7674c0e079b1db41209904f60945326ffc40d0fd99a5b1864ee1b3cfbb0fd943

Analysis

max time kernel
119s
max time network
16s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
08-10-2024 23:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7674c0e079b1db41209904f60945326ffc40d0fd99a5b1864ee1b3cfbb0fd943N.exe
Size

468KB
MD5

74335bc165aa1ea4c10d991e951b9be0
SHA1

44f472be99fb163406cb4f1e6fc8000b3c3ebb5f
SHA256

7674c0e079b1db41209904f60945326ffc40d0fd99a5b1864ee1b3cfbb0fd943
SHA512

33aab8b8db463fdac91fa2f0017c81b2257add4b56fdae3cc54154336ce5cc946a0a7a60e7a991943766bb0b609f1dd4172d5b89e28fc1998b744c846560ebf9
SSDEEP

3072:d1CIogBRjq8U2bYLPz3yqf8boChjyIpwPmHxpTHf4t8+Rz7NE6lW:d1ZoiTU2QPDyqff09J4t7x7NE

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
1808	Unicorn-13315.exe
2520	Unicorn-48209.exe
1712	Unicorn-59070.exe
2692	Unicorn-57337.exe
2740	Unicorn-14913.exe
2704	Unicorn-14258.exe
2612	Unicorn-20389.exe
2068	Unicorn-57420.exe
768	Unicorn-23356.exe
1976	Unicorn-16580.exe
1476	Unicorn-63377.exe
1184	Unicorn-17134.exe
1040	Unicorn-6273.exe
3040	Unicorn-12971.exe
1864	Unicorn-53419.exe
1624	Unicorn-45998.exe
832	Unicorn-35691.exe
1804	Unicorn-11016.exe
1520	Unicorn-11016.exe
1080	Unicorn-33666.exe
1696	Unicorn-34950.exe
1088	Unicorn-9070.exe
2336	Unicorn-24950.exe
2100	Unicorn-25215.exe
2208	Unicorn-25215.exe
1972	Unicorn-5349.exe
2012	Unicorn-57979.exe
2536	Unicorn-31437.exe
2492	Unicorn-11571.exe
1680	Unicorn-58811.exe
2224	Unicorn-49081.exe
2956	Unicorn-29215.exe
2984	Unicorn-28560.exe
2872	Unicorn-28661.exe
2756	Unicorn-61425.exe
2892	Unicorn-2018.exe
2576	Unicorn-20362.exe
1500	Unicorn-30991.exe
1968	Unicorn-16793.exe
2352	Unicorn-16527.exe
2772	Unicorn-5509.exe
1484	Unicorn-11639.exe
2888	Unicorn-11639.exe
2788	Unicorn-14961.exe
1472	Unicorn-50897.exe
2404	Unicorn-45296.exe
2456	Unicorn-40036.exe
1232	Unicorn-58629.exe
1428	Unicorn-39028.exe
2480	Unicorn-39028.exe
1036	Unicorn-39028.exe
1536	Unicorn-39028.exe
636	Unicorn-52764.exe
2568	Unicorn-58894.exe
740	Unicorn-58894.exe
1672	Unicorn-58894.exe
2064	Unicorn-55941.exe
2292	Unicorn-62978.exe
1880	Unicorn-26606.exe
3016	Unicorn-26606.exe
2680	Unicorn-31436.exe
2844	Unicorn-57424.exe
2840	Unicorn-61224.exe
2924	Unicorn-23076.exe

Loads dropped DLL 64 IoCs

pid	Process
2396	7674c0e079b1db41209904f60945326ffc40d0fd99a5b1864ee1b3cfbb0fd943N.exe
2396	7674c0e079b1db41209904f60945326ffc40d0fd99a5b1864ee1b3cfbb0fd943N.exe
1808	Unicorn-13315.exe
2396	7674c0e079b1db41209904f60945326ffc40d0fd99a5b1864ee1b3cfbb0fd943N.exe
1808	Unicorn-13315.exe
2396	7674c0e079b1db41209904f60945326ffc40d0fd99a5b1864ee1b3cfbb0fd943N.exe
2520	Unicorn-48209.exe
2520	Unicorn-48209.exe
1808	Unicorn-13315.exe
1808	Unicorn-13315.exe
2396	7674c0e079b1db41209904f60945326ffc40d0fd99a5b1864ee1b3cfbb0fd943N.exe
2396	7674c0e079b1db41209904f60945326ffc40d0fd99a5b1864ee1b3cfbb0fd943N.exe
1712	Unicorn-59070.exe
1712	Unicorn-59070.exe
2692	Unicorn-57337.exe
2692	Unicorn-57337.exe
2520	Unicorn-48209.exe
2520	Unicorn-48209.exe
2704	Unicorn-14258.exe
2704	Unicorn-14258.exe
2396	7674c0e079b1db41209904f60945326ffc40d0fd99a5b1864ee1b3cfbb0fd943N.exe
2396	7674c0e079b1db41209904f60945326ffc40d0fd99a5b1864ee1b3cfbb0fd943N.exe
2740	Unicorn-14913.exe
1712	Unicorn-59070.exe
1712	Unicorn-59070.exe
2740	Unicorn-14913.exe
1808	Unicorn-13315.exe
1808	Unicorn-13315.exe
2068	Unicorn-57420.exe
2068	Unicorn-57420.exe
2692	Unicorn-57337.exe
2692	Unicorn-57337.exe
2612	Unicorn-20389.exe
2612	Unicorn-20389.exe
768	Unicorn-23356.exe
768	Unicorn-23356.exe
1476	Unicorn-63377.exe
1476	Unicorn-63377.exe
2520	Unicorn-48209.exe
2520	Unicorn-48209.exe
2396	7674c0e079b1db41209904f60945326ffc40d0fd99a5b1864ee1b3cfbb0fd943N.exe
2396	7674c0e079b1db41209904f60945326ffc40d0fd99a5b1864ee1b3cfbb0fd943N.exe
3040	Unicorn-12971.exe
3040	Unicorn-12971.exe
1808	Unicorn-13315.exe
2704	Unicorn-14258.exe
1184	Unicorn-17134.exe
1976	Unicorn-16580.exe
2704	Unicorn-14258.exe
1808	Unicorn-13315.exe
1184	Unicorn-17134.exe
1976	Unicorn-16580.exe
1712	Unicorn-59070.exe
1712	Unicorn-59070.exe
1040	Unicorn-6273.exe
2740	Unicorn-14913.exe
1040	Unicorn-6273.exe
2740	Unicorn-14913.exe
1864	Unicorn-53419.exe
1864	Unicorn-53419.exe
2068	Unicorn-57420.exe
1624	Unicorn-45998.exe
2068	Unicorn-57420.exe
1624	Unicorn-45998.exe

Program crash 5 IoCs

pid	pid_target	Process	procid_target
2428	2872	WerFault.exe	64
3736	2848	WerFault.exe	114
5252	4304	WerFault.exe	293
5276	4312	WerFault.exe	294
5284	4276	WerFault.exe	292

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37034.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9890.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12971.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31436.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42318.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31421.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14761.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58296.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31104.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19943.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2790.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21064.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57602.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19943.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34134.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63377.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63921.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36838.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41760.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19943.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13092.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37875.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12546.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51200.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42302.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19781.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50320.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61691.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30254.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63850.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46574.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58629.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44640.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39734.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14355.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18194.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26809.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37034.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61778.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33704.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20389.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32553.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13554.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30550.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18943.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39556.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32675.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26809.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30890.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10684.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51162.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35509.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61251.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44971.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62083.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1424.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32675.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44568.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26606.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1665.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7635.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28609.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26809.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21235.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2396	7674c0e079b1db41209904f60945326ffc40d0fd99a5b1864ee1b3cfbb0fd943N.exe
1808	Unicorn-13315.exe
2520	Unicorn-48209.exe
1712	Unicorn-59070.exe
2692	Unicorn-57337.exe
2740	Unicorn-14913.exe
2704	Unicorn-14258.exe
2612	Unicorn-20389.exe
2068	Unicorn-57420.exe
768	Unicorn-23356.exe
1976	Unicorn-16580.exe
1476	Unicorn-63377.exe
1184	Unicorn-17134.exe
3040	Unicorn-12971.exe
1040	Unicorn-6273.exe
1864	Unicorn-53419.exe
1624	Unicorn-45998.exe
832	Unicorn-35691.exe
1804	Unicorn-11016.exe
1520	Unicorn-11016.exe
1696	Unicorn-34950.exe
1080	Unicorn-33666.exe
2208	Unicorn-25215.exe
2536	Unicorn-31437.exe
1088	Unicorn-9070.exe
2100	Unicorn-25215.exe
2336	Unicorn-24950.exe
2012	Unicorn-57979.exe
2492	Unicorn-11571.exe
1972	Unicorn-5349.exe
1680	Unicorn-58811.exe
2224	Unicorn-49081.exe
2956	Unicorn-29215.exe
2984	Unicorn-28560.exe
2756	Unicorn-61425.exe
2892	Unicorn-2018.exe
2872	Unicorn-28661.exe
2576	Unicorn-20362.exe
2888	Unicorn-11639.exe
1500	Unicorn-30991.exe
2772	Unicorn-5509.exe
1968	Unicorn-16793.exe
1484	Unicorn-11639.exe
2788	Unicorn-14961.exe
2352	Unicorn-16527.exe
1472	Unicorn-50897.exe
2404	Unicorn-45296.exe
740	Unicorn-58894.exe
2456	Unicorn-40036.exe
1672	Unicorn-58894.exe
1036	Unicorn-39028.exe
1536	Unicorn-39028.exe
2064	Unicorn-55941.exe
636	Unicorn-52764.exe
2292	Unicorn-62978.exe
2568	Unicorn-58894.exe
1232	Unicorn-58629.exe
1428	Unicorn-39028.exe
2480	Unicorn-39028.exe
1880	Unicorn-26606.exe
2680	Unicorn-31436.exe
3016	Unicorn-26606.exe
2844	Unicorn-57424.exe
2840	Unicorn-61224.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2396 wrote to memory of 1808	2396	7674c0e079b1db41209904f60945326ffc40d0fd99a5b1864ee1b3cfbb0fd943N.exe	30
PID 2396 wrote to memory of 1808	2396	7674c0e079b1db41209904f60945326ffc40d0fd99a5b1864ee1b3cfbb0fd943N.exe	30
PID 2396 wrote to memory of 1808	2396	7674c0e079b1db41209904f60945326ffc40d0fd99a5b1864ee1b3cfbb0fd943N.exe	30
PID 2396 wrote to memory of 1808	2396	7674c0e079b1db41209904f60945326ffc40d0fd99a5b1864ee1b3cfbb0fd943N.exe	30
PID 1808 wrote to memory of 2520	1808	Unicorn-13315.exe	31
PID 1808 wrote to memory of 2520	1808	Unicorn-13315.exe	31
PID 1808 wrote to memory of 2520	1808	Unicorn-13315.exe	31
PID 1808 wrote to memory of 2520	1808	Unicorn-13315.exe	31
PID 2396 wrote to memory of 1712	2396	7674c0e079b1db41209904f60945326ffc40d0fd99a5b1864ee1b3cfbb0fd943N.exe	32
PID 2396 wrote to memory of 1712	2396	7674c0e079b1db41209904f60945326ffc40d0fd99a5b1864ee1b3cfbb0fd943N.exe	32
PID 2396 wrote to memory of 1712	2396	7674c0e079b1db41209904f60945326ffc40d0fd99a5b1864ee1b3cfbb0fd943N.exe	32
PID 2396 wrote to memory of 1712	2396	7674c0e079b1db41209904f60945326ffc40d0fd99a5b1864ee1b3cfbb0fd943N.exe	32
PID 2520 wrote to memory of 2692	2520	Unicorn-48209.exe	33
PID 2520 wrote to memory of 2692	2520	Unicorn-48209.exe	33
PID 2520 wrote to memory of 2692	2520	Unicorn-48209.exe	33
PID 2520 wrote to memory of 2692	2520	Unicorn-48209.exe	33
PID 1808 wrote to memory of 2740	1808	Unicorn-13315.exe	34
PID 1808 wrote to memory of 2740	1808	Unicorn-13315.exe	34
PID 1808 wrote to memory of 2740	1808	Unicorn-13315.exe	34
PID 1808 wrote to memory of 2740	1808	Unicorn-13315.exe	34
PID 2396 wrote to memory of 2704	2396	7674c0e079b1db41209904f60945326ffc40d0fd99a5b1864ee1b3cfbb0fd943N.exe	35
PID 2396 wrote to memory of 2704	2396	7674c0e079b1db41209904f60945326ffc40d0fd99a5b1864ee1b3cfbb0fd943N.exe	35
PID 2396 wrote to memory of 2704	2396	7674c0e079b1db41209904f60945326ffc40d0fd99a5b1864ee1b3cfbb0fd943N.exe	35
PID 2396 wrote to memory of 2704	2396	7674c0e079b1db41209904f60945326ffc40d0fd99a5b1864ee1b3cfbb0fd943N.exe	35
PID 1712 wrote to memory of 2612	1712	Unicorn-59070.exe	36
PID 1712 wrote to memory of 2612	1712	Unicorn-59070.exe	36
PID 1712 wrote to memory of 2612	1712	Unicorn-59070.exe	36
PID 1712 wrote to memory of 2612	1712	Unicorn-59070.exe	36
PID 2692 wrote to memory of 2068	2692	Unicorn-57337.exe	38
PID 2692 wrote to memory of 2068	2692	Unicorn-57337.exe	38
PID 2692 wrote to memory of 2068	2692	Unicorn-57337.exe	38
PID 2692 wrote to memory of 2068	2692	Unicorn-57337.exe	38
PID 2520 wrote to memory of 768	2520	Unicorn-48209.exe	39
PID 2520 wrote to memory of 768	2520	Unicorn-48209.exe	39
PID 2520 wrote to memory of 768	2520	Unicorn-48209.exe	39
PID 2520 wrote to memory of 768	2520	Unicorn-48209.exe	39
PID 2704 wrote to memory of 1976	2704	Unicorn-14258.exe	40
PID 2704 wrote to memory of 1976	2704	Unicorn-14258.exe	40
PID 2704 wrote to memory of 1976	2704	Unicorn-14258.exe	40
PID 2704 wrote to memory of 1976	2704	Unicorn-14258.exe	40
PID 2396 wrote to memory of 1476	2396	7674c0e079b1db41209904f60945326ffc40d0fd99a5b1864ee1b3cfbb0fd943N.exe	41
PID 2396 wrote to memory of 1476	2396	7674c0e079b1db41209904f60945326ffc40d0fd99a5b1864ee1b3cfbb0fd943N.exe	41
PID 2396 wrote to memory of 1476	2396	7674c0e079b1db41209904f60945326ffc40d0fd99a5b1864ee1b3cfbb0fd943N.exe	41
PID 2396 wrote to memory of 1476	2396	7674c0e079b1db41209904f60945326ffc40d0fd99a5b1864ee1b3cfbb0fd943N.exe	41
PID 1712 wrote to memory of 1184	1712	Unicorn-59070.exe	43
PID 1712 wrote to memory of 1184	1712	Unicorn-59070.exe	43
PID 1712 wrote to memory of 1184	1712	Unicorn-59070.exe	43
PID 1712 wrote to memory of 1184	1712	Unicorn-59070.exe	43
PID 2740 wrote to memory of 1040	2740	Unicorn-14913.exe	42
PID 2740 wrote to memory of 1040	2740	Unicorn-14913.exe	42
PID 2740 wrote to memory of 1040	2740	Unicorn-14913.exe	42
PID 2740 wrote to memory of 1040	2740	Unicorn-14913.exe	42
PID 1808 wrote to memory of 3040	1808	Unicorn-13315.exe	44
PID 1808 wrote to memory of 3040	1808	Unicorn-13315.exe	44
PID 1808 wrote to memory of 3040	1808	Unicorn-13315.exe	44
PID 1808 wrote to memory of 3040	1808	Unicorn-13315.exe	44
PID 2068 wrote to memory of 1864	2068	Unicorn-57420.exe	45
PID 2068 wrote to memory of 1864	2068	Unicorn-57420.exe	45
PID 2068 wrote to memory of 1864	2068	Unicorn-57420.exe	45
PID 2068 wrote to memory of 1864	2068	Unicorn-57420.exe	45
PID 2692 wrote to memory of 1624	2692	Unicorn-57337.exe	46
PID 2692 wrote to memory of 1624	2692	Unicorn-57337.exe	46
PID 2692 wrote to memory of 1624	2692	Unicorn-57337.exe	46
PID 2692 wrote to memory of 1624	2692	Unicorn-57337.exe	46

C:\Users\Admin\AppData\Local\Temp\7674c0e079b1db41209904f60945326ffc40d0fd99a5b1864ee1b3cfbb0fd943N.exe
"C:\Users\Admin\AppData\Local\Temp\7674c0e079b1db41209904f60945326ffc40d0fd99a5b1864ee1b3cfbb0fd943N.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2396
- C:\Users\Admin\AppData\Local\Temp\Unicorn-13315.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-13315.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1808
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48209.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48209.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57337.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57337.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57420.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53419.exe
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:1864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58811.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62978.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59766.exe
        9⤵
        
        PID:1856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-648.exe
        9⤵
        
        PID:4748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51506.exe
        9⤵
        
        PID:5556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30205.exe
        9⤵
        
        PID:6868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23071.exe
        8⤵
        
        PID:2564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2296.exe
        9⤵
        
        PID:2660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29426.exe
        9⤵
        
        PID:7056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45302.exe
        8⤵
        
        PID:4532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40459.exe
        8⤵
        
        PID:5432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58644.exe
        8⤵
        
        PID:7212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55941.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44369.exe
        8⤵
        
        PID:2096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11966.exe
        9⤵
        
        PID:3464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13092.exe
        9⤵
        
        PID:4244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26809.exe
        9⤵
        
        PID:5468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40528.exe
        9⤵
        
        PID:7844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54845.exe
        8⤵
        
        PID:4220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16146.exe
        8⤵
        
        PID:6080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2873.exe
        8⤵
        
        PID:6472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64689.exe
        7⤵
        
        PID:2724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44172.exe
        8⤵
        
        PID:3500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39734.exe
        8⤵
        
        PID:4640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26809.exe
        8⤵
        
        PID:5460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46541.exe
        8⤵
        
        PID:6720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-736.exe
        7⤵
        
        PID:3672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19943.exe
        7⤵
        
        PID:4912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13035.exe
        7⤵
        
        PID:6736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10684.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29215.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26606.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45376.exe
        8⤵
        
        PID:1052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19781.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61895.exe
        8⤵
        
        PID:5872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1424.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47384.exe
        7⤵
        
        PID:2896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47440.exe
        7⤵
        
        PID:4596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57371.exe
        7⤵
        
        PID:5540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56350.exe
        7⤵
        
        PID:6780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57424.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10160.exe
        7⤵
        
        PID:280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12163.exe
        8⤵
        
        PID:2380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64348.exe
        8⤵
        
        PID:4332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10281.exe
        8⤵
        
        PID:5124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15622.exe
        8⤵
        
        PID:6308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59589.exe
        7⤵
        
        PID:2600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12546.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16146.exe
        7⤵
        
        PID:6064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18263.exe
        7⤵
        
        PID:7688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61234.exe
        6⤵
        
        PID:2512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37291.exe
        7⤵
        
        PID:3436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37601.exe
        7⤵
        
        PID:4744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2223.exe
        7⤵
        
        PID:5192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50128.exe
        7⤵
        
        PID:6968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49357.exe
        6⤵
        
        PID:3616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34134.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9890.exe
        6⤵
        
        PID:6184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31960.exe
        6⤵
        
        PID:6456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45998.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:1624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49081.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26606.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5474.exe
        8⤵
        
        PID:2112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61084.exe
        9⤵
        
        PID:3940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23210.exe
        9⤵
        
        PID:5164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2223.exe
        9⤵
        
        PID:5688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37875.exe
        9⤵
        
        PID:6676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41218.exe
        8⤵
        
        PID:3960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53470.exe
        8⤵
        
        PID:4684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30890.exe
        8⤵
        
        PID:5660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21340.exe
        8⤵
        
        PID:6364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41223.exe
        7⤵
        
        PID:1328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44935.exe
        8⤵
        
        PID:4312
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4312 -s 188
        9⤵
        Program crash
        
        PID:5276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62083.exe
        8⤵
        
        PID:6136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44568.exe
        8⤵
        
        PID:5536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11591.exe
        7⤵
        
        PID:3076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32693.exe
        7⤵
        
        PID:4812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59305.exe
        7⤵
        
        PID:5208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11348.exe
        7⤵
        
        PID:6660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47456.exe
        7⤵
        
        PID:7384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31436.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51193.exe
        7⤵
        
        PID:1648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63641.exe
        8⤵
        
        PID:3236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28609.exe
        8⤵
        
        PID:4964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14355.exe
        8⤵
        
        PID:6168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38406.exe
        8⤵
        
        PID:6568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36838.exe
        7⤵
        
        PID:2332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27476.exe
        8⤵
        
        PID:8148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5836.exe
        7⤵
        
        PID:3396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59335.exe
        7⤵
        
        PID:4676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24009.exe
        7⤵
        
        PID:5200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59532.exe
        7⤵
        
        PID:7728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30672.exe
        6⤵
        
        PID:2176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1712.exe
        7⤵
        
        PID:1912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33704.exe
        7⤵
        
        PID:4612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51506.exe
        7⤵
        
        PID:5528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58985.exe
        7⤵
        
        PID:6876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1447.exe
        6⤵
        
        PID:2032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44640.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32170.exe
        6⤵
        
        PID:5504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56880.exe
        6⤵
        
        PID:6808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28560.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41633.exe
        6⤵
        
        PID:1692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31536.exe
        7⤵
        
        PID:3108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13092.exe
        7⤵
        
        PID:4272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26809.exe
        7⤵
        
        PID:5424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40528.exe
        7⤵
        
        PID:7804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3340.exe
        6⤵
        
        PID:3812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28609.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14355.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42490.exe
        6⤵
        
        PID:6260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22641.exe
        5⤵
        
        PID:2004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13917.exe
        6⤵
        
        PID:1044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54649.exe
        7⤵
        
        PID:3172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26938.exe
        7⤵
        
        PID:4716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28368.exe
        7⤵
        
        PID:5708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25424.exe
        7⤵
        
        PID:7160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39983.exe
        6⤵
        
        PID:3364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53470.exe
        6⤵
        
        PID:4528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32675.exe
        6⤵
        
        PID:5976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37875.exe
        6⤵
        
        PID:6592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32553.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28197.exe
        6⤵
        
        PID:5848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38725.exe
        6⤵
        
        PID:5584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42302.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24539.exe
        5⤵
        
        PID:6012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16875.exe
        5⤵
        
        PID:6712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23356.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23356.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11016.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11639.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35433.exe
        7⤵
        
        PID:2784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48557.exe
        8⤵
        
        PID:3648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39734.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26809.exe
        8⤵
        
        PID:5320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46541.exe
        8⤵
        
        PID:6804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45905.exe
        7⤵
        
        PID:3840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51634.exe
        7⤵
        
        PID:4124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59095.exe
        7⤵
        
        PID:5864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29508.exe
        7⤵
        
        PID:7008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9153.exe
        6⤵
        
        PID:1144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13554.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9008.exe
        7⤵
        
        PID:4996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18943.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46044.exe
        7⤵
        
        PID:7028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61778.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18272.exe
        6⤵
        
        PID:4672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46643.exe
        6⤵
        
        PID:5592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58826.exe
        6⤵
        
        PID:7044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50897.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8790.exe
        6⤵
        
        PID:2584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57638.exe
        7⤵
        
        PID:3328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29076.exe
        7⤵
        
        PID:4692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59095.exe
        7⤵
        
        PID:5980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41760.exe
        7⤵
        
        PID:6984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11670.exe
        6⤵
        
        PID:3116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29076.exe
        6⤵
        
        PID:5116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59820.exe
        6⤵
        
        PID:6652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3450.exe
        6⤵
        
        PID:7376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29110.exe
        5⤵
        
        PID:1604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48344.exe
        6⤵
        
        PID:2688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44935.exe
        7⤵
        
        PID:4304
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4304 -s 188
        8⤵
        Program crash
        
        PID:5252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62083.exe
        7⤵
        
        PID:6128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44568.exe
        7⤵
        
        PID:6352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41109.exe
        6⤵
        
        PID:4176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10281.exe
        6⤵
        
        PID:6096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11538.exe
        6⤵
        
        PID:6424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50217.exe
        5⤵
        
        PID:2448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24113.exe
        6⤵
        
        PID:5876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38725.exe
        6⤵
        
        PID:7164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52045.exe
        5⤵
        
        PID:4192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56483.exe
        5⤵
        
        PID:6032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3403.exe
        5⤵
        
        PID:6448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33666.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33666.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30991.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44369.exe
        6⤵
        
        PID:1908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64592.exe
        7⤵
        
        PID:3828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39734.exe
        7⤵
        
        PID:4660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26809.exe
        7⤵
        
        PID:5440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46541.exe
        7⤵
        
        PID:6728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54845.exe
        6⤵
        
        PID:4212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16146.exe
        6⤵
        
        PID:6072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18263.exe
        6⤵
        
        PID:7680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49392.exe
        5⤵
        
        PID:1340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51162.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39734.exe
        6⤵
        
        PID:4592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26809.exe
        6⤵
        
        PID:2552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46541.exe
        6⤵
        
        PID:6848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42318.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57167.exe
        5⤵
        
        PID:4792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11833.exe
        5⤵
        
        PID:5748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42490.exe
        5⤵
        
        PID:7136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16527.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16527.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14109.exe
        5⤵
        
        PID:2684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34995.exe
        6⤵
        
        PID:5940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60153.exe
        6⤵
        
        PID:7112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41109.exe
        5⤵
        
        PID:4168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10281.exe
        5⤵
        
        PID:5132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39743.exe
        5⤵
        
        PID:6244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17431.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17431.exe
      4⤵
      PID:2316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11966.exe
        5⤵
        
        PID:3456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9008.exe
        5⤵
        
        PID:5036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26809.exe
        5⤵
        
        PID:5272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46541.exe
        5⤵
        
        PID:6756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35509.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35509.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8011.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8011.exe
      4⤵
      PID:6088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51493.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51493.exe
      4⤵
      PID:6292
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14913.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14913.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6273.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6273.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:1040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31437.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58894.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30254.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14761.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15586.exe
        8⤵
        
        PID:8168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12817.exe
        7⤵
        
        PID:4396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10281.exe
        7⤵
        
        PID:4228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50433.exe
        7⤵
        
        PID:6360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15588.exe
        6⤵
        
        PID:3036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41026.exe
        6⤵
        
        PID:4708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57371.exe
        6⤵
        
        PID:5564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50320.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39028.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12298.exe
        6⤵
        
        PID:2168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11800.exe
        7⤵
        
        PID:3704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9008.exe
        7⤵
        
        PID:5044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26809.exe
        7⤵
        
        PID:5264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50625.exe
        7⤵
        
        PID:7148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5941.exe
        6⤵
        
        PID:3904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22743.exe
        6⤵
        
        PID:5076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30890.exe
        6⤵
        
        PID:1700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21340.exe
        6⤵
        
        PID:6692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4606.exe
        5⤵
        
        PID:2848
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2848 -s 240
        6⤵
        Program crash
        
        PID:3736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11343.exe
        5⤵
        
        PID:3964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19943.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31421.exe
        5⤵
        
        PID:6208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47601.exe
        5⤵
        
        PID:6444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11571.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11571.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16793.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5282.exe
        6⤵
        
        PID:2588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1001.exe
        7⤵
        
        PID:3688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9008.exe
        7⤵
        
        PID:5060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39556.exe
        7⤵
        
        PID:2708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41960.exe
        7⤵
        
        PID:7124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5640.exe
        6⤵
        
        PID:3788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22743.exe
        6⤵
        
        PID:5084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30890.exe
        6⤵
        
        PID:920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21340.exe
        6⤵
        
        PID:6612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63590.exe
        5⤵
        
        PID:944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18002.exe
        6⤵
        
        PID:752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35354.exe
        5⤵
        
        PID:1068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64981.exe
        5⤵
        
        PID:4436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27709.exe
        5⤵
        
        PID:5308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51875.exe
        5⤵
        
        PID:6460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5509.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5509.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8598.exe
        5⤵
        
        PID:1904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48967.exe
        6⤵
        
        PID:2916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33704.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2607.exe
        6⤵
        
        PID:5396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60242.exe
        6⤵
        
        PID:7036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9065.exe
        5⤵
        
        PID:2624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49386.exe
        5⤵
        
        PID:4840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32675.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58296.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6771.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6771.exe
      4⤵
      PID:1512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14732.exe
        5⤵
        
        PID:860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59967.exe
        5⤵
        
        PID:4780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37034.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58296.exe
        5⤵
        
        PID:6952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15724.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15724.exe
      4⤵
      PID:1556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7492.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7492.exe
      4⤵
      PID:4696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24539.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24539.exe
      4⤵
      PID:5196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37295.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37295.exe
      4⤵
      PID:6992
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12971.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12971.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:3040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9070.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9070.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58894.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64488.exe
        6⤵
        
        PID:904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63549.exe
        7⤵
        
        PID:3100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9008.exe
        7⤵
        
        PID:5028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39556.exe
        7⤵
        
        PID:5588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37875.exe
        7⤵
        
        PID:6648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17041.exe
        6⤵
        
        PID:3136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22743.exe
        6⤵
        
        PID:4132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32675.exe
        6⤵
        
        PID:5908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41960.exe
        6⤵
        
        PID:6276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18172.exe
        5⤵
        
        PID:872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14481.exe
        6⤵
        
        PID:6320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39002.exe
        5⤵
        
        PID:3156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32693.exe
        5⤵
        
        PID:4956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14355.exe
        5⤵
        
        PID:6176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19527.exe
        5⤵
        
        PID:7768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39028.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39028.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45547.exe
        5⤵
        
        PID:2728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17146.exe
        6⤵
        
        PID:3224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9008.exe
        6⤵
        
        PID:5004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39556.exe
        6⤵
        
        PID:5812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41960.exe
        6⤵
        
        PID:6288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17316.exe
        5⤵
        
        PID:4012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22743.exe
        5⤵
        
        PID:5100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32675.exe
        5⤵
        
        PID:5912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41960.exe
        5⤵
        
        PID:6312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29302.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29302.exe
      4⤵
      PID:1544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10923.exe
        5⤵
        
        PID:3448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9008.exe
        5⤵
        
        PID:5068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39556.exe
        5⤵
        
        PID:5676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3065.exe
        5⤵
        
        PID:6800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18442.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18442.exe
      4⤵
      PID:4076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19943.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19943.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31421.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31421.exe
      4⤵
      PID:6216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47601.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47601.exe
      4⤵
      PID:6408
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24950.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24950.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31820.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31820.exe
      4⤵
      PID:2928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29019.exe
        5⤵
        
        PID:372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56341.exe
        6⤵
        
        PID:3540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13092.exe
        6⤵
        
        PID:4872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26809.exe
        6⤵
        
        PID:2136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40528.exe
        6⤵
        
        PID:7812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30829.exe
        5⤵
        
        PID:3760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22743.exe
        5⤵
        
        PID:4140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32675.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3065.exe
        5⤵
        
        PID:6824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63921.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63921.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44089.exe
        5⤵
        
        PID:3504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13092.exe
        5⤵
        
        PID:4204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26809.exe
        5⤵
        
        PID:5416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59002.exe
        5⤵
        
        PID:7716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19703.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19703.exe
      4⤵
      PID:3720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24027.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24027.exe
      4⤵
      PID:4664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7474.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7474.exe
      4⤵
      PID:5992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50658.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50658.exe
      4⤵
      PID:6944
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14961.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14961.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44971.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44971.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22709.exe
        5⤵
        
        PID:3184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13092.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26809.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40528.exe
        5⤵
        
        PID:7820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9449.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9449.exe
      4⤵
      PID:3308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26938.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26938.exe
      4⤵
      PID:4728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28368.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28368.exe
      4⤵
      PID:5776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25424.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25424.exe
      4⤵
      PID:1868
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57030.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57030.exe
    3⤵
    PID:3064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14732.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14732.exe
      4⤵
      PID:1436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23210.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23210.exe
      4⤵
      PID:5148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2223.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2223.exe
      4⤵
      PID:2640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46044.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46044.exe
      4⤵
      PID:6316
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16254.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16254.exe
    3⤵
    PID:1224
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29669.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29669.exe
    3⤵
    PID:4416
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63211.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63211.exe
    3⤵
    PID:5984
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15740.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15740.exe
    3⤵
    PID:6864
- C:\Users\Admin\AppData\Local\Temp\Unicorn-59070.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-59070.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1712
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20389.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20389.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35691.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35691.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28661.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2872
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2872 -s 188
        6⤵
        Program crash
        
        PID:2428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7036.exe
        5⤵
        
        PID:2040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25184.exe
        5⤵
        
        PID:4392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28368.exe
        5⤵
        
        PID:5236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21340.exe
        5⤵
        
        PID:6560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61425.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61425.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8131.exe
        5⤵
        
        PID:2632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15396.exe
        6⤵
        
        PID:2220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57000.exe
        7⤵
        
        PID:3728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13092.exe
        7⤵
        
        PID:4340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26809.exe
        7⤵
        
        PID:5428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5717.exe
        7⤵
        
        PID:7744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22744.exe
        6⤵
        
        PID:3992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51634.exe
        6⤵
        
        PID:4472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63179.exe
        6⤵
        
        PID:5632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41760.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51530.exe
        5⤵
        
        PID:1960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64151.exe
        6⤵
        
        PID:5240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52052.exe
        6⤵
        
        PID:5612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61096.exe
        6⤵
        
        PID:6688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17813.exe
        5⤵
        
        PID:3400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32693.exe
        5⤵
        
        PID:4828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24009.exe
        5⤵
        
        PID:5228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21340.exe
        5⤵
        
        PID:6508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63259.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63259.exe
      4⤵
      PID:2884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21064.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47903.exe
        5⤵
        
        PID:4484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26809.exe
        5⤵
        
        PID:5248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46541.exe
        5⤵
        
        PID:6788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43537.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43537.exe
      4⤵
      PID:1724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22611.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22611.exe
      4⤵
      PID:4520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10793.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10793.exe
      4⤵
      PID:5444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27492.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27492.exe
      4⤵
      PID:6732
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17134.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17134.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25215.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25215.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58894.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61691.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2480.exe
        7⤵
        
        PID:3408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2790.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2223.exe
        7⤵
        
        PID:916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41960.exe
        7⤵
        
        PID:6300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1665.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22743.exe
        6⤵
        
        PID:5108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30890.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25424.exe
        6⤵
        
        PID:6232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49994.exe
        5⤵
        
        PID:348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17530.exe
        6⤵
        
        PID:3564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45769.exe
        6⤵
        
        PID:4296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6307.exe
        6⤵
        
        PID:5600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58296.exe
        6⤵
        
        PID:6432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50595.exe
        5⤵
        
        PID:3676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57167.exe
        5⤵
        
        PID:4760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21779.exe
        5⤵
        
        PID:6916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27399.exe
        5⤵
        
        PID:7624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39028.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39028.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45931.exe
        5⤵
        
        PID:836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30166.exe
        6⤵
        
        PID:3168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9008.exe
        6⤵
        
        PID:5012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26809.exe
        6⤵
        
        PID:5292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11730.exe
        6⤵
        
        PID:6388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17700.exe
        5⤵
        
        PID:3388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22743.exe
        5⤵
        
        PID:5092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32675.exe
        5⤵
        
        PID:5936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41960.exe
        5⤵
        
        PID:7116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15104.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15104.exe
      4⤵
      PID:292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-622.exe
        5⤵
        
        PID:3056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12546.exe
        5⤵
        
        PID:4356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16146.exe
        5⤵
        
        PID:6056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18263.exe
        5⤵
        
        PID:7664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56439.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56439.exe
      4⤵
      PID:2832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35324.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35324.exe
      4⤵
      PID:3244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3408.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3408.exe
      4⤵
      PID:4988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9890.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9890.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15624.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15624.exe
      4⤵
      PID:7096
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57979.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57979.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41825.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41825.exe
      4⤵
      PID:2948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55189.exe
        5⤵
        
        PID:2720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31374.exe
        5⤵
        
        PID:4800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45284.exe
        5⤵
        
        PID:5628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58985.exe
        5⤵
        
        PID:6884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61119.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61119.exe
      4⤵
      PID:2412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53305.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53305.exe
      4⤵
      PID:4628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48706.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48706.exe
      4⤵
      PID:5520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33784.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33784.exe
      4⤵
      PID:6924
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58629.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58629.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24956.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24956.exe
      4⤵
      PID:1656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9008.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9008.exe
      4⤵
      PID:5020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26809.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26809.exe
      4⤵
      PID:5496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40528.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40528.exe
      4⤵
      PID:7828
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7364.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7364.exe
    3⤵
    PID:824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57602.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57602.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13092.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13092.exe
      4⤵
      PID:4880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26809.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26809.exe
      4⤵
      PID:5412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5717.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5717.exe
      4⤵
      PID:7752
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38934.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38934.exe
    3⤵
    PID:3284
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51200.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51200.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4432
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3009.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3009.exe
    3⤵
    PID:6008
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15624.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15624.exe
    3⤵
    PID:7088
- C:\Users\Admin\AppData\Local\Temp\Unicorn-14258.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-14258.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2704
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16580.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16580.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25215.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25215.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40036.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60788.exe
        6⤵
        
        PID:1916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44935.exe
        7⤵
        
        PID:4276
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4276 -s 188
        8⤵
        Program crash
        
        PID:5284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62083.exe
        7⤵
        
        PID:6120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44568.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57638.exe
        6⤵
        
        PID:3332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59531.exe
        6⤵
        
        PID:5696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56395.exe
        6⤵
        
        PID:6764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49802.exe
        6⤵
        
        PID:7960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30616.exe
        5⤵
        
        PID:2556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54845.exe
        5⤵
        
        PID:4152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16146.exe
        5⤵
        
        PID:6040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6957.exe
        5⤵
        
        PID:6268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39028.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39028.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65064.exe
        5⤵
        
        PID:2392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12817.exe
        5⤵
        
        PID:4408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10281.exe
        5⤵
        
        PID:4376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50433.exe
        5⤵
        
        PID:6372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64134.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64134.exe
      4⤵
      PID:992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55251.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55251.exe
      4⤵
      PID:4820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42484.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42484.exe
      4⤵
      PID:5636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33784.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33784.exe
      4⤵
      PID:6904
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5349.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5349.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41825.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41825.exe
      4⤵
      PID:968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47789.exe
        5⤵
        
        PID:3268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13092.exe
        5⤵
        
        PID:4864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26809.exe
        5⤵
        
        PID:5500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46541.exe
        5⤵
        
        PID:6844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53719.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53719.exe
      4⤵
      PID:3348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28609.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28609.exe
      4⤵
      PID:4904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14355.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14355.exe
      4⤵
      PID:6200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46574.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46574.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6964
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52764.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52764.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21235.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21235.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27540.exe
        5⤵
        
        PID:1740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30550.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41685.exe
        6⤵
        
        PID:4384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2223.exe
        6⤵
        
        PID:5752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37875.exe
        6⤵
        
        PID:6632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5038.exe
        5⤵
        
        PID:4068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55718.exe
        5⤵
        
        PID:5136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59095.exe
        5⤵
        
        PID:2532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21340.exe
        5⤵
        
        PID:6584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36838.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36838.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14732.exe
        5⤵
        
        PID:1588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23210.exe
        5⤵
        
        PID:5184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2223.exe
        5⤵
        
        PID:5732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18263.exe
        5⤵
        
        PID:7672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18524.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18524.exe
      4⤵
      PID:1736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28609.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28609.exe
      4⤵
      PID:4944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14355.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14355.exe
      4⤵
      PID:6160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38406.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38406.exe
      4⤵
      PID:6668
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63948.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63948.exe
    3⤵
    PID:2484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26902.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26902.exe
      4⤵
      PID:2776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51162.exe
        5⤵
        
        PID:3524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9008.exe
        5⤵
        
        PID:5052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39556.exe
        5⤵
        
        PID:5816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37875.exe
        5⤵
        
        PID:6512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31104.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31104.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-295.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-295.exe
      4⤵
      PID:4848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28368.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28368.exe
      4⤵
      PID:2664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25424.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25424.exe
      4⤵
      PID:7152
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42860.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42860.exe
    3⤵
    PID:2636
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17606.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17606.exe
    3⤵
    PID:4652
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49236.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49236.exe
    3⤵
    PID:5572
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29319.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29319.exe
    3⤵
    PID:6900
- C:\Users\Admin\AppData\Local\Temp\Unicorn-63377.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-63377.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1476
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11016.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11016.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2018.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2018.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61224.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64213.exe
        6⤵
        
        PID:2312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56704.exe
        7⤵
        
        PID:2596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24904.exe
        8⤵
        
        PID:4088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23210.exe
        8⤵
        
        PID:5156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2223.exe
        8⤵
        
        PID:4372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37875.exe
        8⤵
        
        PID:6684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57638.exe
        7⤵
        
        PID:3360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-295.exe
        7⤵
        
        PID:4784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28368.exe
        7⤵
        
        PID:5764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21340.exe
        7⤵
        
        PID:6580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38976.exe
        6⤵
        
        PID:536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23944.exe
        7⤵
        
        PID:3384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39734.exe
        7⤵
        
        PID:4568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26809.exe
        7⤵
        
        PID:5472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46541.exe
        7⤵
        
        PID:1164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34533.exe
        6⤵
        
        PID:3340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32693.exe
        6⤵
        
        PID:4836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24009.exe
        6⤵
        
        PID:6108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29508.exe
        6⤵
        
        PID:7084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22749.exe
        5⤵
        
        PID:3024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63798.exe
        6⤵
        
        PID:3924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39734.exe
        6⤵
        
        PID:4588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26809.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46541.exe
        6⤵
        
        PID:6760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54762.exe
        5⤵
        
        PID:3248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57167.exe
        5⤵
        
        PID:4808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11833.exe
        5⤵
        
        PID:5828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15443.exe
        5⤵
        
        PID:7856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23076.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23076.exe
      4⤵
      Executes dropped EXE
      PID:2924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1390.exe
        5⤵
        
        PID:3020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38614.exe
        6⤵
        
        PID:1796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33072.exe
        7⤵
        
        PID:3980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39734.exe
        7⤵
        
        PID:1072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26809.exe
        7⤵
        
        PID:2056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54709.exe
        7⤵
        
        PID:6416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57638.exe
        6⤵
        
        PID:3320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22743.exe
        6⤵
        
        PID:4148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32675.exe
        6⤵
        
        PID:5932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41960.exe
        6⤵
        
        PID:7076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50399.exe
        5⤵
        
        PID:548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38286.exe
        5⤵
        
        PID:4856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37034.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37875.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36485.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36485.exe
      4⤵
      PID:2904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65246.exe
        5⤵
        
        PID:4452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16774.exe
        5⤵
        
        PID:5300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44568.exe
        5⤵
        
        PID:6344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60627.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60627.exe
      4⤵
      PID:3232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19943.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19943.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31421.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31421.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16875.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16875.exe
      4⤵
      PID:6700
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20362.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20362.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22906.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22906.exe
      4⤵
      PID:532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4727.exe
        5⤵
        
        PID:2180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24057.exe
        5⤵
        
        PID:4488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-442.exe
        5⤵
        
        PID:5604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40528.exe
        5⤵
        
        PID:7836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42038.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42038.exe
      4⤵
      PID:2752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23944.exe
        5⤵
        
        PID:3428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23210.exe
        5⤵
        
        PID:4756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2223.exe
        5⤵
        
        PID:5892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37875.exe
        5⤵
        
        PID:6484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7891.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7891.exe
      4⤵
      PID:3656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28609.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28609.exe
      4⤵
      PID:4972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7372.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7372.exe
      4⤵
      PID:5896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29508.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29508.exe
      4⤵
      PID:7060
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61700.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61700.exe
    3⤵
    PID:2628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63850.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63850.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40088.exe
        5⤵
        
        PID:3488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9008.exe
        5⤵
        
        PID:4980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39556.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53074.exe
        5⤵
        
        PID:7440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18276.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18276.exe
      4⤵
      PID:3596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26827.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26827.exe
      4⤵
      PID:4732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32675.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32675.exe
      4⤵
      PID:5968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46044.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46044.exe
      4⤵
      PID:7016
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1447.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1447.exe
    3⤵
    PID:2184
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38226.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38226.exe
    3⤵
    PID:4720
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32170.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32170.exe
    3⤵
    PID:5512
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50850.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50850.exe
    3⤵
    PID:6892
- C:\Users\Admin\AppData\Local\Temp\Unicorn-34950.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-34950.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1696
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11639.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11639.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5474.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5474.exe
      4⤵
      PID:2560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18194.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41109.exe
        5⤵
        
        PID:4160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10281.exe
        5⤵
        
        PID:4268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50433.exe
        5⤵
        
        PID:6380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31192.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31192.exe
      4⤵
      PID:2248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14208.exe
        5⤵
        
        PID:4260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62083.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5673.exe
        5⤵
        
        PID:6436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12546.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12546.exe
      4⤵
      PID:4364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16146.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16146.exe
      4⤵
      PID:6048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21784.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21784.exe
      4⤵
      PID:7456
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33055.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33055.exe
    3⤵
    PID:3060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37950.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37950.exe
      4⤵
      PID:3888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23210.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23210.exe
      4⤵
      PID:5176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2223.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2223.exe
      4⤵
      PID:5672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37875.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37875.exe
      4⤵
      PID:6504
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1669.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1669.exe
    3⤵
    PID:4032
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59335.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59335.exe
    3⤵
    PID:4560
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24009.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24009.exe
    3⤵
    PID:5220
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21340.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21340.exe
    3⤵
    PID:6620
- C:\Users\Admin\AppData\Local\Temp\Unicorn-45296.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-45296.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2404
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44623.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44623.exe
    3⤵
    PID:1956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9250.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9250.exe
      4⤵
      PID:6492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2592.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2592.exe
      4⤵
      PID:7228
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5945.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5945.exe
    3⤵
    PID:3836
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61251.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61251.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4324
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42559.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42559.exe
    3⤵
    PID:932
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38406.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38406.exe
    3⤵
    PID:6564
- C:\Users\Admin\AppData\Local\Temp\Unicorn-37531.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-37531.exe
  2⤵
  PID:840
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17530.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17530.exe
    3⤵
    PID:3588
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39734.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39734.exe
    3⤵
    PID:4572
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26809.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26809.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5408
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46541.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46541.exe
    3⤵
    PID:6836
- C:\Users\Admin\AppData\Local\Temp\Unicorn-7635.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-7635.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3380
- C:\Users\Admin\AppData\Local\Temp\Unicorn-24334.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-24334.exe
  2⤵
  PID:4420
- C:\Users\Admin\AppData\Local\Temp\Unicorn-1874.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-1874.exe
  2⤵
  PID:6020
- C:\Users\Admin\AppData\Local\Temp\Unicorn-53541.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-53541.exe
  2⤵
  PID:6932

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-18194.exe

Filesize
468KB

MD5
79f07071f05bb910a90aef2c381c6448

SHA1
c168f37f464c93c295d5a18283c35128e9174f77

SHA256
afc22f9412c47365e59411f2abe7fda23b291cc208605631a104e61979d71580

SHA512
48e60717e4ae46ade3d30eb89d792d4f47cecbec3b1df7e24d2a6fe97e88407633a5e6f92f1711d1c3ec8dfc9185e1a36d3322b97dd24ee0b285d02ec7036a14

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-20389.exe

Filesize
468KB

MD5
a11f2f57e261ad22675829ef23501864

SHA1
73262e862584b60da5272d69853df147205aefec

SHA256
06b3a1e879ac50d2c185b92a986eff57b0aafb455039610c808449923fe2a98f

SHA512
f85fb2c482823b4cfb9d75cc5c0a57024c642088ac83e28de375389c969ae823706ca6cf1f33c7979f432b570e66d3826263489bedac71e455e751d63b68c059

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-23356.exe

Filesize
468KB

MD5
4675c1ff657a24ffc28cf1fa95d384b4

SHA1
40374cda6d1f2f3e1ee59a106f91ae52d6d8c992

SHA256
2e5446fd5e83cb56061be5e7211ff2ce502dd0629cbff81203c5558b1f649879

SHA512
37f43f0bc92ac9a31f904991e6b1ee499d3bdc66a3b4df6fa55bd8b286c1f204590ffb23131cae65cc691e803a11b0b168ba8f69f5cfa77bb3e7923e7a3b8c12

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-31374.exe

Filesize
468KB

MD5
aa2ad21cc055f6166d9aab1a3b6e77b7

SHA1
fb294c4e4aa2a9d16365f7241656f47cf468629c

SHA256
c1916564962afcb0e88b7193b0158eedab68f74c3d174846bbd69b5044f92426

SHA512
20c7a320230f3245ac98c62ba856e151c6276ebb9500cb578f8b72362230fa454f3283f20c06a473fbdc83b5e4b34a359edc9f9010bacfe7c03005e0fcefbe02

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-35691.exe

Filesize
468KB

MD5
867411469a3a766efe7606bbb0ef8934

SHA1
8b186727735586344e54e60d9e3d8c590619860c

SHA256
64258531c88ea4231674ed2623392129efd26f658b6bf51265cd3968b484162c

SHA512
ff922841e4e4c979106c49fbfbc13de8b038af2b5972de059b6a039ed7e1a4e727782a31c8a14bc2a8599437dd897e3debc577e72192caa956923d6e41e58871

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-37531.exe

Filesize
468KB

MD5
db1d9484330cd0ac2ca2bb2eaa8d7ea1

SHA1
6f2ca9f8bc009526e6a68137dfc62089264a14b0

SHA256
e01c64b112de857092ee77a31c23af84491fe9fe68e5ed77ff9992c00ec3909e

SHA512
4dbac73477c2c90e27cc08b3c53a19eb3d54db54c058045996bdf4299724ecf218f9ca829dcd6cbde57f57155c0bc7f0bad205f5d49941bb37032e7d3820df4e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-57420.exe

Filesize
468KB

MD5
da8118b93fe3a6187b930b50f004ccab

SHA1
8b2d00fb9cad3663db9c8abca5d734dca5883183

SHA256
9f892ce6f726143e5351db285acb5046d9e57ff68cd56dffd25da4eba0029acf

SHA512
f20b95abece000b6dce0db5167e7e3de85573384b57d703e3e36aef6f87a143b97df4c78ef9df01889f9e588ef2ccb9ade6912cb5b8547fd55fa547e4a4ab418

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-63377.exe

Filesize
468KB

MD5
96a5036e7374c2eb75c6a4aa7b5baff1

SHA1
2247bb469e79173014037d88d16040699465df4b

SHA256
d6ae367e98b26dff2e38c90597247e6c8004708ef3e092202724a57492fc5ebf

SHA512
b678d7f7d6ddfaf30fae80ac695e33388a6501e8f66d7745ed38de2e5000b934646ed7021e702c8ef089526932b7d233ca80d4a40add515a349f9ec80752ae72

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-11016.exe

Filesize
468KB

MD5
6b98e5e69358abff5e7f8ab0089ff45b

SHA1
db3a09407d89f5cdefa1936152b6dcfdaa83c025

SHA256
301df22a3ebf430b5127f34ea58e0f54c74a36f4ba923f6d12ba53324bfda391

SHA512
6307f39fc0e4de503762ae0f4a4ae02b01917a9cf3edc0fc3ad8f15315f39bce8753fff4e58b7314f495975a082c1fd85f2b6a1359b8b214d9706b93adfab49b

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-12971.exe

Filesize
468KB

MD5
1cd95b05974fc0aee9aa235e6133a422

SHA1
298b5261dea5d466e3c3d797e03924ae88ca980f

SHA256
ce02446b67c9e92a0dbcfdc2bb8d951cf4005f50f6a98ed8a5c3519a3482aafb

SHA512
4e67736c7c398b331739b42725b3c306c262f8793b3133d92810455ab802b3dfd29bc32f7ef49653173ccc7e785cb33b6624ac8c0011eaaa39d426ab591ba160

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-13315.exe

Filesize
468KB

MD5
fe26859d66e5d17736ec73980a47b0d7

SHA1
65e9aafc0119fdfa70c08e3a6843ac5993bc1835

SHA256
0cf0e0ceccc2733c85a84f2799784f9b38704c9dc9ea040919a4fcd64ca7f9ea

SHA512
a1fdfa4c7569eb55bad572f66c1f52302f255ce56b67ce643952a99e44dea2430aa612a36b7afed94fed82f8ce5c5fce5bce1759e2383e0412ee0cd7ca078e26

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-14258.exe

Filesize
468KB

MD5
b53a8f27f3ca859e0c7671df0ee956f2

SHA1
972b080a2a143678cb9adb5f83ff4cc4a0cea092

SHA256
cdd029509301a4d24904d8238e4f357cf480676229cc74ae0aeae4d8b3140ba4

SHA512
2671f72b69bb8c23cf7a09e44df67113ca17354a6e5432e1da05c68a5cf620c20f3bfe040ad9bfcc671755ddf1e6673c442e44c939e52617a6cb24a651e87ff9

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-14913.exe

Filesize
468KB

MD5
f7e05367f006c05b9a3b0a94182b410a

SHA1
e98e61a6c5f8e4a8bfdb13e315c7d5e337407cb2

SHA256
3439ba529458d6a20621c9ef973a877a8d8891047f844f40da7c11454d3a9ac9

SHA512
7d98afb9b5c2e41cf3150fd2da1a5c6a3d5e4931a4e494200befc4655ce8a40a335c21a324005d5315503aee739ed4304d4ede3f7cfff5e404f50be5364e813c

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-16580.exe

Filesize
468KB

MD5
92b99427e777c0ab43d9bef2b0fdb720

SHA1
940e6cc0801b4150ba97cf3dd678fb23979d7a35

SHA256
8c45c077ec5e238ce7dcee4f9d65b30cf885f4d73d68d24f181b213c2383a942

SHA512
6c63e37f01a2fb3a9016f8323c631266d0680818e38bd44b4f08798de1a876ebc88e920d545626bdc3ffadb02e72af43109337f6139a732cd3f32a82783dc450

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-17134.exe

Filesize
468KB

MD5
c91a68861e681c30c5d60d97d574d195

SHA1
0e20eced661d548d1acc01312dfb809014a590bc

SHA256
e7b63f0be93717832d724a5884e8b41288932bb5da27d2c8e753d34b855b4d57

SHA512
50a199b578cc1ae5f4dcc2a75d035bf68aa951375fb4a1dd98f2da92c921824d6c5b9acf6eae4ce809ff6953563ca50235fa861eed8dbf93fe6dae8bc8c36ecc

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-45998.exe

Filesize
468KB

MD5
d8706cce6bd893ff505f837486354bd8

SHA1
db98739a2aa352bfa22d29f8dd66e4688a1771a9

SHA256
eb1b335a6cb3a7e084c5ba6576794b083cb5a0809e2b6f0f0eea005a58f23f6d

SHA512
b67e55af394069a8da4bbf8ddd0118edeb7a5bd8dc0b9faaf2518d72c96784d3d570693d2b521f52b154c2f3e65a0f9b28776695916dd07ad17bd763b34e14c6

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-48209.exe

Filesize
468KB

MD5
cf422b3613b0981474e832eb3377bcf6

SHA1
a0b87ebec90169a27c24c31506fb63272905b595

SHA256
192c94cdaeea9f16a25351ed1e269f18c31746a9b9ee5989b26216bffeb170cb

SHA512
359836b31b9acb2b76a617e0f147a4694bc44c0009ab61dee3de1aba045f9e7ee45ab73401b0816d828ddfcf4c696dcb5d7339312dce3745b993f7139337cc42

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-53419.exe

Filesize
468KB

MD5
3aa0d55af0367738a63b469e1e403561

SHA1
f6c7af1f182e74035d5f733211dfecfe53637829

SHA256
2e4075346e883d55db7a0bbe799b0e1f21475f4b62eb654e565ecca7bafa24c5

SHA512
4be6f09961324371bb1b7d4d0bc04764fd6aecbfa689068b001f7783fcce31f7c95ece8b033c667e093075cb9c20652c3c7258849c2eba23966a40d7c71429a8

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-57337.exe

Filesize
468KB

MD5
3149c9328327a3dc939fdaf661fdda19

SHA1
107285d6d833d3f5923d9e5202a249b511157f5a

SHA256
9bcaaf9ffcdbb0b878ea83fb1d59834794488cb62695f89875afcf6abe09c053

SHA512
f7505849472c0d088397ef8b1990d3e4a274552dbdf9c076b14b43d1202d6548e62f05db5da6b577f7b545292187f87d86b8e8618ce4096ea521ff65f35e77de

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-59070.exe

Filesize
468KB

MD5
64efde63775a9f9e09da6956d130d1a1

SHA1
e46c4bac4cb4796194cdece5010f332d2c6aa894

SHA256
2b77a6cea93e52756aea5d09a665d3ee542431bba9c0b6638c8ec2fc8ed89d7d

SHA512
bb0afda065cfbd7fda71a144bbb0a272a90409d62067c359332b223723b7c095975ec056f01c2b67d8c27b015db3e5224929e67dd9b0ffde16c32428fd3b9587

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-6273.exe

Filesize
468KB

MD5
7ae062869417d6a7cf4b81beab095ac7

SHA1
ed64936406e622c701d1747b8c88841aa317fbe1

SHA256
4eda46989d136e1c5d6eb21e4d85a229edf42c3936c08e644dc9dc61473de20c

SHA512
7377775f38a5f02a0024a9ae7f3074b5c227b023b38acb8f91d31dff7c113d584ba5a6c50592cafdba49773ad5a0c4971c4fa9e5c4767f9cd5563799e348a0b8

Download Submit
memory/768-219-0x0000000001CF0000-0x0000000001D65000-memory.dmp

Filesize
468KB

Download
memory/768-109-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/768-226-0x0000000001CF0000-0x0000000001D65000-memory.dmp

Filesize
468KB

Download
memory/832-213-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/832-367-0x0000000001F30000-0x0000000001FA5000-memory.dmp

Filesize
468KB

Download
memory/1040-299-0x00000000028E0000-0x0000000002955000-memory.dmp

Filesize
468KB

Download
memory/1040-298-0x00000000028E0000-0x0000000002955000-memory.dmp

Filesize
468KB

Download
memory/1040-163-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1080-242-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1080-406-0x0000000003440000-0x00000000034B5000-memory.dmp

Filesize
468KB

Download
memory/1088-258-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1184-278-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/1184-274-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/1476-227-0x0000000002850000-0x00000000028C5000-memory.dmp

Filesize
468KB

Download
memory/1476-228-0x0000000002850000-0x00000000028C5000-memory.dmp

Filesize
468KB

Download
memory/1476-396-0x0000000002850000-0x00000000028C5000-memory.dmp

Filesize
468KB

Download
memory/1476-397-0x0000000002850000-0x00000000028C5000-memory.dmp

Filesize
468KB

Download
memory/1500-407-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1624-200-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1624-345-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/1680-333-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1696-251-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1712-408-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1712-37-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1712-281-0x00000000024F0000-0x0000000002565000-memory.dmp

Filesize
468KB

Download
memory/1712-295-0x00000000024F0000-0x0000000002565000-memory.dmp

Filesize
468KB

Download
memory/1712-145-0x00000000024F0000-0x0000000002565000-memory.dmp

Filesize
468KB

Download
memory/1712-147-0x00000000024F0000-0x0000000002565000-memory.dmp

Filesize
468KB

Download
memory/1804-381-0x0000000002640000-0x00000000026B5000-memory.dmp

Filesize
468KB

Download
memory/1804-229-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1808-168-0x0000000001D50000-0x0000000001DC5000-memory.dmp

Filesize
468KB

Download
memory/1808-31-0x0000000001FC0000-0x0000000002035000-memory.dmp

Filesize
468KB

Download
memory/1808-277-0x0000000001FC0000-0x0000000002035000-memory.dmp

Filesize
468KB

Download
memory/1808-272-0x0000000001FC0000-0x0000000002035000-memory.dmp

Filesize
468KB

Download
memory/1808-13-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1808-57-0x0000000001D50000-0x0000000001DC5000-memory.dmp

Filesize
468KB

Download
memory/1808-162-0x0000000001D50000-0x0000000001DC5000-memory.dmp

Filesize
468KB

Download
memory/1808-382-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1864-331-0x00000000024F0000-0x0000000002565000-memory.dmp

Filesize
468KB

Download
memory/1864-329-0x00000000024F0000-0x0000000002565000-memory.dmp

Filesize
468KB

Download
memory/1972-283-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1976-280-0x00000000026E0000-0x0000000002755000-memory.dmp

Filesize
468KB

Download
memory/1976-275-0x00000000026E0000-0x0000000002755000-memory.dmp

Filesize
468KB

Download
memory/2012-296-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2068-185-0x0000000002530000-0x00000000025A5000-memory.dmp

Filesize
468KB

Download
memory/2068-344-0x0000000002530000-0x00000000025A5000-memory.dmp

Filesize
468KB

Download
memory/2068-346-0x0000000002530000-0x00000000025A5000-memory.dmp

Filesize
468KB

Download
memory/2068-184-0x0000000002530000-0x00000000025A5000-memory.dmp

Filesize
468KB

Download
memory/2100-282-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2224-349-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2336-279-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2396-250-0x0000000002610000-0x0000000002685000-memory.dmp

Filesize
468KB

Download
memory/2396-125-0x0000000002610000-0x0000000002685000-memory.dmp

Filesize
468KB

Download
memory/2396-11-0x0000000002610000-0x0000000002685000-memory.dmp

Filesize
468KB

Download
memory/2396-10-0x0000000002610000-0x0000000002685000-memory.dmp

Filesize
468KB

Download
memory/2396-249-0x0000000002610000-0x0000000002685000-memory.dmp

Filesize
468KB

Download
memory/2396-129-0x0000000002610000-0x0000000002685000-memory.dmp

Filesize
468KB

Download
memory/2396-355-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2396-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2492-305-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2492-415-0x0000000002870000-0x00000000028E5000-memory.dmp

Filesize
468KB

Download
memory/2492-423-0x0000000002870000-0x00000000028E5000-memory.dmp

Filesize
468KB

Download
memory/2520-241-0x00000000007D0000-0x0000000000845000-memory.dmp

Filesize
468KB

Download
memory/2520-48-0x00000000007D0000-0x0000000000845000-memory.dmp

Filesize
468KB

Download
memory/2520-49-0x00000000007D0000-0x0000000000845000-memory.dmp

Filesize
468KB

Download
memory/2520-413-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2520-422-0x00000000007D0000-0x0000000000845000-memory.dmp

Filesize
468KB

Download
memory/2520-36-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2520-236-0x00000000007D0000-0x0000000000845000-memory.dmp

Filesize
468KB

Download
memory/2536-300-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2576-398-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2612-86-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2612-212-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2612-211-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2612-376-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2692-198-0x0000000000560000-0x00000000005D5000-memory.dmp

Filesize
468KB

Download
memory/2692-197-0x0000000000560000-0x00000000005D5000-memory.dmp

Filesize
468KB

Download
memory/2692-98-0x0000000000560000-0x00000000005D5000-memory.dmp

Filesize
468KB

Download
memory/2692-51-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2692-359-0x0000000000560000-0x00000000005D5000-memory.dmp

Filesize
468KB

Download
memory/2704-75-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2704-276-0x0000000002330000-0x00000000023A5000-memory.dmp

Filesize
468KB

Download
memory/2704-273-0x0000000002330000-0x00000000023A5000-memory.dmp

Filesize
468KB

Download
memory/2740-304-0x0000000003200000-0x0000000003275000-memory.dmp

Filesize
468KB

Download
memory/2740-161-0x0000000003200000-0x0000000003275000-memory.dmp

Filesize
468KB

Download
memory/2740-63-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2740-144-0x0000000003200000-0x0000000003275000-memory.dmp

Filesize
468KB

Download
memory/2740-297-0x0000000003200000-0x0000000003275000-memory.dmp

Filesize
468KB

Download
memory/2756-380-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2872-368-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2892-383-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2956-350-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2984-360-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3040-170-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3040-257-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/3040-253-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download