KB

MD5
34d27534a58eb767678682d22d94ec06

SHA1
05ca7f25c8fedc8e0b286162c9d5c94bd6d2727d

SHA256
a8bedcb4e371f96e1d2f550cc61a3eaeb586a72cf96c262e3527955c3689e574

SHA512
2e206d6edb7ad9f8973b7d8417fb8f55857e0265641eba9d350299e202871eb2d6fba81f1ce2fe26e9919ac956d2e9ca1259943c73872e5035f2d963051867f7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-28291.exe

Filesize
468KB

MD5
9961f480e05cd37b894f4e66db3cc169

SHA1
526f59882b1da3e9741f65d54906c5e256b497a2

SHA256
90c8dfcf6a560493b17cae5782314ecc628ecd8b415e881a0892dba7fa828d65

SHA512
83caf9e6590d9496002b6eeb45517a1845ec70cb0b31726b7ffc694e1fa2cc13165ecd2ab438e4621ab17ff83ac6702b4e91baa07edeb4fe141dce28ba65d964

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-29176.exe

Filesize
468KB

MD5
525549b99d5aaee08c131e240bf744e8

SHA1
8aae7a3ef68d7b0b099103582c1aa9ac00d6bbdf

SHA256
7ffb33cdd2b559aabd1283b9a1f4e1e7d3152b39759607a5e2ae36646b4b69ea

SHA512
500d1bd0831d2591b21978f06a5ca9093b9188e521aee939e5567f6af31ea300b1dd9c09c0eecc08df1ddf43ab6723739abe394aa043b2f72f32a70ac2f19e4d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-31969.exe

Filesize
468KB

MD5
61b987d7bad87b058b5b0332141d9f3f

SHA1
5b940c7ffd89c7e7e5fd2f243c0e7fdd555d1475

SHA256
4ac87d73eb18237e7ed83fc296f8e4d801e2ec5c936759497a2d42c3a9d79a05

SHA512
2be8c3543d3c3d6fc394ac32877761d1f5d2da76439a80d598f2af4bde62311f60a73f2b377a4d9ee21d7466b0e4d1398dfdc5d707c5a554bc030ea62d7e4402

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-34694.exe

Filesize
468KB

MD5
8fbf058a5a7babbd6918e23cb9d6b2e1

SHA1
bd1ddff7fb0e920c5dfe399cb9bdac6660af9bad

SHA256
31a84f9045fb0b7deaec9f964700e9f8c9217a8780179ad0f3d5468cfe8e247f

SHA512
4fe18ad282e83d088acdb1d74f84c6c660a10970ec9ed3e9c84f95c66fe5641b478e869d698b19a1f743609cd2940707fc91e42802fb5460609afe95b6ba13d2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-35307.exe

Filesize
468KB

MD5
6697e3f1e73fb3594a0f159c31a90c18

SHA1
804e9aaf44578fe559ee01e50325083ef97cdb43

SHA256
18a078672289701b47278ff992c30d210cdb7391cb55b50e3d268ad020999314

SHA512
dc9a949b4096016be9878706f9bb7e4408c6d05ce52e8bc3047ea74a35ae40462c15a71ac366f4dc02f9a6ed71bb2fefc2980567d515deadab0c86523c5e1929

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-40957.exe

Filesize
468KB

MD5
77b8f40229fcd9596eea8548696e3165

SHA1
e52379dd7bc438ac04ac49cff171a4876d1380e1

SHA256
0d4e012a33757a56178a30dbf5801660281e9c59b7d3b568969b16afe727f202

SHA512
1ae2452041496e8ad06c911e8dd2dc7f63bc08544ff17fb0c83bd467becd16e0e7a79ceb379016e1d3ea2b0c6e9120373c6ffa2456163da76ad608dbe500c6ae

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-42685.exe

Filesize
468KB

MD5
cf81b47fd8c35de710537ac73a9a1929

SHA1
90c8bf87f510ca80adf83387541067b18fbfd12d

SHA256
72ad7ea166e8cde87dc5af144a0bf01c7b984900ec0360450519ceab9c3fa188

SHA512
3557ab48874f864971c1af47c8b07831a76c2d2bf44601abfa66ad5e7512d46b5f6f5cda7ae5b84b3dfa3df6165d7a730d4afd8e1d4b2a4ae4e85512875aa11c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-42905.exe

Filesize
468KB

MD5
f42d0d0e943272a9eb8e023ed3b76462

SHA1
5ef4f9101c0721163353e28122e168b136a09759

SHA256
0d457e64dc2dd98d16e23aa9546635b10b3e7e4d20b2e7d50e2fd2aa8d12fd9b

SHA512
9ea2f09e28158a6e4374a7bec95455c2c497db4eccb6a196aee5aae08ad3fc2149c3d531f0cd5ac628e5c406f7a156b945e28bb1e24daaa6702705f0c76cdbf8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-45705.exe

Filesize
468KB

MD5
dcec68caa083891024928d66cd72294b

SHA1
bdbca8c7863d3d33742f96261424c138fd541e3f

SHA256
aa24dbdb522f2e8d3dd83cd893bdb11eed1b03d7b679fe199aa87f7ba3e63464

SHA512
58ef7e72889d87add575dff238f227bbd6828b4ce1f2a7e180f87466f1348d640aafede2e687bd4b35bfd6e8bc6dd42087521e924d54b5c612d9cec83ab3898a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-48253.exe

Filesize
468KB

MD5
c1427488ed5076f148a5dd701fe8f870

SHA1
08b33a1b002e883080ee9bafb19adf7c091c5c8f

SHA256
fb6e31bfd66457d6a43fa38d988756f9c92bed2f32179f4c91b3ac89cdede816

SHA512
903aa3fc3ab0849f95c202c3e0a59931ba6fa5223ce905b26e41ff7e2804662ea1124a35c9c1649913cb65c4582b6447b2910150f2a5adc48eb4da6aee8cac7c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-49697.exe

Filesize
468KB

MD5
50d94ed91285ebefaf98742f6714158a

SHA1
99dd319c17435c834964aee6d7b150bc4808dc33

SHA256
98f6087947bbdb78dd2267dd21020b072e7bf05333eaa957792333e2961ad82b

SHA512
f018e2caf4c3836e08c24ad1182aaa19324381840fe2465938202c3db7d7a23063e58a4a3e0ebd0133aa4bc8ad8cf8abe5b337a635d1657c809a1a0299e5adc1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-51570.exe

Filesize
468KB

MD5
500b275b3429ca5a4f24fdbb4da3b739

SHA1
9169d54737be1c853d1f21ef22edac4950456d8e

SHA256
61a096af86fc2c2268a529564605867ab466bb57e6cae1fd9f21849fed0da299

SHA512
6901a64ad7e0cf856576b0f522566c3948c4ef7a8cee1bb01d2242295ead929ca2b52229b3d666392734b02753de900e4842591db5e5d5867f87081b8c8f4d2f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-52390.exe

Filesize
468KB

MD5
3a25d4528277829e5fd870264583b7a5

SHA1
f4b055d8580a7bb25b773690199e73eae5520316

SHA256
e585bf07b2c61bef63984a13ffc745d87e15fa245e90863ac55d196a7bab8d33

SHA512
336ebbf28fe37d603850d9051369276790a3e940499acb602c6c01d3e70165e88ccd793f315cbe03b2f07fc58b796d6d699df57c0b91bb20f3801497b02274af

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-54118.exe

Filesize
468KB

MD5
563134d85ac8cea9442c81a1091d628e

SHA1
9a2ee7d2d96a69f8abd2bafac422f3f962cae025

SHA256
4ff43e19c5c1405b80dd90753affded5f005b67090abe7b1b73f2269a332b7b5

SHA512
dde40a9052cae10e83d4db735301601d257b24155288ac1fa33828cafb5f08bd504875afbba52defbf3d7caec9c9c8e9ba59e2e13be9af88e1aab239d02be844

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-55680.exe

Filesize
468KB

MD5
8905bbb15cee13c02c57d7434c110681

SHA1
0435979675af60aa7f8d4a49f5ba2b0d9783121e

SHA256
7c3a3719851a172604a604e2cb53d42ddff7769df44a35c3a2b428b5d2a170e2

SHA512
2b9d35838732bb0316b7b9fe5595bb58fa315ac207d4a421650280084d4310e51bb2fb0a43dfca2bfc63959526fc3f40b67fa062d2b88fa3d0d8718e60e98e8a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-57076.exe

Filesize
468KB

MD5
384d147d5dd8bafb39c3089acab21c3e

SHA1
cf0f9260ae8f65c52e500c499e366656805b361b

SHA256
401dd97bedf41acf9066d2f7498665a4ed0fc6b60496998c6344d66c50f401ac

SHA512
38f64bf02ba83bbbd4650ea1a18e385f13d5d41962479a11527f7aaf96055a3ffdd0ae3107443359df50914c400b48638357def3a315af97995eed4f6fbe50b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-57865.exe

Filesize
468KB

MD5
faeeb79a8668767255d4cd5310cd0d83

SHA1
fe1cfee275107ecbe18a27d51e60af0d41ab7d52

SHA256
87a557c3926e74fb609d09c922e4cec8d2ff79ee81dbdab56622593064ab2fec

SHA512
09258b60c4001e6b9a4f8fed313308622d2cf4378a6ffa52e7176de016908be9a1ce403bb58b2158fb86cc3629817fcd4ebf11a7fb419fb01065184308546034

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-58777.exe

Filesize
468KB

MD5
fec02223381d2c9ac7473e18e2064587

SHA1
fb40923b249109fc8288229f7b0040185b97cc6a

SHA256
a04d10abec157d67fd7de9cc2a968fd093da9f703101cbc3686a6c040c466186

SHA512
908f6001b751d1e85581353698f76d805b0b995523c6b7357e056d7e646baacb71eef1ff83f0ed6e83eb5a2621dcb0bc01c5da3b14aaa72e5d70313b6b33204a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-59427.exe

Filesize
468KB

MD5
d52b3f49b9e03afdd6dfacd7d03fcfa8

SHA1
557185b55c3d61dd91c48f3c7d0cc1ebba64e784

SHA256
004fbba872734bbca06a0b5757b18874af492718f34a775ccfe9d174815b62d3

SHA512
48eb71191de69d8e2bc64bfecf1362d254dd6687d54fea9108d99abf620c28b7c56c6112269cbdf7af49420232db63df8341a823be0188f4ca9dd1390358eb52

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-61251.exe

Filesize
468KB

MD5
efcbef3b269ee9d354f9d8ac171edb8c

SHA1
e5b9520ed02b377fb86d66dfad1bffccdc483fe3

SHA256
7b14d3a12e44a75629a3a2000eac8fedac844a49a07a53ef569da453041ddf72

SHA512
0b9ccdbaacbfb713e4502d4c045da8ed43fd0669096c24c19fce418a2952389aebd8d4f4972e9fb706282239898d69f2b8ad98aa14eca610fb30893829bd128e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-61949.exe

Filesize
468KB

MD5
d65b4d22e435cd81329131c65c42d4ef

SHA1
a0e11df3f21675cdebb4568c90b5090aa2659482

SHA256
47d0911d6dc8e15ce6b44b5a36f2596b45115010878914b9ad996c55eda53e63

SHA512
bf09f9256a528d845a7dae02e9712304e66eb57aec81cf1d0b182f13c9fc600c8c37d6d020e21222ca1b22dbff104fa5752554d482663331ea674ae0085441f7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-673.exe

Filesize
468KB

MD5
70f987a64fde8d6f29e7e3565a035370

SHA1
d2336228c1139ffe7374695c5643b65233977556

SHA256
1b873b8cf471cb7219f0f10dcb483aefdebe5bc9621b2b0dadc21db5030a1061

SHA512
b6aa0bd5ab1961a8c21f8864b96b3348e647aa9ecc2de67dc4420ebf14da8d9783844e831964682af20ccf809a03866d960984bb8c259a72f2e5944b1207569b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-7320.exe

Filesize
468KB

MD5
d89e3b70b0027cca2e5aa05c3cfe1268

SHA1
6ae4f68d65bbbc35cf27cb07245589c7b5e4eb8a

SHA256
129b91aa9c4ba3f63cf46f28b863c36a8570c4711f0bdd24f0eaa5abd9d4d8a5

SHA512
bfe38f5fc066f6fa4e8f8ff0c47bcba452518fb3c616676bd76768fcf30126f503bd6aae2589ee15fed5f1ae974dca94cadec709da5e220c8100067204c5f9c0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-9676.exe

Filesize
468KB

MD5
622436f94372129b7bdd392da76d4425

SHA1
465f7435c8449f86f42edc47f76f0f40a3474189

SHA256
94ce0af79ca29462eb5da63b3d5c5b3f6dcfca72fd696141e7fe9d331354a29c

SHA512
465d2329e924ed15f9902bdbf4b9cf4999d71488644e37c7d43e1e13949941c56969d3fadf151984cf280de5527ad1b1aafa6d72dbe78b4513065c9acf3312a9

Download Submit
memory/388-107-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/644-268-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1188-344-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1220-243-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1228-315-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1284-410-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1372-86-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1400-459-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1436-429-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1452-143-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1480-398-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1496-6-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1512-434-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1660-330-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1684-47-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1688-286-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1700-412-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1708-66-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1780-411-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1836-265-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1876-317-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1892-58-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1928-403-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1964-264-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1984-431-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2040-287-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2060-310-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2120-319-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2156-19-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2284-122-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2396-368-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2452-202-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2488-77-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2488-6298-0x0000000075E10000-0x0000000075E85000-memory.dmp

Filesize
468KB

Download
memory/2540-146-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2552-380-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2612-352-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2656-31-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2688-215-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2752-14-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2768-229-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2864-91-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2876-169-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2896-5096-0x00000000755E0000-0x0000000075699000-memory.dmp

Filesize
740KB

Download
memory/2896-97-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2948-227-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3068-381-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3084-168-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3172-6971-0x00007FFD64FA0000-0x00007FFD65023000-memory.dmp

Filesize
524KB

Download
memory/3172-115-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3216-486-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3288-266-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3296-228-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3312-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3312-522-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3404-460-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3484-303-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3552-353-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3608-428-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3668-394-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3716-37-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3916-318-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4044-432-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4068-451-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4136-166-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4164-374-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4316-481-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4428-250-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4436-167-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4440-461-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4480-338-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4616-210-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4720-316-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4728-396-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4824-251-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4856-309-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4872-238-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4884-145-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4900-3713-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4976-354-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4996-179-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5028-427-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5084-485-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5164-523-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5172-524-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5180-536-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5196-534-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5212-557-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5256-537-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5280-541-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5288-539-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5324-554-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5332-553-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5340-525-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5360-535-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5388-555-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5396-559-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5428-538-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5444-571-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5480-540-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/6568-3289-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/7884-3779-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/9576-3765-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/9752-3724-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/9876-6829-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/10296-3723-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/10832-3766-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/11200-4088-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/11204-3776-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/11276-4106-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/11572-6948-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/12604-3697-0x00007FFD64FA0000-0x00007FFD65023000-memory.dmp

Filesize
524KB

Download
memory/12644-3695-0x0000000077B10000-0x0000000077B1A000-memory.dmp

Filesize
40KB

Download
memory/12700-3696-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/16068-3739-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/17208-5815-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/17264-3698-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads