68f5c9b56cacd8bb99e98b02000bcd3b5f9de94e62deb66bcc1e5440d35780c9

Analysis

max time kernel
148s
max time network
120s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
28-09-2024 22:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

68f5c9b56cacd8bb99e98b02000bcd3b5f9de94e62deb66bcc1e5440d35780c9.exe
Size

468KB
MD5

255aa7f6dd796e4db0ee79c18933e26f
SHA1

36fcd1d2862affdfa0ed15b59f3f2126ca4ebc9f
SHA256

68f5c9b56cacd8bb99e98b02000bcd3b5f9de94e62deb66bcc1e5440d35780c9
SHA512

796c48555f39bd3b87dcee5503b80114ed6fb272b276b577bc8834b9cc8235d57a9d17c6864370257c582f1a5b27b455422251aa2eb3aaac159d6e906655524c
SSDEEP

3072:PqmCoauxj2812bYIPz3yqf8/hC9NO4pP6mHa//kiIY0+14DsHolr:PqroHX12fPDyqfGEYTIYDqDsH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2160	Unicorn-12183.exe
2920	Unicorn-1960.exe
2624	Unicorn-12821.exe
2756	Unicorn-59376.exe
2788	Unicorn-28650.exe
864	Unicorn-14927.exe
2740	Unicorn-35426.exe
320	Unicorn-17668.exe
1880	Unicorn-17934.exe
3040	Unicorn-17934.exe
2988	Unicorn-63605.exe
288	Unicorn-11803.exe
3036	Unicorn-17934.exe
3052	Unicorn-17934.exe
2948	Unicorn-63605.exe
696	Unicorn-11986.exe
496	Unicorn-53574.exe
908	Unicorn-39567.exe
1372	Unicorn-39567.exe
328	Unicorn-39567.exe
1660	Unicorn-53303.exe
964	Unicorn-59168.exe
1060	Unicorn-50503.exe
1056	Unicorn-59433.exe
348	Unicorn-41404.exe
1984	Unicorn-4477.exe
1996	Unicorn-51440.exe
1684	Unicorn-57570.exe
1756	Unicorn-17284.exe
2804	Unicorn-34747.exe
1092	Unicorn-15146.exe
1604	Unicorn-41042.exe
2768	Unicorn-56100.exe
2832	Unicorn-27420.exe
3028	Unicorn-677.exe
2792	Unicorn-6807.exe
2404	Unicorn-49329.exe
1992	Unicorn-5853.exe
2052	Unicorn-49594.exe
2716	Unicorn-60455.exe
2136	Unicorn-8653.exe
2508	Unicorn-54855.exe
2864	Unicorn-14783.exe
3044	Unicorn-52016.exe
1216	Unicorn-17205.exe
2196	Unicorn-11083.exe
680	Unicorn-54154.exe
2472	Unicorn-19828.exe
1244	Unicorn-48971.exe
2448	Unicorn-6013.exe
876	Unicorn-50061.exe
2200	Unicorn-11066.exe
2068	Unicorn-42360.exe
1828	Unicorn-42360.exe
1720	Unicorn-22759.exe
1572	Unicorn-22759.exe
2776	Unicorn-42625.exe
2276	Unicorn-42625.exe
896	Unicorn-22759.exe
2468	Unicorn-33694.exe
2728	Unicorn-42625.exe
2636	Unicorn-65083.exe
2268	Unicorn-32319.exe
2984	Unicorn-45126.exe

Loads dropped DLL 64 IoCs

pid	Process
2520	68f5c9b56cacd8bb99e98b02000bcd3b5f9de94e62deb66bcc1e5440d35780c9.exe
2520	68f5c9b56cacd8bb99e98b02000bcd3b5f9de94e62deb66bcc1e5440d35780c9.exe
2160	Unicorn-12183.exe
2160	Unicorn-12183.exe
2520	68f5c9b56cacd8bb99e98b02000bcd3b5f9de94e62deb66bcc1e5440d35780c9.exe
2520	68f5c9b56cacd8bb99e98b02000bcd3b5f9de94e62deb66bcc1e5440d35780c9.exe
2624	Unicorn-12821.exe
2920	Unicorn-1960.exe
2624	Unicorn-12821.exe
2920	Unicorn-1960.exe
2160	Unicorn-12183.exe
2160	Unicorn-12183.exe
2520	68f5c9b56cacd8bb99e98b02000bcd3b5f9de94e62deb66bcc1e5440d35780c9.exe
2520	68f5c9b56cacd8bb99e98b02000bcd3b5f9de94e62deb66bcc1e5440d35780c9.exe
2160	Unicorn-12183.exe
2520	68f5c9b56cacd8bb99e98b02000bcd3b5f9de94e62deb66bcc1e5440d35780c9.exe
2160	Unicorn-12183.exe
2520	68f5c9b56cacd8bb99e98b02000bcd3b5f9de94e62deb66bcc1e5440d35780c9.exe
2756	Unicorn-59376.exe
2788	Unicorn-28650.exe
2740	Unicorn-35426.exe
864	Unicorn-14927.exe
864	Unicorn-14927.exe
2788	Unicorn-28650.exe
2740	Unicorn-35426.exe
2624	Unicorn-12821.exe
2624	Unicorn-12821.exe
2920	Unicorn-1960.exe
2920	Unicorn-1960.exe
2988	Unicorn-63605.exe
2988	Unicorn-63605.exe
2756	Unicorn-59376.exe
2756	Unicorn-59376.exe
864	Unicorn-14927.exe
2740	Unicorn-35426.exe
2788	Unicorn-28650.exe
864	Unicorn-14927.exe
2740	Unicorn-35426.exe
2788	Unicorn-28650.exe
2920	Unicorn-1960.exe
2160	Unicorn-12183.exe
2160	Unicorn-12183.exe
2920	Unicorn-1960.exe
2520	68f5c9b56cacd8bb99e98b02000bcd3b5f9de94e62deb66bcc1e5440d35780c9.exe
2520	68f5c9b56cacd8bb99e98b02000bcd3b5f9de94e62deb66bcc1e5440d35780c9.exe
288	Unicorn-11803.exe
288	Unicorn-11803.exe
1880	Unicorn-17934.exe
1880	Unicorn-17934.exe
496	Unicorn-53574.exe
496	Unicorn-53574.exe
2756	Unicorn-59376.exe
696	Unicorn-11986.exe
2756	Unicorn-59376.exe
696	Unicorn-11986.exe
2988	Unicorn-63605.exe
2988	Unicorn-63605.exe
3052	Unicorn-17934.exe
2624	Unicorn-12821.exe
2624	Unicorn-12821.exe
3052	Unicorn-17934.exe
908	Unicorn-39567.exe
908	Unicorn-39567.exe
2740	Unicorn-35426.exe

Program crash 12 IoCs

pid	pid_target	Process	procid_target
2576	2988	WerFault.exe	43
2148	2948	WerFault.exe	44
2820	696	WerFault.exe	45
600	1756	WerFault.exe	58
956	1684	WerFault.exe	57
1632	1092	WerFault.exe	59
3748	2776	WerFault.exe	92
3756	2276	WerFault.exe	91
3764	2728	WerFault.exe	93
4004	2448	WerFault.exe	82
4604	2828	WerFault.exe	142
7984	584	WerFault.exe	174

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4358.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59707.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54714.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52789.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64171.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52147.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64362.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39326.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61931.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59433.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7369.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2707.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-404.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13500.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49868.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43782.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27510.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50514.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8653.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46534.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61562.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46464.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58873.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18496.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12821.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49039.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42587.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7025.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21934.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20798.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36469.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16138.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22759.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54450.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24971.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5096.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58131.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13668.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14586.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19631.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6228.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48027.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24090.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45126.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44690.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39326.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22759.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63953.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27839.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39939.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50208.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30869.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8953.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8779.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16835.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13761.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42149.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14082.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16246.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13031.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28380.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19105.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7025.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60605.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2520	68f5c9b56cacd8bb99e98b02000bcd3b5f9de94e62deb66bcc1e5440d35780c9.exe
2160	Unicorn-12183.exe
2920	Unicorn-1960.exe
2624	Unicorn-12821.exe
2756	Unicorn-59376.exe
2788	Unicorn-28650.exe
864	Unicorn-14927.exe
2740	Unicorn-35426.exe
1880	Unicorn-17934.exe
320	Unicorn-17668.exe
3040	Unicorn-17934.exe
2988	Unicorn-63605.exe
288	Unicorn-11803.exe
3052	Unicorn-17934.exe
2948	Unicorn-63605.exe
496	Unicorn-53574.exe
696	Unicorn-11986.exe
908	Unicorn-39567.exe
328	Unicorn-39567.exe
1060	Unicorn-50503.exe
964	Unicorn-59168.exe
1660	Unicorn-53303.exe
1372	Unicorn-39567.exe
1056	Unicorn-59433.exe
348	Unicorn-41404.exe
1984	Unicorn-4477.exe
1756	Unicorn-17284.exe
1996	Unicorn-51440.exe
1604	Unicorn-41042.exe
1684	Unicorn-57570.exe
1092	Unicorn-15146.exe
2804	Unicorn-34747.exe
2768	Unicorn-56100.exe
2832	Unicorn-27420.exe
3028	Unicorn-677.exe
2864	Unicorn-14783.exe
2792	Unicorn-6807.exe
2716	Unicorn-60455.exe
2508	Unicorn-54855.exe
2404	Unicorn-49329.exe
2136	Unicorn-8653.exe
1992	Unicorn-5853.exe
2052	Unicorn-49594.exe
1216	Unicorn-17205.exe
3044	Unicorn-52016.exe
2196	Unicorn-11083.exe
680	Unicorn-54154.exe
2472	Unicorn-19828.exe
1244	Unicorn-48971.exe
2448	Unicorn-6013.exe
876	Unicorn-50061.exe
2200	Unicorn-11066.exe
2468	Unicorn-33694.exe
896	Unicorn-22759.exe
2068	Unicorn-42360.exe
2776	Unicorn-42625.exe
1828	Unicorn-42360.exe
1720	Unicorn-22759.exe
1572	Unicorn-22759.exe
2728	Unicorn-42625.exe
2276	Unicorn-42625.exe
2268	Unicorn-32319.exe
2636	Unicorn-65083.exe
1664	Unicorn-53123.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2520 wrote to memory of 2160	2520	68f5c9b56cacd8bb99e98b02000bcd3b5f9de94e62deb66bcc1e5440d35780c9.exe	30
PID 2520 wrote to memory of 2160	2520	68f5c9b56cacd8bb99e98b02000bcd3b5f9de94e62deb66bcc1e5440d35780c9.exe	30
PID 2520 wrote to memory of 2160	2520	68f5c9b56cacd8bb99e98b02000bcd3b5f9de94e62deb66bcc1e5440d35780c9.exe	30
PID 2520 wrote to memory of 2160	2520	68f5c9b56cacd8bb99e98b02000bcd3b5f9de94e62deb66bcc1e5440d35780c9.exe	30
PID 2160 wrote to memory of 2920	2160	Unicorn-12183.exe	31
PID 2160 wrote to memory of 2920	2160	Unicorn-12183.exe	31
PID 2160 wrote to memory of 2920	2160	Unicorn-12183.exe	31
PID 2160 wrote to memory of 2920	2160	Unicorn-12183.exe	31
PID 2520 wrote to memory of 2624	2520	68f5c9b56cacd8bb99e98b02000bcd3b5f9de94e62deb66bcc1e5440d35780c9.exe	32
PID 2520 wrote to memory of 2624	2520	68f5c9b56cacd8bb99e98b02000bcd3b5f9de94e62deb66bcc1e5440d35780c9.exe	32
PID 2520 wrote to memory of 2624	2520	68f5c9b56cacd8bb99e98b02000bcd3b5f9de94e62deb66bcc1e5440d35780c9.exe	32
PID 2520 wrote to memory of 2624	2520	68f5c9b56cacd8bb99e98b02000bcd3b5f9de94e62deb66bcc1e5440d35780c9.exe	32
PID 2624 wrote to memory of 2756	2624	Unicorn-12821.exe	33
PID 2624 wrote to memory of 2756	2624	Unicorn-12821.exe	33
PID 2624 wrote to memory of 2756	2624	Unicorn-12821.exe	33
PID 2624 wrote to memory of 2756	2624	Unicorn-12821.exe	33
PID 2920 wrote to memory of 2788	2920	Unicorn-1960.exe	34
PID 2920 wrote to memory of 2788	2920	Unicorn-1960.exe	34
PID 2920 wrote to memory of 2788	2920	Unicorn-1960.exe	34
PID 2920 wrote to memory of 2788	2920	Unicorn-1960.exe	34
PID 2160 wrote to memory of 2740	2160	Unicorn-12183.exe	35
PID 2160 wrote to memory of 2740	2160	Unicorn-12183.exe	35
PID 2160 wrote to memory of 2740	2160	Unicorn-12183.exe	35
PID 2160 wrote to memory of 2740	2160	Unicorn-12183.exe	35
PID 2520 wrote to memory of 864	2520	68f5c9b56cacd8bb99e98b02000bcd3b5f9de94e62deb66bcc1e5440d35780c9.exe	36
PID 2520 wrote to memory of 864	2520	68f5c9b56cacd8bb99e98b02000bcd3b5f9de94e62deb66bcc1e5440d35780c9.exe	36
PID 2520 wrote to memory of 864	2520	68f5c9b56cacd8bb99e98b02000bcd3b5f9de94e62deb66bcc1e5440d35780c9.exe	36
PID 2520 wrote to memory of 864	2520	68f5c9b56cacd8bb99e98b02000bcd3b5f9de94e62deb66bcc1e5440d35780c9.exe	36
PID 2160 wrote to memory of 288	2160	Unicorn-12183.exe	37
PID 2160 wrote to memory of 288	2160	Unicorn-12183.exe	37
PID 2160 wrote to memory of 288	2160	Unicorn-12183.exe	37
PID 2160 wrote to memory of 288	2160	Unicorn-12183.exe	37
PID 2520 wrote to memory of 320	2520	68f5c9b56cacd8bb99e98b02000bcd3b5f9de94e62deb66bcc1e5440d35780c9.exe	38
PID 2520 wrote to memory of 320	2520	68f5c9b56cacd8bb99e98b02000bcd3b5f9de94e62deb66bcc1e5440d35780c9.exe	38
PID 2520 wrote to memory of 320	2520	68f5c9b56cacd8bb99e98b02000bcd3b5f9de94e62deb66bcc1e5440d35780c9.exe	38
PID 2520 wrote to memory of 320	2520	68f5c9b56cacd8bb99e98b02000bcd3b5f9de94e62deb66bcc1e5440d35780c9.exe	38
PID 864 wrote to memory of 1880	864	Unicorn-14927.exe	42
PID 864 wrote to memory of 1880	864	Unicorn-14927.exe	42
PID 864 wrote to memory of 1880	864	Unicorn-14927.exe	42
PID 864 wrote to memory of 1880	864	Unicorn-14927.exe	42
PID 2788 wrote to memory of 3040	2788	Unicorn-28650.exe	40
PID 2788 wrote to memory of 3040	2788	Unicorn-28650.exe	40
PID 2788 wrote to memory of 3040	2788	Unicorn-28650.exe	40
PID 2788 wrote to memory of 3040	2788	Unicorn-28650.exe	40
PID 2740 wrote to memory of 3052	2740	Unicorn-35426.exe	41
PID 2740 wrote to memory of 3052	2740	Unicorn-35426.exe	41
PID 2740 wrote to memory of 3052	2740	Unicorn-35426.exe	41
PID 2740 wrote to memory of 3052	2740	Unicorn-35426.exe	41
PID 2624 wrote to memory of 2988	2624	Unicorn-12821.exe	43
PID 2624 wrote to memory of 2988	2624	Unicorn-12821.exe	43
PID 2624 wrote to memory of 2988	2624	Unicorn-12821.exe	43
PID 2624 wrote to memory of 2988	2624	Unicorn-12821.exe	43
PID 2920 wrote to memory of 2948	2920	Unicorn-1960.exe	44
PID 2920 wrote to memory of 2948	2920	Unicorn-1960.exe	44
PID 2920 wrote to memory of 2948	2920	Unicorn-1960.exe	44
PID 2920 wrote to memory of 2948	2920	Unicorn-1960.exe	44
PID 2988 wrote to memory of 696	2988	Unicorn-63605.exe	45
PID 2988 wrote to memory of 696	2988	Unicorn-63605.exe	45
PID 2988 wrote to memory of 696	2988	Unicorn-63605.exe	45
PID 2988 wrote to memory of 696	2988	Unicorn-63605.exe	45
PID 2756 wrote to memory of 496	2756	Unicorn-59376.exe	46
PID 2756 wrote to memory of 496	2756	Unicorn-59376.exe	46
PID 2756 wrote to memory of 496	2756	Unicorn-59376.exe	46
PID 2756 wrote to memory of 496	2756	Unicorn-59376.exe	46

C:\Users\Admin\AppData\Local\Temp\68f5c9b56cacd8bb99e98b02000bcd3b5f9de94e62deb66bcc1e5440d35780c9.exe
"C:\Users\Admin\AppData\Local\Temp\68f5c9b56cacd8bb99e98b02000bcd3b5f9de94e62deb66bcc1e5440d35780c9.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2520
- C:\Users\Admin\AppData\Local\Temp\Unicorn-12183.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-12183.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2160
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1960.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1960.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28650.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28650.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17934.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17205.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35500.exe
        7⤵
        
        PID:1360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33404.exe
        8⤵
        
        PID:4608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20798.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21290.exe
        8⤵
        
        PID:6536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10993.exe
        8⤵
        
        PID:5580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36132.exe
        7⤵
        
        PID:3600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35364.exe
        7⤵
        
        PID:4064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24971.exe
        7⤵
        
        PID:3784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13618.exe
        7⤵
        
        PID:5360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12731.exe
        7⤵
        
        PID:6908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7186.exe
        7⤵
        
        PID:7840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52147.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32024.exe
        7⤵
        
        PID:5576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44433.exe
        7⤵
        
        PID:6644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46074.exe
        7⤵
        
        PID:7332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38181.exe
        6⤵
        
        PID:3256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55818.exe
        6⤵
        
        PID:4844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42066.exe
        6⤵
        
        PID:4764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30869.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60497.exe
        6⤵
        
        PID:6232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61931.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39567.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22759.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40435.exe
        7⤵
        
        PID:584
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 584 -s 200
        8⤵
        Program crash
        
        PID:7984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11872.exe
        7⤵
        
        PID:4044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16305.exe
        7⤵
        
        PID:5108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29588.exe
        7⤵
        
        PID:5704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26805.exe
        7⤵
        
        PID:6252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14586.exe
        7⤵
        
        PID:7384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34304.exe
        6⤵
        
        PID:2116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50975.exe
        7⤵
        
        PID:4800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58131.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2816.exe
        7⤵
        
        PID:6624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45804.exe
        7⤵
        
        PID:6664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28380.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55288.exe
        6⤵
        
        PID:4876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46531.exe
        6⤵
        
        PID:5092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11843.exe
        6⤵
        
        PID:5832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1190.exe
        6⤵
        
        PID:6344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18786.exe
        6⤵
        
        PID:7376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8653.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2422.exe
        6⤵
        
        PID:2252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65302.exe
        7⤵
        
        PID:1000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4690.exe
        7⤵
        
        PID:3220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2024.exe
        7⤵
        
        PID:4284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38486.exe
        7⤵
        
        PID:5924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40276.exe
        7⤵
        
        PID:6204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65266.exe
        7⤵
        
        PID:6788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35976.exe
        6⤵
        
        PID:940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16876.exe
        7⤵
        
        PID:4660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21099.exe
        7⤵
        
        PID:5248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26360.exe
        7⤵
        
        PID:5324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30070.exe
        7⤵
        
        PID:3184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55733.exe
        6⤵
        
        PID:3588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19242.exe
        6⤵
        
        PID:3848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65307.exe
        6⤵
        
        PID:4520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46654.exe
        6⤵
        
        PID:5712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5274.exe
        6⤵
        
        PID:6260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18786.exe
        6⤵
        
        PID:7368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42360.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19631.exe
        6⤵
        
        PID:2388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43782.exe
        6⤵
        
        PID:3292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10689.exe
        6⤵
        
        PID:4332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42149.exe
        6⤵
        
        PID:2704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7025.exe
        6⤵
        
        PID:5600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52401.exe
        6⤵
        
        PID:6796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10700.exe
        5⤵
        
        PID:2656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64218.exe
        6⤵
        
        PID:4980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52132.exe
        6⤵
        
        PID:5044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54872.exe
        6⤵
        
        PID:6104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44832.exe
        6⤵
        
        PID:6272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47930.exe
        6⤵
        
        PID:6840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38181.exe
        5⤵
        
        PID:3384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55818.exe
        5⤵
        
        PID:4888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42066.exe
        5⤵
        
        PID:4756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54598.exe
        5⤵
        
        PID:5456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-247.exe
        5⤵
        
        PID:5748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41154.exe
        5⤵
        
        PID:6488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63605.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63605.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2948
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2948 -s 240
        5⤵
        Program crash
        
        PID:2148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53303.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53303.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6807.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15525.exe
        6⤵
        
        PID:776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4690.exe
        6⤵
        
        PID:3216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2024.exe
        6⤵
        
        PID:4300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25613.exe
        6⤵
        
        PID:4596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24090.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-404.exe
        6⤵
        
        PID:6968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25940.exe
        5⤵
        
        PID:2176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28521.exe
        6⤵
        
        PID:4784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12625.exe
        6⤵
        
        PID:5328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24204.exe
        6⤵
        
        PID:6900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49868.exe
        5⤵
        
        PID:3472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30508.exe
        5⤵
        
        PID:4632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65307.exe
        5⤵
        
        PID:4440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46654.exe
        5⤵
        
        PID:5644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18496.exe
        5⤵
        
        PID:6228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55025.exe
        5⤵
        
        PID:7872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49329.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49329.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53123.exe
        5⤵
        Suspicious use of SetWindowsHookEx
        
        PID:1664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48930.exe
        6⤵
        
        PID:2464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2355.exe
        7⤵
        
        PID:3168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35397.exe
        8⤵
        
        PID:5652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14553.exe
        8⤵
        
        PID:6432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49449.exe
        7⤵
        
        PID:3212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61421.exe
        8⤵
        
        PID:4544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5370.exe
        8⤵
        
        PID:4048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53008.exe
        8⤵
        
        PID:5436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31048.exe
        8⤵
        
        PID:5876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25488.exe
        8⤵
        
        PID:6404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10689.exe
        7⤵
        
        PID:4376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64899.exe
        7⤵
        
        PID:1400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7025.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21934.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48027.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7569.exe
        6⤵
        
        PID:3860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8551.exe
        6⤵
        
        PID:4500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30088.exe
        6⤵
        
        PID:4680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7025.exe
        6⤵
        
        PID:5612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21934.exe
        6⤵
        
        PID:7092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12728.exe
        5⤵
        
        PID:2620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55998.exe
        6⤵
        
        PID:3716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21628.exe
        6⤵
        
        PID:4104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19105.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19978.exe
        6⤵
        
        PID:5852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22190.exe
        6⤵
        
        PID:6392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64568.exe
        6⤵
        
        PID:6932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49868.exe
        5⤵
        
        PID:3480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61235.exe
        5⤵
        
        PID:4640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65307.exe
        5⤵
        
        PID:4436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15927.exe
        5⤵
        
        PID:5484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18496.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7520.exe
        5⤵
        
        PID:6564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40109.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40109.exe
      4⤵
      PID:1192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49506.exe
        5⤵
        
        PID:2432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19631.exe
        6⤵
        
        PID:1136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27839.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2213.exe
        7⤵
        
        PID:8068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8779.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10689.exe
        6⤵
        
        PID:4392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64899.exe
        6⤵
        
        PID:4896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7025.exe
        6⤵
        
        PID:5480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21934.exe
        6⤵
        
        PID:3976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65302.exe
        5⤵
        
        PID:2688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10404.exe
        6⤵
        
        PID:5408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31758.exe
        6⤵
        
        PID:6372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61812.exe
        6⤵
        
        PID:6772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57517.exe
        5⤵
        
        PID:2684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2024.exe
        5⤵
        
        PID:4264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56340.exe
        5⤵
        
        PID:4804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24090.exe
        5⤵
        
        PID:5144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-404.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7704.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7704.exe
      4⤵
      PID:2844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51914.exe
        5⤵
        
        PID:3692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64035.exe
        5⤵
        
        PID:4616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24971.exe
        5⤵
        
        PID:4176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29671.exe
        5⤵
        
        PID:6112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45362.exe
        5⤵
        
        PID:6164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13024.exe
        5⤵
        
        PID:7880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47598.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47598.exe
      4⤵
      PID:3536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11563.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11563.exe
      4⤵
      PID:4128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55506.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55506.exe
      4⤵
      PID:5100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54714.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54714.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37856.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37856.exe
      4⤵
      PID:6384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13031.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13031.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6300
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35426.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35426.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17934.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17934.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:3052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15146.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6013.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63247.exe
        7⤵
        
        PID:1308
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2448 -s 216
        7⤵
        Program crash
        
        PID:4004
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1092 -s 236
        6⤵
        Program crash
        
        PID:1632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11066.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65302.exe
        6⤵
        
        PID:1868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1297.exe
        7⤵
        
        PID:5524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56873.exe
        7⤵
        
        PID:6304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15948.exe
        7⤵
        
        PID:8060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57517.exe
        6⤵
        
        PID:3332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63953.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17917.exe
        6⤵
        
        PID:4916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55102.exe
        6⤵
        
        PID:5312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7012.exe
        6⤵
        
        PID:6524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2834.exe
        6⤵
        
        PID:7548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29589.exe
        5⤵
        
        PID:984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8779.exe
        6⤵
        
        PID:3708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10689.exe
        6⤵
        
        PID:4360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64899.exe
        6⤵
        
        PID:4952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7025.exe
        6⤵
        
        PID:5536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21934.exe
        6⤵
        
        PID:7044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47068.exe
        5⤵
        
        PID:3544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16028.exe
        5⤵
        
        PID:4144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16835.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55849.exe
        5⤵
        
        PID:5768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61392.exe
        5⤵
        
        PID:6376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58968.exe
        5⤵
        
        PID:6444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39567.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39567.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41042.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42625.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25085.exe
        7⤵
        
        PID:2828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64135.exe
        8⤵
        
        PID:4572
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2828 -s 236
        8⤵
        Program crash
        
        PID:4604
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2776 -s 236
        7⤵
        Program crash
        
        PID:3748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46060.exe
        6⤵
        
        PID:1804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46523.exe
        7⤵
        
        PID:5396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18712.exe
        7⤵
        
        PID:6928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36322.exe
        7⤵
        
        PID:7816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4690.exe
        6⤵
        
        PID:3136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2024.exe
        6⤵
        
        PID:4288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25613.exe
        6⤵
        
        PID:4824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24090.exe
        6⤵
        
        PID:5340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-404.exe
        6⤵
        
        PID:6980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22759.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65302.exe
        6⤵
        
        PID:1736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57068.exe
        6⤵
        
        PID:4076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65307.exe
        6⤵
        
        PID:4468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15927.exe
        6⤵
        
        PID:5508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18496.exe
        6⤵
        
        PID:6156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42330.exe
        6⤵
        
        PID:6732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54450.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57444.exe
        6⤵
        
        PID:7216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55733.exe
        5⤵
        
        PID:3528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19242.exe
        5⤵
        
        PID:3876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65307.exe
        5⤵
        
        PID:3796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11843.exe
        5⤵
        
        PID:5776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17910.exe
        5⤵
        
        PID:6596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33944.exe
        5⤵
        
        PID:7740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56100.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56100.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43646.exe
        5⤵
        
        PID:1612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28998.exe
        6⤵
        
        PID:3152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2002.exe
        6⤵
        
        PID:3568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11046.exe
        6⤵
        
        PID:4472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8027.exe
        6⤵
        
        PID:4692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30543.exe
        6⤵
        
        PID:6568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37669.exe
        6⤵
        
        PID:7128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37834.exe
        5⤵
        
        PID:3344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21602.exe
        5⤵
        
        PID:3448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7369.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22790.exe
        5⤵
        
        PID:5168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24090.exe
        5⤵
        
        PID:6064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47066.exe
        5⤵
        
        PID:4396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44690.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44690.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48027.exe
        5⤵
        
        PID:3112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15737.exe
        5⤵
        
        PID:3680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16911.exe
        5⤵
        
        PID:4464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64899.exe
        5⤵
        
        PID:4948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7025.exe
        5⤵
        
        PID:5156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21934.exe
        5⤵
        
        PID:6920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64644.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64644.exe
      4⤵
      PID:2020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38181.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38181.exe
      4⤵
      PID:3240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43566.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43566.exe
      4⤵
      PID:5008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18138.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18138.exe
      4⤵
      PID:1700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50514.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50514.exe
      4⤵
      PID:5816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55.exe
      4⤵
      PID:6416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31232.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31232.exe
      4⤵
      PID:6288
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11803.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11803.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59433.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59433.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22759.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19631.exe
        6⤵
        
        PID:1304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8779.exe
        6⤵
        
        PID:3596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58088.exe
        6⤵
        
        PID:4900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6195.exe
        6⤵
        
        PID:5028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11313.exe
        6⤵
        
        PID:5860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5655.exe
        6⤵
        
        PID:6424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16096.exe
        6⤵
        
        PID:6484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13500.exe
        5⤵
        
        PID:1504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63382.exe
        5⤵
        
        PID:2076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55288.exe
        5⤵
        
        PID:4852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34983.exe
        5⤵
        
        PID:4560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47956.exe
        5⤵
        
        PID:5900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50483.exe
        5⤵
        
        PID:7032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15003.exe
        5⤵
        
        PID:6832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60455.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60455.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13225.exe
        5⤵
        
        PID:2380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-399.exe
        6⤵
        
        PID:6056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54618.exe
        6⤵
        
        PID:6680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39939.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55733.exe
        5⤵
        
        PID:3580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44699.exe
        5⤵
        
        PID:4668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16835.exe
        5⤵
        
        PID:4196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19871.exe
        5⤵
        
        PID:6092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22696.exe
        5⤵
        
        PID:6180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14595.exe
        5⤵
        
        PID:6584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65083.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65083.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48930.exe
        5⤵
        
        PID:2652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43782.exe
        6⤵
        
        PID:3336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51116.exe
        6⤵
        
        PID:5004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11306.exe
        6⤵
        
        PID:5332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22912.exe
        6⤵
        
        PID:6008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4488.exe
        6⤵
        
        PID:6360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36132.exe
        5⤵
        
        PID:3620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35364.exe
        5⤵
        
        PID:3468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24971.exe
        5⤵
        
        PID:3424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36469.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45362.exe
        5⤵
        
        PID:6172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43465.exe
        5⤵
        
        PID:6752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24161.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24161.exe
      4⤵
      PID:2732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3673.exe
        5⤵
        
        PID:3776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18229.exe
        5⤵
        
        PID:4276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19105.exe
        5⤵
        
        PID:4248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58873.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22382.exe
        5⤵
        
        PID:5740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8953.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47068.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47068.exe
      4⤵
      PID:3560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61765.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61765.exe
      4⤵
      PID:4648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60841.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60841.exe
      4⤵
      PID:4136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50514.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50514.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63211.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63211.exe
      4⤵
      PID:6528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56477.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56477.exe
      4⤵
      PID:6816
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59168.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59168.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49594.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49594.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38733.exe
        5⤵
        
        PID:2532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19631.exe
        6⤵
        
        PID:1800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43782.exe
        6⤵
        
        PID:3260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10689.exe
        6⤵
        
        PID:4356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39326.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7025.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21934.exe
        6⤵
        
        PID:6880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43319.exe
        5⤵
        
        PID:1568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3207.exe
        5⤵
        
        PID:4036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65307.exe
        5⤵
        
        PID:4432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15927.exe
        5⤵
        
        PID:5492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1382.exe
        5⤵
        
        PID:5744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36876.exe
        5⤵
        
        PID:6716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20512.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20512.exe
      4⤵
      PID:1148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19631.exe
        5⤵
        
        PID:1484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3941.exe
        6⤵
        
        PID:7996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64362.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10689.exe
        5⤵
        
        PID:4408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30088.exe
        5⤵
        
        PID:5128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7025.exe
        5⤵
        
        PID:5592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21934.exe
        5⤵
        
        PID:7040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13500.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13500.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30200.exe
        5⤵
        
        PID:7752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61562.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61562.exe
      4⤵
      PID:3132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52209.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52209.exe
      4⤵
      PID:3968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16835.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16835.exe
      4⤵
      PID:4420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59933.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59933.exe
      4⤵
      PID:5552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-131.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-131.exe
      4⤵
      PID:5904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3353.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3353.exe
      4⤵
      PID:6556
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5853.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5853.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32319.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32319.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64555.exe
        5⤵
        
        PID:2540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43782.exe
        5⤵
        
        PID:3316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10689.exe
        5⤵
        
        PID:4324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42149.exe
        5⤵
        
        PID:4812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7025.exe
        5⤵
        
        PID:5380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52401.exe
        5⤵
        
        PID:6636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20569.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20569.exe
      4⤵
      PID:1312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23020.exe
        5⤵
        
        PID:3408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5370.exe
        5⤵
        
        PID:3676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18197.exe
        5⤵
        
        PID:5568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-321.exe
        5⤵
        
        PID:5992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25488.exe
        5⤵
        
        PID:6364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22514.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22514.exe
      4⤵
      PID:3616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63953.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63953.exe
      4⤵
      PID:4928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17917.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17917.exe
      4⤵
      PID:1724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3950.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3950.exe
      4⤵
      PID:5936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55818.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55818.exe
      4⤵
      PID:7060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10803.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10803.exe
      4⤵
      PID:6724
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23573.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23573.exe
    3⤵
    PID:2364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48027.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48027.exe
      4⤵
      PID:3120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46464.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46464.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3432
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16911.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16911.exe
      4⤵
      PID:4452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30088.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30088.exe
      4⤵
      PID:5136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7025.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7025.exe
      4⤵
      PID:5516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21934.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21934.exe
      4⤵
      PID:7056
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32035.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32035.exe
    3⤵
    PID:2332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33534.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33534.exe
      4⤵
      PID:7140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56930.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56930.exe
      4⤵
      PID:7156
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33716.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33716.exe
    3⤵
    PID:380
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28952.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28952.exe
    3⤵
    PID:4860
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40931.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40931.exe
    3⤵
    PID:5036
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61789.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61789.exe
    3⤵
    PID:5664
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57697.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57697.exe
    3⤵
    PID:5984
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1920.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1920.exe
    3⤵
    PID:2488
- C:\Users\Admin\AppData\Local\Temp\Unicorn-12821.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-12821.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2624
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59376.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59376.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17934.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17934.exe
      4⤵
      Executes dropped EXE
      PID:3036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53574.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53574.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4477.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19828.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19631.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43782.exe
        7⤵
        
        PID:3296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10689.exe
        7⤵
        
        PID:4340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21420.exe
        7⤵
        
        PID:5972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48335.exe
        7⤵
        
        PID:6456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32676.exe
        7⤵
        
        PID:6848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65302.exe
        6⤵
        
        PID:2672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57068.exe
        6⤵
        
        PID:4068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65307.exe
        6⤵
        
        PID:4496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15927.exe
        6⤵
        
        PID:5500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1382.exe
        6⤵
        
        PID:6036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64690.exe
        6⤵
        
        PID:6476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48971.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8857.exe
        6⤵
        
        PID:748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20711.exe
        7⤵
        
        PID:5544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3746.exe
        7⤵
        
        PID:6576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12995.exe
        7⤵
        
        PID:7400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36132.exe
        6⤵
        
        PID:3644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35364.exe
        6⤵
        
        PID:3984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5096.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40278.exe
        6⤵
        
        PID:5220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-546.exe
        6⤵
        
        PID:6700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16138.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1165.exe
        5⤵
        
        PID:1380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42587.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54717.exe
        5⤵
        
        PID:3392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38752.exe
        5⤵
        
        PID:4836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63597.exe
        5⤵
        
        PID:5052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25123.exe
        5⤵
        
        PID:5656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61584.exe
        5⤵
        
        PID:5840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3353.exe
        5⤵
        
        PID:6548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51440.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51440.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42625.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19631.exe
        6⤵
        
        PID:2584
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2728 -s 216
        6⤵
        Program crash
        
        PID:3764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65302.exe
        5⤵
        
        PID:2836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57517.exe
        5⤵
        
        PID:3280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63953.exe
        5⤵
        
        PID:4920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17917.exe
        5⤵
        
        PID:4732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3950.exe
        5⤵
        
        PID:5908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55818.exe
        5⤵
        
        PID:7012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4117.exe
        5⤵
        
        PID:7204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42360.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42360.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13325.exe
        5⤵
        
        PID:2316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1803.exe
        6⤵
        
        PID:7960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36132.exe
        5⤵
        
        PID:3628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35364.exe
        5⤵
        
        PID:3792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24971.exe
        5⤵
        
        PID:4188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15397.exe
        5⤵
        
        PID:5584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5847.exe
        5⤵
        
        PID:5988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26019.exe
        5⤵
        
        PID:6408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14701.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14701.exe
      4⤵
      PID:2676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50882.exe
        5⤵
        
        PID:5676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22062.exe
        5⤵
        
        PID:5364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15948.exe
        5⤵
        
        PID:8052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30532.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30532.exe
      4⤵
      PID:3504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19772.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19772.exe
      4⤵
      PID:3900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44297.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44297.exe
      4⤵
      PID:4600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34678.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34678.exe
      4⤵
      PID:5264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40269.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40269.exe
      4⤵
      PID:7112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34604.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34604.exe
      4⤵
      PID:5464
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63605.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63605.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11986.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11986.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57570.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42625.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19631.exe
        7⤵
        
        PID:2096
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2276 -s 216
        7⤵
        Program crash
        
        PID:3756
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1684 -s 216
        6⤵
        Program crash
        
        PID:956
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 696 -s 236
        5⤵
        Program crash
        
        PID:2820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17284.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17284.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1756
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1756 -s 240
        5⤵
        Program crash
        
        PID:600
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2988 -s 240
      4⤵
      Program crash
      PID:2576
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34747.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34747.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50061.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50061.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51644.exe
        5⤵
        
        PID:2548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19631.exe
        6⤵
        
        PID:2112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53404.exe
        7⤵
        
        PID:5808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62109.exe
        7⤵
        
        PID:6516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9482.exe
        7⤵
        
        PID:7412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8779.exe
        6⤵
        
        PID:3664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10689.exe
        6⤵
        
        PID:4368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21420.exe
        6⤵
        
        PID:5964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22720.exe
        6⤵
        
        PID:6352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14586.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65302.exe
        5⤵
        
        PID:2972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4690.exe
        5⤵
        
        PID:3444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2024.exe
        5⤵
        
        PID:4308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25613.exe
        5⤵
        
        PID:948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24090.exe
        5⤵
        
        PID:5296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-404.exe
        5⤵
        
        PID:6984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38384.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38384.exe
      4⤵
      PID:1048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14296.exe
        5⤵
        
        PID:6040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13668.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64745.exe
        5⤵
        
        PID:7716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49868.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49868.exe
      4⤵
      PID:3460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27908.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27908.exe
      4⤵
      PID:4024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16305.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16305.exe
      4⤵
      PID:4020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60315.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60315.exe
      4⤵
      PID:5784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61807.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61807.exe
      4⤵
      PID:6192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9148.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9148.exe
      4⤵
      PID:6820
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33694.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33694.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55344.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55344.exe
      4⤵
      PID:1080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36132.exe
        5⤵
        
        PID:3656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35364.exe
        5⤵
        
        PID:3844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5096.exe
        5⤵
        
        PID:4592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40278.exe
        5⤵
        
        PID:5244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-546.exe
        5⤵
        
        PID:6688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60470.exe
        5⤵
        
        PID:7684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9132.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9132.exe
      4⤵
      PID:3144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13599.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13599.exe
      4⤵
      PID:3884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4358.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4358.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39326.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39326.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7025.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7025.exe
      4⤵
      PID:5420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21934.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21934.exe
      4⤵
      PID:7004
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62551.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62551.exe
    3⤵
    PID:2892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2931.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2931.exe
      4⤵
      PID:3304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28644.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28644.exe
      4⤵
      PID:3828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2577.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2577.exe
      4⤵
      PID:4688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47991.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47991.exe
      4⤵
      PID:5160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23560.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23560.exe
      4⤵
      PID:5304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4869.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4869.exe
      4⤵
      PID:6884
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47598.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47598.exe
    3⤵
    PID:3512
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63779.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63779.exe
    3⤵
    PID:3908
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55506.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55506.exe
    3⤵
    PID:3804
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58799.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58799.exe
    3⤵
    PID:5560
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38048.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38048.exe
    3⤵
    PID:5884
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22953.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22953.exe
    3⤵
    PID:6468
- C:\Users\Admin\AppData\Local\Temp\Unicorn-14927.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-14927.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:864
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17934.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17934.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41404.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41404.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11083.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24893.exe
        6⤵
        
        PID:2064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43782.exe
        6⤵
        
        PID:3368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51116.exe
        6⤵
        
        PID:5000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18148.exe
        6⤵
        
        PID:6000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55818.exe
        6⤵
        
        PID:7020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65302.exe
        5⤵
        
        PID:2632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57517.exe
        5⤵
        
        PID:3312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34580.exe
        5⤵
        
        PID:4940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55014.exe
        5⤵
        
        PID:5372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1382.exe
        5⤵
        
        PID:5724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64690.exe
        5⤵
        
        PID:6632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54154.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54154.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3019.exe
        5⤵
        
        PID:2100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49128.exe
        6⤵
        
        PID:5896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53365.exe
        6⤵
        
        PID:6492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9482.exe
        6⤵
        
        PID:7392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36132.exe
        5⤵
        
        PID:3608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35364.exe
        5⤵
        
        PID:4000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24971.exe
        5⤵
        
        PID:4484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36469.exe
        5⤵
        
        PID:5232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45362.exe
        5⤵
        
        PID:6268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43465.exe
        5⤵
        
        PID:6764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18789.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18789.exe
      4⤵
      PID:1768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47068.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47068.exe
      4⤵
      PID:3452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2707.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2707.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16835.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16835.exe
      4⤵
      PID:4200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55849.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55849.exe
      4⤵
      PID:5732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62160.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62160.exe
      4⤵
      PID:6856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15003.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15003.exe
      4⤵
      PID:6896
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39567.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39567.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27420.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27420.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49039.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49868.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41229.exe
        6⤵
        
        PID:4060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16305.exe
        6⤵
        
        PID:5112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60315.exe
        6⤵
        
        PID:5792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26805.exe
        6⤵
        
        PID:6240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60102.exe
        6⤵
        
        PID:7164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6755.exe
        5⤵
        
        PID:1436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4690.exe
        5⤵
        
        PID:2124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2024.exe
        5⤵
        
        PID:4316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25613.exe
        5⤵
        
        PID:936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24090.exe
        5⤵
        
        PID:5196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-404.exe
        5⤵
        
        PID:6960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47648.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47648.exe
      4⤵
      PID:580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19631.exe
        5⤵
        
        PID:2428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64362.exe
        5⤵
        
        PID:3100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10689.exe
        5⤵
        
        PID:4348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64899.exe
        5⤵
        
        PID:2912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7025.exe
        5⤵
        
        PID:5468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21934.exe
        5⤵
        
        PID:7080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64647.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64647.exe
      4⤵
      PID:2008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61562.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61562.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51026.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51026.exe
      4⤵
      PID:4256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42679.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42679.exe
      4⤵
      PID:1488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2560.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2560.exe
      4⤵
      PID:5348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60605.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60605.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6992
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-677.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-677.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1073.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1073.exe
      4⤵
      PID:2436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16246.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36132.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36132.exe
      4⤵
      PID:3496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22042.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22042.exe
      4⤵
      PID:3952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24971.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24971.exe
      4⤵
      PID:4172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50208.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50208.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45362.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45362.exe
      4⤵
      PID:6148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8655.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8655.exe
      4⤵
      PID:3948
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41649.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41649.exe
    3⤵
    PID:2628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54390.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54390.exe
      4⤵
      PID:5616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52789.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52789.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15948.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15948.exe
      4⤵
      PID:8044
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38181.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38181.exe
    3⤵
    PID:3272
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27510.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27510.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4204
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50623.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50623.exe
    3⤵
    PID:2260
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1425.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1425.exe
    3⤵
    PID:5308
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37070.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37070.exe
    3⤵
    PID:6852
- C:\Users\Admin\AppData\Local\Temp\Unicorn-17668.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-17668.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:320
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52016.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52016.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47368.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47368.exe
      4⤵
      PID:2564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55998.exe
        5⤵
        
        PID:3732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8307.exe
        5⤵
        
        PID:3932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13761.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56814.exe
        5⤵
        
        PID:5280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49017.exe
        5⤵
        
        PID:6652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37669.exe
        5⤵
        
        PID:6320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36132.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36132.exe
      4⤵
      PID:3636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35364.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35364.exe
      4⤵
      PID:3824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24971.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24971.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13618.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13618.exe
      4⤵
      PID:5388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12731.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12731.exe
      4⤵
      PID:6916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7186.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7186.exe
      4⤵
      PID:7832
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53901.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53901.exe
    3⤵
    PID:2476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42314.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42314.exe
      4⤵
      PID:4816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58022.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58022.exe
      4⤵
      PID:5948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14082.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14082.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45804.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45804.exe
      4⤵
      PID:6740
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47068.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47068.exe
    3⤵
    PID:3552
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2707.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2707.exe
    3⤵
    PID:3872
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16835.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16835.exe
    3⤵
    PID:4228
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25123.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25123.exe
    3⤵
    PID:5684
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-65476.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-65476.exe
    3⤵
    PID:6220
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8013.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8013.exe
    3⤵
    PID:6844
- C:\Users\Admin\AppData\Local\Temp\Unicorn-50503.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-50503.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1060
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14783.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14783.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61545.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61545.exe
      4⤵
      PID:1948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43782.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10689.exe
        5⤵
        
        PID:4220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42149.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7025.exe
        5⤵
        
        PID:5352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52401.exe
        5⤵
        
        PID:4236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21497.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21497.exe
      4⤵
      PID:3244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21602.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21602.exe
      4⤵
      PID:3412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32065.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32065.exe
      4⤵
      PID:4532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57344.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57344.exe
      4⤵
      PID:5240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44552.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44552.exe
      4⤵
      PID:6668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33944.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33944.exe
      4⤵
      PID:7724
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45126.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45126.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50912.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50912.exe
      4⤵
      PID:1560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4690.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4690.exe
      4⤵
      PID:3224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2024.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2024.exe
      4⤵
      PID:3960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38486.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38486.exe
      4⤵
      PID:5956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1190.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1190.exe
      4⤵
      PID:6276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18786.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18786.exe
      4⤵
      PID:7344
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4756.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4756.exe
    3⤵
    PID:2312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55998.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55998.exe
      4⤵
      PID:3724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64035.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64035.exe
      4⤵
      PID:4624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5096.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5096.exe
      4⤵
      PID:4580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40278.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40278.exe
      4⤵
      PID:5208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10401.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10401.exe
      4⤵
      PID:6648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64171.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64171.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7556
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55733.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55733.exe
    3⤵
    PID:3572
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32563.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32563.exe
    3⤵
    PID:4112
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-65307.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-65307.exe
    3⤵
    PID:4388
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11843.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11843.exe
    3⤵
    PID:5844
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1190.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1190.exe
    3⤵
    PID:6332
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54767.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54767.exe
    3⤵
    PID:6612
- C:\Users\Admin\AppData\Local\Temp\Unicorn-54855.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-54855.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2508
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8172.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8172.exe
    3⤵
    PID:2528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35462.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35462.exe
      4⤵
      PID:7448
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57517.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57517.exe
    3⤵
    PID:3356
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63953.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63953.exe
    3⤵
    PID:4868
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63067.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63067.exe
    3⤵
    PID:5024
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29588.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29588.exe
    3⤵
    PID:5692
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57723.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57723.exe
    3⤵
    PID:6028
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4488.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4488.exe
    3⤵
    PID:6316
- C:\Users\Admin\AppData\Local\Temp\Unicorn-46534.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-46534.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2188
- C:\Users\Admin\AppData\Local\Temp\Unicorn-26067.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-26067.exe
  2⤵
  PID:3520
- C:\Users\Admin\AppData\Local\Temp\Unicorn-6228.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-6228.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4120
- C:\Users\Admin\AppData\Local\Temp\Unicorn-59707.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-59707.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3236
- C:\Users\Admin\AppData\Local\Temp\Unicorn-61789.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-61789.exe
  2⤵
  PID:5628
- C:\Users\Admin\AppData\Local\Temp\Unicorn-19847.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-19847.exe
  2⤵
  PID:5892
- C:\Users\Admin\AppData\Local\Temp\Unicorn-38354.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-38354.exe
  2⤵
  PID:6544

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-11803.exe

Filesize
468KB

MD5
881cd7a81a8f5b9bb4cf0e387fed3f6b

SHA1
beedb071d259dadc8c8864a809c8dc8b1a942171

SHA256
d5004c8705b79ccc6b92b7d6420fcacd5536fbd8bb8df26364a4ab949f9fd4f0

SHA512
d5f95c33a27644fed9c08d7decad1ceba38fa303047799268fb7de863ac636d42693f210e1bc1f86e085075dc97557a597893c33020c9c11965bd94f5180887a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-14927.exe

Filesize
468KB

MD5
3f4ad42ddbd133fad028c3887d558044

SHA1
da0c099543d9fa25dad94fa2608fd1572b09037f

SHA256
4cd233d6a77ec34e0845820ba2f88acf41ce5508b6f6716d6c5b1336805cb857

SHA512
22d4b5cdefa53efdf5fe0d10920f53ad70212d7e40d765d475a28524443177c2951f92d8bcac406528ca4817f74dc9b8d4a647b0ff70e059281dd6a4d296857f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-15737.exe

Filesize
468KB

MD5
bcc368a3be8539c486939a4302bfe548

SHA1
a16b908ad7f5297b2aab0e642fb37d8619c52e91

SHA256
a68db7c5bfb065d1283cdf753a1fde29f7a09b51460a21a88c8bf04329f115bb

SHA512
6cdc93c774ee4ebf52f61dceccc232a0e55d6b27f1cd20d8407b6df1ceae1391a48a9df2054254b6819967b549beff556ceb9eea725f82d8a199650fca3f9263

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-17668.exe

Filesize
468KB

MD5
0c569f70f30d94b866e8afaa8a45775a

SHA1
60ac24aa4c86763d6953947ea32c1f28f10de612

SHA256
104e38a40eab4596759bc1de95d8727e1789a20b78876c3814c2f2fae881475b

SHA512
cd34f629cf97cd10944a4eb5480324da87e1495ec58e91adc1a226928a20c48d7c18c975543c710b8150c11562730f4a76ece460b88cef32794256c4a4e7f86b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-1960.exe

Filesize
468KB

MD5
563cf87f65d69d136b5bc2652825134a

SHA1
5f2fa33cc2c55acad4b7aefd73a9bcc4ca0b330f

SHA256
0fbac418976f7e2eed0c62357e28b0ed3afbce558fd1902c9448f95e3ea9438d

SHA512
4f7c59a12842573e533144c91785e48902c93004742315eba6285eb5236082bb6120eec76dbbb9f907ef918ebd7f9ac97d9c8273a3fb12d7c75b2ff549ae96ea

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-23020.exe

Filesize
468KB

MD5
156f9c3267e6f80fc7c4fae486661155

SHA1
83009abbe97efddb21dc75d5bba92350fac07374

SHA256
3151433eded4574e1f5832fe06dc5c6e88dd43f6266c801aa2261686e862aa8c

SHA512
ab5ac7b292d00362827f67e78b58c6866c46985fe3a11f89aa53dd215e31abf956add4f8b92077a2e65ab2e5954a57fb615320aa6c3d4b0534af3dc61bb569e9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-28650.exe

Filesize
468KB

MD5
758ff9e53511526b91e71b1487e5e835

SHA1
d933cb8003a91ec4fd1f2fdb408225f236fdcec5

SHA256
0101ca953596135b2201bb39476f3fd5bda9bf118ba87d2d1d3762a0e12dff3f

SHA512
1951d01029a18588b1a6f19d1c63e458541de0b0c4fb5ba7150f51bde588bd82ec116ea00963e4f14607e173e040de13e9f997b80bda5654b5d24689b2768bc6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-35426.exe

Filesize
468KB

MD5
1bb5f59c4a2148a9764f4d95d2273b84

SHA1
e23ec6d16bf8f23eb1f2e6dae8d0dcaca9e33ba7

SHA256
9fc8b349a5650b87c91675b0a0282eb5a79414a688a1118f6d6ea802e58f22c1

SHA512
2bd108be57c9674cf0061191e1e41091fe263986bf83b63f4663e029150eed94091441b6f466f9b85f3cfa23e1f17d7451d742d8627a3265eb48900ecd20bb7c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-53574.exe

Filesize
468KB

MD5
bf35d2551a64274fff7a9814b1d37c8a

SHA1
85efd40609a53c6ed561d486d7060f8ab03cdf1e

SHA256
b98fa5e79e085cf0e2236abf55b0f23ecb72a19c351893f09c8f8c1f9a7b0b26

SHA512
4349b0be5cc9c23ff43cca2ae85565c2d9004173806d28815915f77e82a44aee3b112aeb703834bd1678d8035e0999cc7d8f740a6f7528240cb52dc0fe56ae16

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-9132.exe

Filesize
468KB

MD5
bb7335a10556313502b93d3e4b5e1164

SHA1
d2804fe8e7dc86bfdca80e2b78e4b02c1384981a

SHA256
042bdfc3393a46415a308e1512870d4c58c0abdfb1b47c1109b5452575296c73

SHA512
8bd07df8e01c46166e84159bcf702027ee8bab4e4015a836a4c043afa88721c0db5d792b6168a4183e7a5451a92cd774f3431311f9efd42fac6c14cb56bb4446

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-11986.exe

Filesize
468KB

MD5
75d357d8e783063109311788aa6b4f22

SHA1
24bb0eee806bf82b8aa2cd702f14ff3db690e0eb

SHA256
53b2fcf0fa3fff79c3177ec8c96d7f7961a7f445617a44b5d4eff3746dfd2778

SHA512
9e3cbc67faf7e0423cc1088159acc02d35806e65f96b236096fa34be707c115006d7e35db62744ec08a1258b38e646a225d45660c96ae1ccbe84e070bd8aaa16

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-12183.exe

Filesize
468KB

MD5
e73549cfadd8a61414c79fbf72e8c413

SHA1
2fb85004f78cb5f2c2292dc0929571abda680e54

SHA256
275b0a4a06cd780b21971449ed512fb081baf4a5a85c68ef6235314b426d3103

SHA512
2d3aa8a34d6db808f5358fe1bd3815e566307ec707a3688100c4e9c44b909a284499cdb231feecf37197f9d045328480eeaeede452d303b3d618d791a1d30e12

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-12821.exe

Filesize
468KB

MD5
021600b62467557d3c4d69395e552819

SHA1
d428053ec0ee2109e390ab31f759a031670c0705

SHA256
a3063bbf57944e6369c317fab01378d92f558a12171a174a8111817c2074435e

SHA512
422f8cecd6095215d71b0de8fd3dc1074025b8c70e96a9aaacf68317f160762a48cfcb12308671bd2721e09c9c04c8235e436af5dfb1779fe8020b40c60e90bc

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-17934.exe

Filesize
468KB

MD5
401945ab855b977b5a4b92790d427e87

SHA1
65a2a4cc43f308187d74b43bb274d9baee1e8a15

SHA256
5792540fafffccbb3f8b5c017bdd19c178089b9271de0dc78b610a22686ce918

SHA512
c0227d1a1c5ac85349dbc1ea9150acf287ccef13e475fc3a98e3422162ef590dff728a60c0f9fc2e518f3aa7efa0fe534be1e4629eb26b4650e141b79bdad4bd

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-59376.exe

Filesize
468KB

MD5
b02091ca5e1b71bd8b6d4925753fc441

SHA1
683a78427414a7b027ce158c7ca6aa7c3465ff77

SHA256
1b0cabd64221f9974fc2c43e8e8cfe759f545075ccc98584328054f434d119ed

SHA512
2bfe81270d96544b6ce634dcf9f56b8c1aba43760bf14d34435143e72c570d1f38ced91c22995b7ef82ee531c525aa711d61a4e375931b17cb5f754940e41e49

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-63605.exe

Filesize
468KB

MD5
1fe5829941cb00d77d2eb258e0026196

SHA1
915d0892c693be66d047dcaf9dace5d0a78f84e1

SHA256
6b4debe8c9b00f857c4d1bc49f78411e3c07413961633659685d4782b1d0bd32

SHA512
82d2dfcfdb9ccd7cb2aeed81ca0fb25c83d42b6fd67eb6f225760c6e007e96029ae3229bdabf382e19b2f6cd2ddee055417e12306b75d34b5facdf97ec9a0667

Download Submit
memory/288-225-0x00000000026E0000-0x0000000002755000-memory.dmp

Filesize
468KB

Download
memory/288-229-0x00000000026E0000-0x0000000002755000-memory.dmp

Filesize
468KB

Download
memory/288-399-0x00000000026E0000-0x0000000002755000-memory.dmp

Filesize
468KB

Download
memory/320-113-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/348-254-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/496-261-0x00000000023F0000-0x0000000002465000-memory.dmp

Filesize
468KB

Download
memory/496-183-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/496-262-0x00000000023F0000-0x0000000002465000-memory.dmp

Filesize
468KB

Download
memory/696-276-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/696-179-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/864-349-0x00000000026F0000-0x0000000002765000-memory.dmp

Filesize
468KB

Download
memory/864-343-0x00000000026F0000-0x0000000002765000-memory.dmp

Filesize
468KB

Download
memory/864-383-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/864-195-0x00000000026F0000-0x0000000002765000-memory.dmp

Filesize
468KB

Download
memory/864-190-0x0000000003220000-0x0000000003295000-memory.dmp

Filesize
468KB

Download
memory/864-78-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/908-311-0x0000000002450000-0x00000000024C5000-memory.dmp

Filesize
468KB

Download
memory/908-307-0x0000000002450000-0x00000000024C5000-memory.dmp

Filesize
468KB

Download
memory/908-192-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/964-397-0x00000000026B0000-0x0000000002725000-memory.dmp

Filesize
468KB

Download
memory/964-222-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1056-230-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1060-401-0x0000000002650000-0x00000000026C5000-memory.dmp

Filesize
468KB

Download
memory/1060-223-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1092-304-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1372-332-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/1372-338-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/1604-312-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1660-345-0x00000000005C0000-0x0000000000635000-memory.dmp

Filesize
468KB

Download
memory/1684-279-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1756-287-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1880-251-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/1880-250-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/1984-263-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1992-377-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1996-278-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2052-400-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2136-405-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2160-106-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2160-25-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2160-328-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2160-208-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2160-209-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2160-68-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2404-379-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2508-403-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2520-398-0x00000000024C0000-0x0000000002535000-memory.dmp

Filesize
468KB

Download
memory/2520-219-0x00000000024C0000-0x0000000002535000-memory.dmp

Filesize
468KB

Download
memory/2520-10-0x00000000024C0000-0x0000000002535000-memory.dmp

Filesize
468KB

Download
memory/2520-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2520-218-0x00000000024C0000-0x0000000002535000-memory.dmp

Filesize
468KB

Download
memory/2520-11-0x00000000024C0000-0x0000000002535000-memory.dmp

Filesize
468KB

Download
memory/2520-288-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2520-111-0x00000000024C0000-0x0000000002535000-memory.dmp

Filesize
468KB

Download
memory/2624-34-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2624-355-0x0000000001F00000-0x0000000001F75000-memory.dmp

Filesize
468KB

Download
memory/2624-135-0x0000000001F00000-0x0000000001F75000-memory.dmp

Filesize
468KB

Download
memory/2624-303-0x0000000001F00000-0x0000000001F75000-memory.dmp

Filesize
468KB

Download
memory/2624-302-0x0000000001F00000-0x0000000001F75000-memory.dmp

Filesize
468KB

Download
memory/2624-342-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2624-134-0x0000000001F00000-0x0000000001F75000-memory.dmp

Filesize
468KB

Download
memory/2624-58-0x0000000001F00000-0x0000000001F75000-memory.dmp

Filesize
468KB

Download
memory/2716-402-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2740-327-0x0000000002450000-0x00000000024C5000-memory.dmp

Filesize
468KB

Download
memory/2740-396-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2740-191-0x0000000002450000-0x00000000024C5000-memory.dmp

Filesize
468KB

Download
memory/2740-84-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2756-59-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2756-275-0x00000000029B0000-0x0000000002A25000-memory.dmp

Filesize
468KB

Download
memory/2756-357-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2756-277-0x00000000029B0000-0x0000000002A25000-memory.dmp

Filesize
468KB

Download
memory/2756-116-0x00000000027B0000-0x0000000002825000-memory.dmp

Filesize
468KB

Download
memory/2756-180-0x00000000029B0000-0x0000000002A25000-memory.dmp

Filesize
468KB

Download
memory/2756-181-0x00000000029B0000-0x0000000002A25000-memory.dmp

Filesize
468KB

Download
memory/2768-329-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2788-61-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2788-193-0x00000000027E0000-0x0000000002855000-memory.dmp

Filesize
468KB

Download
memory/2788-194-0x0000000003310000-0x0000000003385000-memory.dmp

Filesize
468KB

Download
memory/2788-354-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2792-358-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2804-301-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2832-339-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2864-404-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2920-213-0x0000000002700000-0x0000000002775000-memory.dmp

Filesize
468KB

Download
memory/2920-356-0x0000000002900000-0x0000000002975000-memory.dmp

Filesize
468KB

Download
memory/2920-340-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2920-136-0x0000000002700000-0x0000000002775000-memory.dmp

Filesize
468KB

Download
memory/2920-32-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2920-203-0x0000000002700000-0x0000000002775000-memory.dmp

Filesize
468KB

Download
memory/2920-376-0x0000000002700000-0x0000000002775000-memory.dmp

Filesize
468KB

Download
memory/2988-137-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2988-286-0x0000000002640000-0x00000000026B5000-memory.dmp

Filesize
468KB

Download
memory/2988-282-0x0000000003330000-0x00000000033A5000-memory.dmp

Filesize
468KB

Download
memory/3028-353-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3052-300-0x00000000025F0000-0x0000000002665000-memory.dmp

Filesize
468KB

Download
memory/3052-299-0x00000000025F0000-0x0000000002665000-memory.dmp

Filesize
468KB

Download