25a41fef9d1aa35483b445c4c09705ac4af1378c4527cfd05eb00f11f2c0ad71

Analysis

max time kernel
120s
max time network
108s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
09-10-2024 06:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

25a41fef9d1aa35483b445c4c09705ac4af1378c4527cfd05eb00f11f2c0ad71N.exe
Size

468KB
MD5

cfb3714848485608e0ad9e0abaac9630
SHA1

93d603c4034332f93d71b92b650e935f5c3c8db5
SHA256

25a41fef9d1aa35483b445c4c09705ac4af1378c4527cfd05eb00f11f2c0ad71
SHA512

a29ad9dc861a669e5700943c967943d39ecb9fe6442df9856ef1532e087fa75ef0d43d60f467217232187add89807d7f734de66639b71e246c7e06d66bf91a78
SSDEEP

3072:SqGtogUxt08UfbY9PzsyqfU/Ekhjj+pxPmHXLVIDdQRGpdhNaOlU:Sq0oB5Uf+Poyqf0uaodQMDhNa

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2020	Unicorn-10894.exe
2836	Unicorn-3022.exe
2456	Unicorn-31288.exe
4836	Unicorn-56146.exe
1232	Unicorn-40879.exe
3400	Unicorn-18412.exe
3708	Unicorn-21013.exe
4588	Unicorn-50578.exe
2916	Unicorn-7085.exe
2984	Unicorn-19167.exe
640	Unicorn-55518.exe
2164	Unicorn-43680.exe
4404	Unicorn-9846.exe
2960	Unicorn-34278.exe
1676	Unicorn-42706.exe
2152	Unicorn-7573.exe
3644	Unicorn-19847.exe
3996	Unicorn-62533.exe
4844	Unicorn-22264.exe
1276	Unicorn-18887.exe
2172	Unicorn-9301.exe
2664	Unicorn-29167.exe
4560	Unicorn-55517.exe
4224	Unicorn-4278.exe
4272	Unicorn-61647.exe
316	Unicorn-58310.exe
3364	Unicorn-43977.exe
2968	Unicorn-20044.exe
4488	Unicorn-37143.exe
4972	Unicorn-27351.exe
2180	Unicorn-59831.exe
2232	Unicorn-56494.exe
4908	Unicorn-4692.exe
2328	Unicorn-11398.exe
3096	Unicorn-7677.exe
3388	Unicorn-34377.exe
4656	Unicorn-21412.exe
116	Unicorn-34642.exe
4936	Unicorn-1429.exe
3680	Unicorn-36562.exe
780	Unicorn-30039.exe
2076	Unicorn-14588.exe
2316	Unicorn-28887.exe
3516	Unicorn-45031.exe
60	Unicorn-9213.exe
4552	Unicorn-61751.exe
4012	Unicorn-22948.exe
3548	Unicorn-29079.exe
3108	Unicorn-23023.exe
3928	Unicorn-31191.exe
1044	Unicorn-52358.exe
388	Unicorn-11325.exe
2932	Unicorn-63671.exe
4892	Unicorn-38205.exe
3848	Unicorn-22566.exe
1148	Unicorn-47149.exe
4432	Unicorn-22831.exe
4964	Unicorn-60334.exe
4100	Unicorn-39864.exe
776	Unicorn-36295.exe
2024	Unicorn-38407.exe
1664	Unicorn-13518.exe
3936	Unicorn-13902.exe
2096	Unicorn-59574.exe

Program crash 6 IoCs

pid	pid_target	Process	procid_target
5348	3548	WerFault.exe	131
8808	5776	WerFault.exe	233
8420	6244	WerFault.exe	281
11180	6252	WerFault.exe	282
13884	13944	WerFault.exe	741
16372	6296	WerFault.exe	388

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16516.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65106.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45527.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15244.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5315.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13902.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8940.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35405.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48300.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26168.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23691.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27351.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24759.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50343.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-300.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33042.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2812.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32058.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42979.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33748.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22215.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18821.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19819.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11634.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34948.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45031.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8733.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42973.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60477.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11969.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15244.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1429.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35405.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6485.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51339.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49468.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15244.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42732.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28563.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56494.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55438.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29295.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40014.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15509.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26194.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29079.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36045.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6107.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28541.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49767.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26927.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49005.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7085.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9213.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6861.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14476.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30981.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40803.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64636.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43680.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33917.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40151.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	6280	dwm.exe
Token: SeChangeNotifyPrivilege	6280	dwm.exe
Token: 33	6280	dwm.exe
Token: SeIncBasePriorityPrivilege	6280	dwm.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
5028	25a41fef9d1aa35483b445c4c09705ac4af1378c4527cfd05eb00f11f2c0ad71N.exe
2020	Unicorn-10894.exe
2836	Unicorn-3022.exe
2456	Unicorn-31288.exe
4836	Unicorn-56146.exe
3400	Unicorn-18412.exe
1232	Unicorn-40879.exe
3708	Unicorn-21013.exe
4588	Unicorn-50578.exe
2916	Unicorn-7085.exe
2984	Unicorn-19167.exe
640	Unicorn-55518.exe
2960	Unicorn-34278.exe
2164	Unicorn-43680.exe
4404	Unicorn-9846.exe
1676	Unicorn-42706.exe
2152	Unicorn-7573.exe
3644	Unicorn-19847.exe
3996	Unicorn-62533.exe
4844	Unicorn-22264.exe
1276	Unicorn-18887.exe
2172	Unicorn-9301.exe
2664	Unicorn-29167.exe
3364	Unicorn-43977.exe
316	Unicorn-58310.exe
4224	Unicorn-4278.exe
4560	Unicorn-55517.exe
4272	Unicorn-61647.exe
2968	Unicorn-20044.exe
4488	Unicorn-37143.exe
4972	Unicorn-27351.exe
2180	Unicorn-59831.exe
4908	Unicorn-4692.exe
2232	Unicorn-56494.exe
2328	Unicorn-11398.exe
3096	Unicorn-7677.exe
3388	Unicorn-34377.exe
4656	Unicorn-21412.exe
116	Unicorn-34642.exe
4936	Unicorn-1429.exe
3680	Unicorn-36562.exe
780	Unicorn-30039.exe
2316	Unicorn-28887.exe
2076	Unicorn-14588.exe
3516	Unicorn-45031.exe
60	Unicorn-9213.exe
4552	Unicorn-61751.exe
3108	Unicorn-23023.exe
3548	Unicorn-29079.exe
4012	Unicorn-22948.exe
3928	Unicorn-31191.exe
1044	Unicorn-52358.exe
388	Unicorn-11325.exe
2932	Unicorn-63671.exe
4964	Unicorn-60334.exe
1148	Unicorn-47149.exe
4432	Unicorn-22831.exe
3848	Unicorn-22566.exe
4892	Unicorn-38205.exe
4100	Unicorn-39864.exe
776	Unicorn-36295.exe
1664	Unicorn-13518.exe
2024	Unicorn-38407.exe
2096	Unicorn-59574.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5028 wrote to memory of 2020	5028	25a41fef9d1aa35483b445c4c09705ac4af1378c4527cfd05eb00f11f2c0ad71N.exe	86
PID 5028 wrote to memory of 2020	5028	25a41fef9d1aa35483b445c4c09705ac4af1378c4527cfd05eb00f11f2c0ad71N.exe	86
PID 5028 wrote to memory of 2020	5028	25a41fef9d1aa35483b445c4c09705ac4af1378c4527cfd05eb00f11f2c0ad71N.exe	86
PID 2020 wrote to memory of 2836	2020	Unicorn-10894.exe	87
PID 2020 wrote to memory of 2836	2020	Unicorn-10894.exe	87
PID 2020 wrote to memory of 2836	2020	Unicorn-10894.exe	87
PID 5028 wrote to memory of 2456	5028	25a41fef9d1aa35483b445c4c09705ac4af1378c4527cfd05eb00f11f2c0ad71N.exe	88
PID 5028 wrote to memory of 2456	5028	25a41fef9d1aa35483b445c4c09705ac4af1378c4527cfd05eb00f11f2c0ad71N.exe	88
PID 5028 wrote to memory of 2456	5028	25a41fef9d1aa35483b445c4c09705ac4af1378c4527cfd05eb00f11f2c0ad71N.exe	88
PID 2836 wrote to memory of 4836	2836	Unicorn-3022.exe	89
PID 2836 wrote to memory of 4836	2836	Unicorn-3022.exe	89
PID 2836 wrote to memory of 4836	2836	Unicorn-3022.exe	89
PID 2456 wrote to memory of 1232	2456	Unicorn-31288.exe	91
PID 2456 wrote to memory of 1232	2456	Unicorn-31288.exe	91
PID 2456 wrote to memory of 1232	2456	Unicorn-31288.exe	91
PID 5028 wrote to memory of 3400	5028	25a41fef9d1aa35483b445c4c09705ac4af1378c4527cfd05eb00f11f2c0ad71N.exe	92
PID 5028 wrote to memory of 3400	5028	25a41fef9d1aa35483b445c4c09705ac4af1378c4527cfd05eb00f11f2c0ad71N.exe	92
PID 5028 wrote to memory of 3400	5028	25a41fef9d1aa35483b445c4c09705ac4af1378c4527cfd05eb00f11f2c0ad71N.exe	92
PID 2020 wrote to memory of 3708	2020	Unicorn-10894.exe	90
PID 2020 wrote to memory of 3708	2020	Unicorn-10894.exe	90
PID 2020 wrote to memory of 3708	2020	Unicorn-10894.exe	90
PID 4836 wrote to memory of 4588	4836	Unicorn-56146.exe	93
PID 4836 wrote to memory of 4588	4836	Unicorn-56146.exe	93
PID 4836 wrote to memory of 4588	4836	Unicorn-56146.exe	93
PID 2836 wrote to memory of 2916	2836	Unicorn-3022.exe	94
PID 2836 wrote to memory of 2916	2836	Unicorn-3022.exe	94
PID 2836 wrote to memory of 2916	2836	Unicorn-3022.exe	94
PID 1232 wrote to memory of 2984	1232	Unicorn-40879.exe	95
PID 1232 wrote to memory of 2984	1232	Unicorn-40879.exe	95
PID 1232 wrote to memory of 2984	1232	Unicorn-40879.exe	95
PID 2456 wrote to memory of 640	2456	Unicorn-31288.exe	96
PID 2456 wrote to memory of 640	2456	Unicorn-31288.exe	96
PID 2456 wrote to memory of 640	2456	Unicorn-31288.exe	96
PID 3708 wrote to memory of 4404	3708	Unicorn-21013.exe	98
PID 3708 wrote to memory of 4404	3708	Unicorn-21013.exe	98
PID 3708 wrote to memory of 4404	3708	Unicorn-21013.exe	98
PID 2020 wrote to memory of 2164	2020	Unicorn-10894.exe	97
PID 2020 wrote to memory of 2164	2020	Unicorn-10894.exe	97
PID 2020 wrote to memory of 2164	2020	Unicorn-10894.exe	97
PID 5028 wrote to memory of 2960	5028	25a41fef9d1aa35483b445c4c09705ac4af1378c4527cfd05eb00f11f2c0ad71N.exe	99
PID 5028 wrote to memory of 2960	5028	25a41fef9d1aa35483b445c4c09705ac4af1378c4527cfd05eb00f11f2c0ad71N.exe	99
PID 5028 wrote to memory of 2960	5028	25a41fef9d1aa35483b445c4c09705ac4af1378c4527cfd05eb00f11f2c0ad71N.exe	99
PID 4588 wrote to memory of 1676	4588	Unicorn-50578.exe	100
PID 4588 wrote to memory of 1676	4588	Unicorn-50578.exe	100
PID 4588 wrote to memory of 1676	4588	Unicorn-50578.exe	100
PID 4836 wrote to memory of 2152	4836	Unicorn-56146.exe	101
PID 4836 wrote to memory of 2152	4836	Unicorn-56146.exe	101
PID 4836 wrote to memory of 2152	4836	Unicorn-56146.exe	101
PID 2916 wrote to memory of 3644	2916	Unicorn-7085.exe	102
PID 2916 wrote to memory of 3644	2916	Unicorn-7085.exe	102
PID 2916 wrote to memory of 3644	2916	Unicorn-7085.exe	102
PID 2836 wrote to memory of 3996	2836	Unicorn-3022.exe	103
PID 2836 wrote to memory of 3996	2836	Unicorn-3022.exe	103
PID 2836 wrote to memory of 3996	2836	Unicorn-3022.exe	103
PID 3400 wrote to memory of 4844	3400	Unicorn-18412.exe	104
PID 3400 wrote to memory of 4844	3400	Unicorn-18412.exe	104
PID 3400 wrote to memory of 4844	3400	Unicorn-18412.exe	104
PID 2984 wrote to memory of 1276	2984	Unicorn-19167.exe	105
PID 2984 wrote to memory of 1276	2984	Unicorn-19167.exe	105
PID 2984 wrote to memory of 1276	2984	Unicorn-19167.exe	105
PID 1232 wrote to memory of 2172	1232	Unicorn-40879.exe	106
PID 1232 wrote to memory of 2172	1232	Unicorn-40879.exe	106
PID 1232 wrote to memory of 2172	1232	Unicorn-40879.exe	106
PID 640 wrote to memory of 2664	640	Unicorn-55518.exe	107

C:\Users\Admin\AppData\Local\Temp\25a41fef9d1aa35483b445c4c09705ac4af1378c4527cfd05eb00f11f2c0ad71N.exe
"C:\Users\Admin\AppData\Local\Temp\25a41fef9d1aa35483b445c4c09705ac4af1378c4527cfd05eb00f11f2c0ad71N.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5028
- C:\Users\Admin\AppData\Local\Temp\Unicorn-10894.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-10894.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2020
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3022.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3022.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56146.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56146.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50578.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42706.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27351.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36295.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38703.exe
        9⤵
        
        PID:5956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45527.exe
        10⤵
        
        PID:5772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34407.exe
        11⤵
        
        PID:10856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26927.exe
        12⤵
        
        PID:15132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25995.exe
        12⤵
        
        PID:14856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56804.exe
        11⤵
        
        PID:13532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22635.exe
        11⤵
        
        PID:4916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47598.exe
        10⤵
        
        PID:10864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59629.exe
        10⤵
        
        PID:15276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26835.exe
        10⤵
        
        PID:5636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24888.exe
        9⤵
        
        PID:7172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60477.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:11448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62895.exe
        10⤵
        
        PID:15864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26194.exe
        10⤵
        
        PID:6336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34811.exe
        9⤵
        
        PID:15708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2501.exe
        8⤵
        
        PID:6004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21023.exe
        9⤵
        
        PID:5852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31698.exe
        10⤵
        
        PID:7336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-326.exe
        11⤵
        
        PID:15544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32261.exe
        11⤵
        
        PID:15512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35488.exe
        10⤵
        
        PID:15260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40757.exe
        10⤵
        
        PID:15676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4920.exe
        9⤵
        
        PID:10524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59629.exe
        9⤵
        
        PID:15168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28563.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:14948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38624.exe
        8⤵
        
        PID:7220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7622.exe
        9⤵
        
        PID:13848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40757.exe
        9⤵
        
        PID:4692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35974.exe
        8⤵
        
        PID:11588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19444.exe
        8⤵
        
        PID:14252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2349.exe
        8⤵
        
        PID:14540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59574.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15735.exe
        8⤵
        
        PID:5264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27492.exe
        9⤵
        
        PID:9528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45769.exe
        9⤵
        
        PID:13832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47139.exe
        9⤵
        
        PID:15700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60166.exe
        8⤵
        
        PID:8196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20487.exe
        9⤵
        
        PID:11372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29294.exe
        10⤵
        
        PID:16092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48971.exe
        10⤵
        
        PID:14848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42485.exe
        9⤵
        
        PID:8412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31452.exe
        8⤵
        
        PID:12092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18091.exe
        8⤵
        
        PID:3368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25748.exe
        7⤵
        
        PID:5804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51303.exe
        8⤵
        
        PID:7620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21143.exe
        9⤵
        
        PID:9964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54830.exe
        9⤵
        
        PID:13520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11058.exe
        9⤵
        
        PID:16140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22813.exe
        8⤵
        
        PID:11076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20708.exe
        8⤵
        
        PID:14084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53014.exe
        8⤵
        
        PID:15040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30611.exe
        8⤵
        
        PID:15900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22964.exe
        7⤵
        
        PID:8320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28845.exe
        7⤵
        
        PID:11184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23083.exe
        7⤵
        
        PID:5320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56494.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13518.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31111.exe
        8⤵
        
        PID:6028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4494.exe
        9⤵
        
        PID:7084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40551.exe
        10⤵
        
        PID:10072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26927.exe
        11⤵
        System Location Discovery: System Language Discovery
        
        PID:15084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27597.exe
        11⤵
        
        PID:16900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38093.exe
        10⤵
        
        PID:13724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62206.exe
        9⤵
        
        PID:10268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28110.exe
        9⤵
        
        PID:6504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5315.exe
        9⤵
        
        PID:9596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50654.exe
        8⤵
        
        PID:6212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27503.exe
        9⤵
        
        PID:15168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8509.exe
        9⤵
        
        PID:13508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27970.exe
        9⤵
        
        PID:13668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21064.exe
        8⤵
        
        PID:13060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45091.exe
        8⤵
        
        PID:15512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19221.exe
        7⤵
        
        PID:6076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1142.exe
        8⤵
        
        PID:7544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6254.exe
        9⤵
        
        PID:13020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56940.exe
        9⤵
        
        PID:8212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39341.exe
        8⤵
        
        PID:11236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43063.exe
        8⤵
        
        PID:15820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62684.exe
        8⤵
        
        PID:8316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15293.exe
        7⤵
        
        PID:3432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6844.exe
        7⤵
        
        PID:13232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13078.exe
        7⤵
        
        PID:15536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48805.exe
        6⤵
        
        PID:2140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64743.exe
        7⤵
        
        PID:5232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26991.exe
        8⤵
        
        PID:6640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16047.exe
        9⤵
        
        PID:10056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38093.exe
        9⤵
        
        PID:13716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5315.exe
        9⤵
        
        PID:14160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54038.exe
        8⤵
        
        PID:10248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20357.exe
        9⤵
        
        PID:4540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63886.exe
        9⤵
        
        PID:2548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3692.exe
        8⤵
        
        PID:14356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49501.exe
        8⤵
        
        PID:5504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25764.exe
        7⤵
        
        PID:8228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49501.exe
        8⤵
        
        PID:2748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15509.exe
        7⤵
        
        PID:13240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26835.exe
        7⤵
        
        PID:15668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48142.exe
        6⤵
        
        PID:5212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50343.exe
        7⤵
        
        PID:7404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33042.exe
        8⤵
        
        PID:9288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34362.exe
        9⤵
        
        PID:14876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60014.exe
        8⤵
        
        PID:14280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13891.exe
        8⤵
        
        PID:4772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14733.exe
        7⤵
        
        PID:10668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6140.exe
        6⤵
        
        PID:5832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15510.exe
        7⤵
        
        PID:2972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40227.exe
        7⤵
        
        PID:16028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12309.exe
        6⤵
        
        PID:11948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7573.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59831.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4316.exe
        7⤵
        
        PID:4956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17671.exe
        8⤵
        
        PID:7660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21021.exe
        9⤵
        
        PID:15692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46293.exe
        9⤵
        
        PID:3484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48587.exe
        9⤵
        
        PID:4416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39341.exe
        8⤵
        
        PID:11188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5723.exe
        8⤵
        
        PID:8372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54686.exe
        7⤵
        
        PID:7024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28652.exe
        7⤵
        
        PID:12056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33381.exe
        7⤵
        
        PID:15820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16747.exe
        7⤵
        
        PID:8152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34109.exe
        6⤵
        
        PID:4976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23135.exe
        7⤵
        
        PID:5864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9502.exe
        8⤵
        
        PID:7424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17687.exe
        9⤵
        
        PID:11048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18591.exe
        9⤵
        
        PID:15568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8421.exe
        9⤵
        
        PID:15492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36138.exe
        9⤵
        
        PID:12280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32604.exe
        8⤵
        
        PID:13100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49443.exe
        8⤵
        
        PID:3684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25764.exe
        7⤵
        
        PID:7776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40014.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:13160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19819.exe
        7⤵
        
        PID:6216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35453.exe
        6⤵
        
        PID:5776
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5776 -s 632
        7⤵
        Program crash
        
        PID:8808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55646.exe
        6⤵
        
        PID:7872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63525.exe
        6⤵
        
        PID:10132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48829.exe
        6⤵
        
        PID:13668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19974.exe
        6⤵
        
        PID:15168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36181.exe
        6⤵
        
        PID:820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63564.exe
        6⤵
        
        PID:14928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4692.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51510.exe
        6⤵
        
        PID:5856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21023.exe
        7⤵
        
        PID:5308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40551.exe
        8⤵
        
        PID:10064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51549.exe
        8⤵
        
        PID:15124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23902.exe
        8⤵
        
        PID:15860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-300.exe
        8⤵
        
        PID:15432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56045.exe
        7⤵
        
        PID:11240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51339.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:13848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64197.exe
        6⤵
        
        PID:6664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49069.exe
        7⤵
        
        PID:8248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-805.exe
        6⤵
        
        PID:11420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48300.exe
        6⤵
        
        PID:4696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13637.exe
        5⤵
        
        PID:2760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15735.exe
        6⤵
        
        PID:5236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4790.exe
        7⤵
        
        PID:7380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19226.exe
        8⤵
        
        PID:15356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-124.exe
        7⤵
        
        PID:13028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6589.exe
        7⤵
        
        PID:16132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4931.exe
        7⤵
        
        PID:16908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48837.exe
        6⤵
        
        PID:9608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45769.exe
        6⤵
        
        PID:13380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64636.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:15488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22372.exe
        5⤵
        
        PID:5872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23727.exe
        6⤵
        
        PID:7516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27119.exe
        7⤵
        
        PID:15148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25995.exe
        7⤵
        
        PID:2864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61446.exe
        6⤵
        
        PID:13140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56565.exe
        6⤵
        
        PID:15212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20954.exe
        6⤵
        
        PID:12884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54006.exe
        5⤵
        
        PID:9728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6030.exe
        5⤵
        
        PID:13552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4323.exe
        5⤵
        
        PID:7584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7085.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7085.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19847.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39864.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53970.exe
        7⤵
        
        PID:5880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37743.exe
        8⤵
        
        PID:6320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9902.exe
        9⤵
        
        PID:11020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45894.exe
        9⤵
        
        PID:13668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13891.exe
        9⤵
        
        PID:15936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4920.exe
        8⤵
        
        PID:10516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20395.exe
        8⤵
        
        PID:1868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18365.exe
        7⤵
        
        PID:7300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55079.exe
        8⤵
        
        PID:12952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40757.exe
        8⤵
        
        PID:15444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5988.exe
        7⤵
        
        PID:11656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40741.exe
        6⤵
        
        PID:5976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50898.exe
        7⤵
        
        PID:6712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8838.exe
        8⤵
        
        PID:980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36469.exe
        8⤵
        
        PID:14564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59202.exe
        8⤵
        
        PID:15356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19226.exe
        8⤵
        
        PID:16128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46062.exe
        7⤵
        
        PID:9440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61582.exe
        8⤵
        
        PID:3416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26874.exe
        8⤵
        
        PID:16800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28110.exe
        7⤵
        
        PID:14036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37307.exe
        7⤵
        
        PID:6348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52382.exe
        6⤵
        
        PID:7628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35287.exe
        7⤵
        
        PID:15056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36781.exe
        7⤵
        
        PID:15952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50621.exe
        7⤵
        
        PID:16052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40227.exe
        7⤵
        
        PID:3280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33748.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7677.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54935.exe
        6⤵
        
        PID:4632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16119.exe
        7⤵
        
        PID:5256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51997.exe
        8⤵
        
        PID:8936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35287.exe
        9⤵
        
        PID:15096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32435.exe
        9⤵
        
        PID:9508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55189.exe
        8⤵
        
        PID:12884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42979.exe
        8⤵
        
        PID:16072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36045.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14239.exe
        7⤵
        
        PID:11968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59700.exe
        7⤵
        
        PID:10728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54966.exe
        6⤵
        
        PID:5984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51997.exe
        7⤵
        
        PID:8668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54046.exe
        7⤵
        
        PID:11672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51339.exe
        7⤵
        
        PID:7296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7125.exe
        6⤵
        
        PID:8404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6750.exe
        7⤵
        
        PID:14600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51478.exe
        7⤵
        
        PID:16352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58629.exe
        7⤵
        
        PID:16340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6844.exe
        6⤵
        
        PID:13236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40132.exe
        6⤵
        
        PID:4824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47653.exe
        5⤵
        
        PID:2224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31983.exe
        6⤵
        
        PID:6364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4982.exe
        7⤵
        
        PID:8116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-730.exe
        8⤵
        
        PID:8380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6861.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:11292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38779.exe
        7⤵
        
        PID:3472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27492.exe
        6⤵
        
        PID:9256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55006.exe
        6⤵
        
        PID:13460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36326.exe
        5⤵
        
        PID:6180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33431.exe
        6⤵
        
        PID:9368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35405.exe
        6⤵
        
        PID:13492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63245.exe
        6⤵
        
        PID:15604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13891.exe
        6⤵
        
        PID:16204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32196.exe
        5⤵
        
        PID:10100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12696.exe
        5⤵
        
        PID:13920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19974.exe
        5⤵
        
        PID:15316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4275.exe
        5⤵
        
        PID:15460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62533.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62533.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11398.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38407.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63591.exe
        7⤵
        
        PID:6056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10654.exe
        8⤵
        
        PID:7668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33042.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:9244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11580.exe
        9⤵
        
        PID:14156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14733.exe
        8⤵
        
        PID:10660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19819.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:8004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44214.exe
        7⤵
        
        PID:7696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24919.exe
        8⤵
        
        PID:15292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37317.exe
        7⤵
        
        PID:11832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42979.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33336.exe
        6⤵
        
        PID:4448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9886.exe
        7⤵
        
        PID:7708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23087.exe
        8⤵
        
        PID:14408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41333.exe
        8⤵
        
        PID:4420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22813.exe
        7⤵
        
        PID:10928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49443.exe
        7⤵
        
        PID:6172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8364.exe
        6⤵
        
        PID:8204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50855.exe
        7⤵
        
        PID:15332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32058.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35014.exe
        6⤵
        
        PID:11816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25908.exe
        6⤵
        
        PID:14000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40165.exe
        5⤵
        
        PID:3984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4494.exe
        6⤵
        
        PID:7092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4318.exe
        7⤵
        
        PID:8548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33101.exe
        7⤵
        
        PID:11908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19226.exe
        7⤵
        
        PID:15608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5397.exe
        6⤵
        
        PID:9320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59599.exe
        7⤵
        
        PID:15184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61093.exe
        7⤵
        
        PID:2532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18821.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:15712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7938.exe
        7⤵
        
        PID:8400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49141.exe
        6⤵
        
        PID:13420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28110.exe
        6⤵
        
        PID:14160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51339.exe
        6⤵
        
        PID:15300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4717.exe
        5⤵
        
        PID:8136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56335.exe
        6⤵
        
        PID:14668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54358.exe
        6⤵
        
        PID:13944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23691.exe
        6⤵
        
        PID:15664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26156.exe
        5⤵
        
        PID:10536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34374.exe
        5⤵
        
        PID:16180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30099.exe
        5⤵
        
        PID:2148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34377.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34377.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51894.exe
        5⤵
        
        PID:6040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1142.exe
        6⤵
        
        PID:7500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59103.exe
        7⤵
        
        PID:10948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24363.exe
        7⤵
        
        PID:608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17805.exe
        6⤵
        
        PID:11172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40227.exe
        7⤵
        
        PID:15772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19748.exe
        6⤵
        
        PID:14620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8468.exe
        6⤵
        
        PID:12264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38829.exe
        5⤵
        
        PID:10116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36575.exe
        6⤵
        
        PID:15392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62540.exe
        6⤵
        
        PID:7616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57382.exe
        5⤵
        
        PID:13632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31957.exe
        5⤵
        
        PID:14476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33692.exe
        5⤵
        
        PID:6200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45045.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45045.exe
      4⤵
      PID:4884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4333.exe
        5⤵
        
        PID:6488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42973.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49276.exe
        7⤵
        
        PID:2068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38944.exe
        6⤵
        
        PID:12120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16195.exe
        6⤵
        
        PID:6532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32484.exe
        5⤵
        
        PID:8072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14422.exe
        6⤵
        
        PID:13212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32589.exe
        6⤵
        
        PID:2524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29150.exe
        5⤵
        
        PID:12132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54111.exe
        5⤵
        
        PID:15464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16588.exe
        5⤵
        
        PID:5244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31384.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31384.exe
      4⤵
      PID:5460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51997.exe
        5⤵
        
        PID:8532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48863.exe
        6⤵
        
        PID:15636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64509.exe
        5⤵
        
        PID:14304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38214.exe
        5⤵
        
        PID:6628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24043.exe
        5⤵
        
        PID:2176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46551.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46551.exe
      4⤵
      PID:8028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65021.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65021.exe
      4⤵
      PID:12124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64395.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64395.exe
      4⤵
      PID:8064
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21013.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21013.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9846.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9846.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37143.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63671.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65106.exe
        7⤵
        
        PID:5448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21023.exe
        8⤵
        
        PID:5516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40722.exe
        9⤵
        
        PID:9224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35405.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:13428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5315.exe
        9⤵
        
        PID:14864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11940.exe
        8⤵
        
        PID:10820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64030.exe
        8⤵
        
        PID:14160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56468.exe
        8⤵
        
        PID:548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24888.exe
        7⤵
        
        PID:7188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53077.exe
        7⤵
        
        PID:9396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61686.exe
        6⤵
        
        PID:5528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4494.exe
        7⤵
        
        PID:7100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49487.exe
        8⤵
        
        PID:2772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27725.exe
        8⤵
        
        PID:14460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63381.exe
        8⤵
        
        PID:15960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19226.exe
        8⤵
        
        PID:16232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3000.exe
        7⤵
        
        PID:10360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59629.exe
        7⤵
        
        PID:11248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41143.exe
        7⤵
        
        PID:15812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12227.exe
        7⤵
        
        PID:14840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64389.exe
        6⤵
        
        PID:8184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10206.exe
        7⤵
        
        PID:15004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11634.exe
        7⤵
        
        PID:6312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26462.exe
        6⤵
        
        PID:11284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48300.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:13148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60334.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8806.exe
        6⤵
        
        PID:5464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37359.exe
        7⤵
        
        PID:7148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40722.exe
        8⤵
        
        PID:9088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49468.exe
        9⤵
        
        PID:3504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35405.exe
        8⤵
        
        PID:13484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48573.exe
        8⤵
        
        PID:14664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6107.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2812.exe
        7⤵
        
        PID:10996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24888.exe
        6⤵
        
        PID:7204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30108.exe
        6⤵
        
        PID:11596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28110.exe
        6⤵
        
        PID:14296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9884.exe
        5⤵
        
        PID:5520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1894.exe
        6⤵
        
        PID:6152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60239.exe
        7⤵
        
        PID:7912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32604.exe
        7⤵
        
        PID:13116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13891.exe
        7⤵
        
        PID:4988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9149.exe
        6⤵
        
        PID:8540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57636.exe
        7⤵
        
        PID:16280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57301.exe
        6⤵
        
        PID:13260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47997.exe
        6⤵
        
        PID:15656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14275.exe
        6⤵
        
        PID:5756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10669.exe
        5⤵
        
        PID:6792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31314.exe
        6⤵
        
        PID:10040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51549.exe
        6⤵
        
        PID:15116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58341.exe
        5⤵
        
        PID:10004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12443.exe
        5⤵
        
        PID:840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58310.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58310.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45031.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23223.exe
        6⤵
        
        PID:4596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-846.exe
        7⤵
        
        PID:6672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17583.exe
        8⤵
        
        PID:9984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35509.exe
        8⤵
        
        PID:14020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40757.exe
        8⤵
        
        PID:2304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46062.exe
        7⤵
        
        PID:9092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28110.exe
        7⤵
        
        PID:13488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18475.exe
        7⤵
        
        PID:17012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38837.exe
        6⤵
        
        PID:7596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49767.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:9356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26194.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35405.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:13468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41757.exe
        7⤵
        
        PID:16296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38058.exe
        7⤵
        
        PID:5668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19620.exe
        6⤵
        
        PID:4744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10738.exe
        7⤵
        
        PID:12252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6485.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:14572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42744.exe
        5⤵
        
        PID:4740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35143.exe
        6⤵
        
        PID:6256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42973.exe
        7⤵
        
        PID:8776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59599.exe
        8⤵
        
        PID:15204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42174.exe
        8⤵
        
        PID:15484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32634.exe
        8⤵
        
        PID:11248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40773.exe
        7⤵
        
        PID:13080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47139.exe
        7⤵
        
        PID:3480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18749.exe
        6⤵
        
        PID:8080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31452.exe
        6⤵
        
        PID:12100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21332.exe
        5⤵
        
        PID:6756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1438.exe
        6⤵
        
        PID:9340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60014.exe
        6⤵
        
        PID:14156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38779.exe
        6⤵
        
        PID:6616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-125.exe
        5⤵
        
        PID:9240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-892.exe
        5⤵
        
        PID:11828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62684.exe
        5⤵
        
        PID:9144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22948.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22948.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24759.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21023.exe
        6⤵
        
        PID:5208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23663.exe
        7⤵
        
        PID:14652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4426.exe
        7⤵
        
        PID:380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22709.exe
        6⤵
        
        PID:10872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34948.exe
        6⤵
        
        PID:15636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24888.exe
        5⤵
        
        PID:7212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44717.exe
        5⤵
        
        PID:11540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5333.exe
        5⤵
        
        PID:15432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4059.exe
        5⤵
        
        PID:8340
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8733.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8733.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4494.exe
        5⤵
        
        PID:7108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48615.exe
        6⤵
        
        PID:9480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16603.exe
        7⤵
        
        PID:9292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26168.exe
        6⤵
        
        PID:13524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64395.exe
        6⤵
        
        PID:8476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62102.exe
        5⤵
        
        PID:9996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40501.exe
        5⤵
        
        PID:11652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11058.exe
        5⤵
        
        PID:15856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61589.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61589.exe
      4⤵
      PID:8164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1261.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1261.exe
      4⤵
      PID:11360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45500.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45500.exe
      4⤵
      PID:4872
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43680.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43680.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4278.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4278.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29079.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3548
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3548 -s 636
        6⤵
        Program crash
        
        PID:5348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45241.exe
        5⤵
        
        PID:5432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21023.exe
        6⤵
        
        PID:5848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17095.exe
        7⤵
        
        PID:9432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26168.exe
        7⤵
        
        PID:13540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13891.exe
        7⤵
        
        PID:2468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51158.exe
        6⤵
        
        PID:11328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46046.exe
        5⤵
        
        PID:8972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42531.exe
        6⤵
        
        PID:2144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52397.exe
        5⤵
        
        PID:13188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20885.exe
        5⤵
        
        PID:16284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15244.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11325.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11325.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62994.exe
        5⤵
        
        PID:3156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40151.exe
        6⤵
        
        PID:6420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21511.exe
        7⤵
        
        PID:5384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40803.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:16380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46742.exe
        7⤵
        
        PID:11428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38779.exe
        7⤵
        
        PID:4612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-300.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58099.exe
        7⤵
        
        PID:8336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15509.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:13256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26835.exe
        6⤵
        
        PID:16160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30948.exe
        5⤵
        
        PID:7316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50582.exe
        5⤵
        
        PID:11516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19444.exe
        5⤵
        
        PID:14464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47724.exe
        5⤵
        
        PID:5740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58592.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58592.exe
      4⤵
      PID:5312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21023.exe
        5⤵
        
        PID:5912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33431.exe
        6⤵
        
        PID:9384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35405.exe
        6⤵
        
        PID:13508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48381.exe
        6⤵
        
        PID:924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10125.exe
        5⤵
        
        PID:11312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15244.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44489.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44489.exe
      4⤵
      PID:7228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1838.exe
        5⤵
        
        PID:9956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19226.exe
        5⤵
        
        PID:15176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57677.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57677.exe
      4⤵
      PID:11480
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53070.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53070.exe
      4⤵
      PID:13848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29523.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29523.exe
      4⤵
      PID:532
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43977.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43977.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22831.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22831.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65106.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45527.exe
        6⤵
        
        PID:5644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37458.exe
        7⤵
        
        PID:7604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45.exe
        7⤵
        
        PID:12052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2220.exe
        7⤵
        
        PID:2856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43549.exe
        6⤵
        
        PID:7904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48181.exe
        6⤵
        
        PID:11396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16195.exe
        6⤵
        
        PID:14892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24888.exe
        5⤵
        
        PID:7196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8347.exe
        6⤵
        
        PID:3344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60477.exe
        5⤵
        
        PID:11440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12733.exe
        5⤵
        
        PID:6628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34948.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4317.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4317.exe
      4⤵
      PID:5576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4494.exe
        5⤵
        
        PID:7076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65247.exe
        6⤵
        
        PID:10088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45686.exe
        6⤵
        
        PID:13760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9101.exe
        6⤵
        
        PID:16072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40757.exe
        6⤵
        
        PID:2620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45870.exe
        5⤵
        
        PID:10284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18523.exe
        6⤵
        
        PID:5964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28110.exe
        5⤵
        
        PID:13944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37001.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37001.exe
      4⤵
      PID:8812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36143.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36143.exe
      4⤵
      PID:11324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15244.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15244.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6528
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47149.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47149.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8998.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8998.exe
      4⤵
      PID:5340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19762.exe
        5⤵
        
        PID:6252
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6252 -s 632
        6⤵
        Program crash
        
        PID:11180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55574.exe
        5⤵
        
        PID:10984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26835.exe
        5⤵
        
        PID:2668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1453.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1453.exe
      4⤵
      PID:7240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44717.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44717.exe
      4⤵
      PID:11532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28110.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28110.exe
      4⤵
      PID:14032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42979.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42979.exe
      4⤵
      PID:4368
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64254.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64254.exe
    3⤵
    PID:5560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37359.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37359.exe
      4⤵
      PID:1760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16711.exe
        5⤵
        
        PID:9232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35405.exe
        5⤵
        
        PID:13476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13891.exe
        5⤵
        
        PID:15648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30581.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30581.exe
      4⤵
      PID:8516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8212.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8212.exe
      4⤵
      PID:13816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51339.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51339.exe
      4⤵
      PID:4332
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21278.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21278.exe
    3⤵
    PID:2280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40803.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40803.exe
      4⤵
      PID:16368
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14476.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14476.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:11616
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62859.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62859.exe
    3⤵
    PID:15860
- C:\Users\Admin\AppData\Local\Temp\Unicorn-31288.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-31288.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2456
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40879.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40879.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19167.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19167.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18887.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36562.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53783.exe
        7⤵
        
        PID:900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23135.exe
        8⤵
        
        PID:5972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1142.exe
        9⤵
        
        PID:7552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31698.exe
        10⤵
        
        PID:10128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60206.exe
        10⤵
        
        PID:14080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23979.exe
        10⤵
        
        PID:7536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5496.exe
        9⤵
        
        PID:10628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59629.exe
        9⤵
        
        PID:13484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28179.exe
        9⤵
        
        PID:16684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25764.exe
        8⤵
        
        PID:8240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15509.exe
        8⤵
        
        PID:13300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37307.exe
        8⤵
        
        PID:6272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36984.exe
        7⤵
        
        PID:5512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26223.exe
        8⤵
        
        PID:7688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9030.exe
        9⤵
        
        PID:9328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12628.exe
        9⤵
        
        PID:15072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44306.exe
        9⤵
        
        PID:15752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31069.exe
        8⤵
        
        PID:10604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56335.exe
        9⤵
        
        PID:14660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51229.exe
        9⤵
        
        PID:1692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44131.exe
        8⤵
        
        PID:5040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49781.exe
        7⤵
        
        PID:7944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60286.exe
        7⤵
        
        PID:11860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16747.exe
        7⤵
        
        PID:7340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52750.exe
        6⤵
        
        PID:4948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43311.exe
        7⤵
        
        PID:5376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21703.exe
        8⤵
        
        PID:7124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5718.exe
        9⤵
        
        PID:15524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58867.exe
        9⤵
        
        PID:5724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49430.exe
        8⤵
        
        PID:11748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18750.exe
        8⤵
        
        PID:16336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22635.exe
        8⤵
        
        PID:4652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59694.exe
        7⤵
        
        PID:6296
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6296 -s 684
        8⤵
        Program crash
        
        PID:16372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48181.exe
        7⤵
        
        PID:12356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8027.exe
        7⤵
        
        PID:6092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44768.exe
        6⤵
        
        PID:6720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17095.exe
        7⤵
        
        PID:9416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49117.exe
        8⤵
        
        PID:15684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26168.exe
        7⤵
        
        PID:13412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28930.exe
        7⤵
        
        PID:10736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40862.exe
        6⤵
        
        PID:9928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29231.exe
        6⤵
        
        PID:13928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30309.exe
        6⤵
        
        PID:6628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34983.exe
        6⤵
        
        PID:16032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42979.exe
        6⤵
        
        PID:15756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1429.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4582.exe
        6⤵
        
        PID:4944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33223.exe
        7⤵
        
        PID:5888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57774.exe
        8⤵
        
        PID:8324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26194.exe
        9⤵
        
        PID:6524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31452.exe
        8⤵
        
        PID:12060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18091.exe
        8⤵
        
        PID:15480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36045.exe
        7⤵
        
        PID:8100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56341.exe
        7⤵
        
        PID:12036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18091.exe
        7⤵
        
        PID:16104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56606.exe
        6⤵
        
        PID:6688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12486.exe
        7⤵
        
        PID:8572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21508.exe
        8⤵
        
        PID:4676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49468.exe
        8⤵
        
        PID:5184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25208.exe
        7⤵
        
        PID:11464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19610.exe
        7⤵
        
        PID:5648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48733.exe
        6⤵
        
        PID:6552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15733.exe
        7⤵
        
        PID:924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2747.exe
        7⤵
        
        PID:9156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44809.exe
        6⤵
        
        PID:11576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16516.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-389.exe
        6⤵
        
        PID:6652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40722.exe
        7⤵
        
        PID:9512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35287.exe
        8⤵
        
        PID:15048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41563.exe
        8⤵
        
        PID:4564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26168.exe
        7⤵
        
        PID:13500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19226.exe
        7⤵
        
        PID:1124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19620.exe
        6⤵
        
        PID:9428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5717.exe
        6⤵
        
        PID:13860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59045.exe
        6⤵
        
        PID:15420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56468.exe
        6⤵
        
        PID:3628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44494.exe
        5⤵
        
        PID:408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17687.exe
        6⤵
        
        PID:10696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24363.exe
        6⤵
        
        PID:14900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57765.exe
        5⤵
        
        PID:9940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55396.exe
        5⤵
        
        PID:6116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9301.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9301.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30039.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61458.exe
        6⤵
        
        PID:1804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15647.exe
        7⤵
        
        PID:6444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12766.exe
        8⤵
        
        PID:7844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10531.exe
        9⤵
        
        PID:16944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63737.exe
        8⤵
        
        PID:11772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38779.exe
        8⤵
        
        PID:6520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61230.exe
        7⤵
        
        PID:8172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9644.exe
        7⤵
        
        PID:13176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26835.exe
        7⤵
        
        PID:1076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24893.exe
        6⤵
        
        PID:6648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24111.exe
        7⤵
        
        PID:9540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26168.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:13532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10300.exe
        6⤵
        
        PID:10020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14269.exe
        6⤵
        
        PID:14072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17356.exe
        6⤵
        
        PID:5708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41400.exe
        5⤵
        
        PID:5108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9325.exe
        6⤵
        
        PID:3520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31314.exe
        7⤵
        
        PID:10012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62982.exe
        7⤵
        
        PID:13624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10772.exe
        7⤵
        
        PID:1236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19620.exe
        6⤵
        
        PID:9564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5717.exe
        6⤵
        
        PID:14188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16751.exe
        6⤵
        
        PID:15480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41860.exe
        6⤵
        
        PID:2632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37669.exe
        5⤵
        
        PID:6744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29295.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41453.exe
        6⤵
        
        PID:11680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64820.exe
        6⤵
        
        PID:4932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14805.exe
        5⤵
        
        PID:7976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20484.exe
        5⤵
        
        PID:12148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13763.exe
        5⤵
        
        PID:12260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14588.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14588.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63186.exe
        5⤵
        
        PID:2208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23815.exe
        6⤵
        
        PID:6452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13150.exe
        7⤵
        
        PID:7356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47221.exe
        7⤵
        
        PID:12048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58006.exe
        7⤵
        
        PID:15552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44114.exe
        7⤵
        
        PID:9860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42781.exe
        6⤵
        
        PID:8952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34996.exe
        6⤵
        
        PID:10048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37897.exe
        6⤵
        
        PID:13944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30948.exe
        5⤵
        
        PID:6644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11358.exe
        6⤵
        
        PID:11496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23691.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35398.exe
        5⤵
        
        PID:11880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55438.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55438.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31135.exe
        5⤵
        
        PID:8820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43657.exe
        5⤵
        
        PID:4492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42531.exe
        6⤵
        
        PID:3964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18667.exe
        5⤵
        
        PID:16052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61589.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61589.exe
      4⤵
      PID:8128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1261.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1261.exe
      4⤵
      PID:11348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42460.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42460.exe
      4⤵
      PID:16156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6387.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6387.exe
      4⤵
      PID:5788
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55518.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55518.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29167.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29167.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28887.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23223.exe
        6⤵
        
        PID:1780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2382.exe
        7⤵
        
        PID:6972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42279.exe
        8⤵
        
        PID:9280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12628.exe
        8⤵
        
        PID:15064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29698.exe
        8⤵
        
        PID:14908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55574.exe
        7⤵
        
        PID:11108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9923.exe
        7⤵
        
        PID:5736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40373.exe
        6⤵
        
        PID:7920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42002.exe
        7⤵
        
        PID:14616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52474.exe
        7⤵
        
        PID:6752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36549.exe
        6⤵
        
        PID:10844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2781.exe
        5⤵
        
        PID:968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40151.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13150.exe
        7⤵
        
        PID:7128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6861.exe
        7⤵
        
        PID:11984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38779.exe
        7⤵
        
        PID:13884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48837.exe
        6⤵
        
        PID:9616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18951.exe
        7⤵
        
        PID:15228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40611.exe
        7⤵
        
        PID:8392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45769.exe
        6⤵
        
        PID:13448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48911.exe
        6⤵
        
        PID:1608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50028.exe
        6⤵
        
        PID:6948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38629.exe
        5⤵
        
        PID:6592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17111.exe
        6⤵
        
        PID:11152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15619.exe
        6⤵
        
        PID:6680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-893.exe
        5⤵
        
        PID:9592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29523.exe
        5⤵
        
        PID:884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52358.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52358.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57815.exe
        5⤵
        
        PID:5224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50898.exe
        6⤵
        
        PID:6728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4510.exe
        7⤵
        
        PID:8564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34445.exe
        7⤵
        
        PID:11992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5645.exe
        7⤵
        
        PID:16260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60834.exe
        7⤵
        
        PID:7592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33461.exe
        6⤵
        
        PID:8556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38944.exe
        6⤵
        
        PID:11552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19710.exe
        6⤵
        
        PID:16140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23595.exe
        6⤵
        
        PID:16164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49118.exe
        5⤵
        
        PID:7636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9518.exe
        6⤵
        
        PID:10648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33786.exe
        7⤵
        
        PID:15416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62684.exe
        6⤵
        
        PID:7644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38470.exe
        5⤵
        
        PID:13040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51339.exe
        5⤵
        
        PID:2688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18052.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18052.exe
      4⤵
      PID:5568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61863.exe
        5⤵
        
        PID:7136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58039.exe
        6⤵
        
        PID:9248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28088.exe
        6⤵
        
        PID:13780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40757.exe
        6⤵
        
        PID:15448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21343.exe
        5⤵
        
        PID:10804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28110.exe
        5⤵
        
        PID:14084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20176.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20176.exe
      4⤵
      PID:6928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5878.exe
        5⤵
        
        PID:12932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40757.exe
        5⤵
        
        PID:3648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50277.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50277.exe
      4⤵
      PID:10380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7707.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7707.exe
      4⤵
      PID:6164
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55517.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55517.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23023.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23023.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47535.exe
        5⤵
        
        PID:5164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52434.exe
        6⤵
        
        PID:6244
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6244 -s 628
        7⤵
        Program crash
        
        PID:8420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5885.exe
        6⤵
        
        PID:9520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56335.exe
        7⤵
        
        PID:14676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23691.exe
        7⤵
        
        PID:212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65389.exe
        6⤵
        
        PID:13868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24888.exe
        5⤵
        
        PID:6740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54007.exe
        6⤵
        
        PID:11164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6013.exe
        6⤵
        
        PID:13516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11634.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38470.exe
        5⤵
        
        PID:13196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49468.exe
        6⤵
        
        PID:5204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26835.exe
        5⤵
        
        PID:4540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21997.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21997.exe
      4⤵
      PID:5368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9813.exe
        5⤵
        
        PID:6572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21256.exe
        5⤵
        
        PID:12940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47139.exe
        5⤵
        
        PID:15452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14311.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14311.exe
      4⤵
      PID:6124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62861.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62861.exe
      4⤵
      PID:12992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24915.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24915.exe
      4⤵
      PID:8000
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22566.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22566.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30269.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30269.exe
      4⤵
      PID:5916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17479.exe
        5⤵
        
        PID:7716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34599.exe
        6⤵
        
        PID:10776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22813.exe
        5⤵
        
        PID:9844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22926.exe
        5⤵
        
        PID:16120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38971.exe
        5⤵
        
        PID:4352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8940.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8940.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:8176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8582.exe
        5⤵
        
        PID:15192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3466.exe
        5⤵
        
        PID:1256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36166.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36166.exe
      4⤵
      PID:11712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51339.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51339.exe
      4⤵
      PID:16184
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56176.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56176.exe
    3⤵
    PID:5416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34375.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34375.exe
      4⤵
      PID:5632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34391.exe
        5⤵
        
        PID:7648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15391.exe
        5⤵
        
        PID:12956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14669.exe
        5⤵
        
        PID:15528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11058.exe
        5⤵
        
        PID:15644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44214.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44214.exe
      4⤵
      PID:7704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65375.exe
        5⤵
        
        PID:14376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65115.exe
        5⤵
        
        PID:5716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29532.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29532.exe
      4⤵
      PID:11888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41955.exe
        5⤵
        
        PID:5696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34948.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34948.exe
      4⤵
      PID:15576
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43413.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43413.exe
    3⤵
    PID:6772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48423.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48423.exe
      4⤵
      PID:9008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57295.exe
        5⤵
        
        PID:14980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34163.exe
        5⤵
        
        PID:14924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20413.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20413.exe
      4⤵
      PID:13152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37866.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37866.exe
      4⤵
      PID:15880
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40511.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40511.exe
    3⤵
    PID:9832
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36764.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36764.exe
    3⤵
    PID:11260
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8410.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8410.exe
    3⤵
    PID:4716
- C:\Users\Admin\AppData\Local\Temp\Unicorn-18412.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-18412.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3400
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22264.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22264.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34642.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34642.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54935.exe
        5⤵
        
        PID:3152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64743.exe
        6⤵
        
        PID:5272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9502.exe
        7⤵
        
        PID:7444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34599.exe
        8⤵
        
        PID:10720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32531.exe
        8⤵
        
        PID:14288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17805.exe
        7⤵
        
        PID:10956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11580.exe
        7⤵
        
        PID:13952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49501.exe
        7⤵
        
        PID:1496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59782.exe
        6⤵
        
        PID:8092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22215.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:13136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31452.exe
        6⤵
        
        PID:12072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3269.exe
        5⤵
        
        PID:5992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1142.exe
        6⤵
        
        PID:7528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17687.exe
        7⤵
        
        PID:11028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13891.exe
        7⤵
        
        PID:16248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17805.exe
        6⤵
        
        PID:11056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19748.exe
        6⤵
        
        PID:6680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13891.exe
        6⤵
        
        PID:3892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38829.exe
        5⤵
        
        PID:10108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31490.exe
        5⤵
        
        PID:14996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31827.exe
        5⤵
        
        PID:9932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33917.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33917.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31879.exe
        5⤵
        
        PID:5816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42258.exe
        6⤵
        
        PID:5076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33431.exe
        7⤵
        
        PID:9400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35405.exe
        7⤵
        
        PID:13516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13891.exe
        7⤵
        
        PID:764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2812.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65494.exe
        6⤵
        
        PID:14616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36237.exe
        5⤵
        
        PID:7656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10206.exe
        6⤵
        
        PID:15276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19226.exe
        6⤵
        
        PID:1612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11935.exe
        5⤵
        
        PID:11788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45091.exe
        5⤵
        
        PID:16272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2204.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2204.exe
      4⤵
      PID:4280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51997.exe
        5⤵
        
        PID:9024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55189.exe
        5⤵
        
        PID:14264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26835.exe
        5⤵
        
        PID:820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22964.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22964.exe
      4⤵
      PID:8068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55846.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55846.exe
      4⤵
      PID:6252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29523.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29523.exe
      4⤵
      PID:2104
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21412.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21412.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13902.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13902.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15735.exe
        5⤵
        
        PID:5160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1142.exe
        6⤵
        
        PID:7460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13086.exe
        7⤵
        
        PID:13280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1260.exe
        7⤵
        
        PID:15388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8292.exe
        6⤵
        
        PID:13000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26277.exe
        6⤵
        
        PID:16276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60742.exe
        5⤵
        
        PID:7180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18567.exe
        6⤵
        
        PID:14648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11058.exe
        6⤵
        
        PID:15864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7140.exe
        5⤵
        
        PID:12000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42732.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:16952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28541.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28541.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50343.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64479.exe
        6⤵
        
        PID:9068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10915.exe
        7⤵
        
        PID:15364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2261.exe
        6⤵
        
        PID:11404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43118.exe
        6⤵
        
        PID:16048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49501.exe
        6⤵
        
        PID:15396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36933.exe
        5⤵
        
        PID:10384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21980.exe
        6⤵
        
        PID:14616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50699.exe
        6⤵
        
        PID:14036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35003.exe
        5⤵
        
        PID:15660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31630.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31630.exe
      4⤵
      PID:8312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35287.exe
        5⤵
        
        PID:15032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10915.exe
        5⤵
        
        PID:16092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47685.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47685.exe
      4⤵
      PID:13048
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53518.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53518.exe
    3⤵
    PID:2124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31879.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31879.exe
      4⤵
      PID:5824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34007.exe
        5⤵
        
        PID:7480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9902.exe
        6⤵
        
        PID:11040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18591.exe
        6⤵
        
        PID:15752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15427.exe
        6⤵
        
        PID:14824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17805.exe
        5⤵
        
        PID:9960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19748.exe
        5⤵
        
        PID:13944
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 13944 -s 72
        6⤵
        Program crash
        
        PID:13884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47046.exe
        5⤵
        
        PID:16088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35085.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35085.exe
      4⤵
      PID:8056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31452.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31452.exe
      4⤵
      PID:12084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18091.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18091.exe
      4⤵
      PID:13436
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47920.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47920.exe
    3⤵
    PID:5476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61199.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61199.exe
      4⤵
      PID:7848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42087.exe
        5⤵
        
        PID:9968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11197.exe
        5⤵
        
        PID:13988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49645.exe
        5⤵
        
        PID:15520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43118.exe
        5⤵
        
        PID:16020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32589.exe
        5⤵
        
        PID:1072
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55766.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55766.exe
      4⤵
      PID:10688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59629.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59629.exe
      4⤵
      PID:13504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37045.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37045.exe
      4⤵
      PID:14256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3483.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3483.exe
      4⤵
      PID:3428
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52174.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52174.exe
    3⤵
    PID:8304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6750.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6750.exe
      4⤵
      PID:14592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41141.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41141.exe
      4⤵
      PID:14960
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11969.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11969.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:12360
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12443.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12443.exe
    3⤵
    PID:1260
- C:\Users\Admin\AppData\Local\Temp\Unicorn-34278.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-34278.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2960
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61647.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61647.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61751.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61751.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30815.exe
        5⤵
        
        PID:2824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40151.exe
        6⤵
        
        PID:6400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42973.exe
        7⤵
        
        PID:8768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62563.exe
        8⤵
        
        PID:15412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38944.exe
        7⤵
        
        PID:11560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8027.exe
        7⤵
        
        PID:5936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27492.exe
        6⤵
        
        PID:9264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55006.exe
        6⤵
        
        PID:13436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25908.exe
        6⤵
        
        PID:5140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30948.exe
        5⤵
        
        PID:7000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41911.exe
        6⤵
        
        PID:11568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8509.exe
        6⤵
        
        PID:13972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32542.exe
        6⤵
        
        PID:15680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11058.exe
        6⤵
        
        PID:4624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3493.exe
        5⤵
        
        PID:11740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19444.exe
        5⤵
        
        PID:2420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24915.exe
        5⤵
        
        PID:8432
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45241.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45241.exe
      4⤵
      PID:5440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45527.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17095.exe
        6⤵
        
        PID:9452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35087.exe
        7⤵
        
        PID:10640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19226.exe
        7⤵
        
        PID:4676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63929.exe
        6⤵
        
        PID:11912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13891.exe
        6⤵
        
        PID:15624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2812.exe
        5⤵
        
        PID:11004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15733.exe
        6⤵
        
        PID:14720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61774.exe
        6⤵
        
        PID:3724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26386.exe
        6⤵
        
        PID:4868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16747.exe
        5⤵
        
        PID:7388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36809.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36809.exe
      4⤵
      PID:8944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60565.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60565.exe
      4⤵
      PID:13304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56887.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56887.exe
      4⤵
      PID:15616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1019.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1019.exe
      4⤵
      PID:5712
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9213.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9213.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:60
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7270.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7270.exe
      4⤵
      PID:3568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40151.exe
        5⤵
        
        PID:6408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13150.exe
        6⤵
        
        PID:7384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30981.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57419.exe
        6⤵
        
        PID:14968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48837.exe
        5⤵
        
        PID:9624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49468.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:16284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45769.exe
        5⤵
        
        PID:14052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15169.exe
        5⤵
        
        PID:15532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23604.exe
        5⤵
        
        PID:10836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16725.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16725.exe
      4⤵
      PID:6224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33042.exe
        5⤵
        
        PID:9752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59822.exe
        5⤵
        
        PID:13888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19710.exe
        5⤵
        
        PID:15192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5315.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:15424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44805.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44805.exe
      4⤵
      PID:10612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54111.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54111.exe
      4⤵
      PID:15268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56757.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56757.exe
      4⤵
      PID:15856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51339.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51339.exe
      4⤵
      PID:15884
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-372.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-372.exe
    3⤵
    PID:5152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45527.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45527.exe
      4⤵
      PID:7160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31314.exe
        5⤵
        
        PID:10024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28856.exe
        5⤵
        
        PID:13692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44933.exe
        5⤵
        
        PID:15444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13005.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13005.exe
      4⤵
      PID:9488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35963.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35963.exe
      4⤵
      PID:1080
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37380.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37380.exe
    3⤵
    PID:8980
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27693.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27693.exe
    3⤵
    PID:11604
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64692.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64692.exe
    3⤵
    PID:16084
- C:\Users\Admin\AppData\Local\Temp\Unicorn-20044.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-20044.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2968
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31191.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31191.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50031.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50031.exe
      4⤵
      PID:5356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4494.exe
        5⤵
        
        PID:7116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-566.exe
        6⤵
        
        PID:9344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26168.exe
        6⤵
        
        PID:13976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14275.exe
        6⤵
        
        PID:6020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21261.exe
        5⤵
        
        PID:10080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32031.exe
        5⤵
        
        PID:13936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43171.exe
        5⤵
        
        PID:6324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29321.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29321.exe
      4⤵
      PID:9576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18907.exe
        5⤵
        
        PID:952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12888.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12888.exe
      4⤵
      PID:13056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54604.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54604.exe
      4⤵
      PID:6440
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4317.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4317.exe
    3⤵
    PID:5548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27271.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27271.exe
      4⤵
      PID:6980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31314.exe
        5⤵
        
        PID:10032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34519.exe
        6⤵
        
        PID:13732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48971.exe
        6⤵
        
        PID:3720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54430.exe
        5⤵
        
        PID:13664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49501.exe
        5⤵
        
        PID:14456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3768.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3768.exe
      4⤵
      PID:9336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28110.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28110.exe
      4⤵
      PID:14232
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13460.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13460.exe
    3⤵
    PID:7892
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58942.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58942.exe
    3⤵
    PID:9604
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7075.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7075.exe
    3⤵
    PID:14084
- C:\Users\Admin\AppData\Local\Temp\Unicorn-38205.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-38205.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4892
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8614.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8614.exe
    3⤵
    PID:5300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29321.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29321.exe
      4⤵
      PID:9568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37103.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37103.exe
      4⤵
      PID:13388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61145.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61145.exe
      4⤵
      PID:16088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24531.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24531.exe
      4⤵
      PID:8024
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29321.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29321.exe
    3⤵
    PID:9584
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12888.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12888.exe
    3⤵
    PID:12212
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62110.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62110.exe
    3⤵
    PID:15196
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58164.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58164.exe
    3⤵
    PID:14464
- C:\Users\Admin\AppData\Local\Temp\Unicorn-56706.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-56706.exe
  2⤵
  PID:5408
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37551.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37551.exe
    3⤵
    PID:6500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14541.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14541.exe
      4⤵
      PID:10796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59629.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59629.exe
      4⤵
      PID:13488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26835.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26835.exe
      4⤵
      PID:8436
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55574.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55574.exe
    3⤵
    PID:10972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31214.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31214.exe
      4⤵
      PID:4352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9474.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9474.exe
      4⤵
      PID:13500
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59629.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59629.exe
    3⤵
    PID:14476
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42979.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42979.exe
    3⤵
    PID:8356
- C:\Users\Admin\AppData\Local\Temp\Unicorn-8108.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-8108.exe
  2⤵
  PID:5544
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55759.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55759.exe
    3⤵
    PID:14608
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3704.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3704.exe
    3⤵
    PID:13436
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48771.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48771.exe
    3⤵
    PID:14004
- C:\Users\Admin\AppData\Local\Temp\Unicorn-26053.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-26053.exe
  2⤵
  PID:11688
- C:\Users\Admin\AppData\Local\Temp\Unicorn-39342.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-39342.exe
  2⤵
  PID:12896
- C:\Users\Admin\AppData\Local\Temp\Unicorn-49005.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-49005.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:14252
- C:\Users\Admin\AppData\Local\Temp\Unicorn-53349.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-53349.exe
  2⤵
  PID:15660
- C:\Users\Admin\AppData\Local\Temp\Unicorn-60786.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-60786.exe
  2⤵
  PID:7564

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3548 -ip 3548
1⤵
PID:4956

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 5776 -ip 5776
1⤵
PID:7772

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 6244 -ip 6244
1⤵
PID:9592

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 6252 -ip 6252
1⤵
PID:10916

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 6296 -ip 6296
1⤵
PID:16316

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:6280

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-10894.exe

Filesize
468KB

MD5
d94c7454890331978b123ef156ab41aa

SHA1
a59238a86d0ceb6fe90d8b1734876966b7820bec

SHA256
4a6449e6d331991c1b7029e29756ab98bc6f5771a73639876fa09dc7cf8f82eb

SHA512
27d12ee2b651d6c1f27aebb12e005afb57b638b6170c3bf111cec3631f5709b8ae1290a51943ad45531fbd60b2dab7fa3358fb3c18ceea90602419d6e7f0c7c5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-18412.exe

Filesize
468KB

MD5
07d71972c10766597d8cc2b6bf5601d2

SHA1
62077e518cc3c44fe73a6febe0aeca88f5e96273

SHA256
60b42bb24c84c06bfe84bc4b74066938db40ee3bc67587fde21c521cc95c84f9

SHA512
622baedeb2d248a2c7b7ae6faaf21d2f07b172c7448ffe859f89124a35ff2cf153b6cd3bde5e5ceb31097d8b96ce2f3aae2e655306eae271d5f79514fa9dcd69

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-18887.exe

Filesize
468KB

MD5
2420f9a39e850a96cc125304909189ff

SHA1
6dc530b9bba170b38d972d9f8cac365c05a761c7

SHA256
7d60db87884547326cc00ab6ddf24d68203376419f8b7ecb8d8754ed5d1d1e33

SHA512
44ae8c0b9855b877b47e897c2865afc1fff3f66fe91e6efff8726887394ea500697abc109d19e85fb26f0351351d119b35423c3b494b2a94388bee6ec7f451a9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-19167.exe

Filesize
468KB

MD5
a4fee1d918eb5027e09c50b745cb8a66

SHA1
7ec23e909e180d90e5bd3cdf5294800dd2e53320

SHA256
33864f387c4ab0548564808be522581b1f6d2c7904484358725f8f4890e46341

SHA512
011557339f8976ccf2e8beabd201710668b98bc91fafa1670dab3d35b7a6fccb981681722a44ead69d55b2994584ab34e73003b06c65dc90dc4bbc7fd9faf7c3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-19847.exe

Filesize
468KB

MD5
9e6526de16d82fe8d311e2cd4f591cd1

SHA1
190a03588fa9762403453b98add7fa824c22c63e

SHA256
5abfcf8bf843f092e549b9dfc4c0531993df9bc55a80b213b42acdef6f974354

SHA512
f73ac5928573f4e52bbec7e3f1a2a6e5cb57b812d88657c11c8b1e616ae68f1eae76cab5b5d351e417fe2272d46b5b0abfceb30430755db4d3cc02e5dc7bc27c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-20044.exe

Filesize
468KB

MD5
0db8b08c550cb2582bf9f42159233311

SHA1
9de7e8bcd056905f6d3c1ebe5faa09487e730bd2

SHA256
985240a9eff77a3e5fb3407792afd1ed9246670bd2edc14a063c354fb9a877e8

SHA512
fec222ea94c92da942e497eb1f9e9d98fc91d0ad1ef9844c1e42c1fbb25d68ca6b7a0b9894a5b173b0af845f4aff6108d7f1d116ec3cd3abaff6aaf0dc82347a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-21013.exe

Filesize
468KB

MD5
c76fd7e46c5e76394284fb16572a246c

SHA1
e3e0d6ea4e741e16e2fc5a016ff22a8d294322b8

SHA256
30be6d46d2e72735a3be3ba7267adee3f3e3451e6928e34f54424c0c2495cdb2

SHA512
25fc777ed4de389fcd07a47dec2d695f7e815ce84094be7b85af19efe5b33127952f1a6261469eef70d8545d80016c6ba0419054a221ed6168f037ad64ef8ea8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-22264.exe

Filesize
468KB

MD5
d50d88a5f160c0435c5ac98b16f1f7f9

SHA1
bd160faaa4b7d8a5f9e6b83a08927eb50ba03661

SHA256
1249f73e311d43abdaee6d8cb45df4e67eed4b011bbb3a81e549307f1dbb7089

SHA512
e7e6704d7163a4b6818bac1f499f0c4409da5ce5467d4d163d5a929be977239235e4521f45697e2bcd0e5c91a0b51f279d3cf428ecbb635ce20c0d9ba840b734

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-27351.exe

Filesize
468KB

MD5
1fd03b110af323247571721911110b8c

SHA1
f3794ab99bd8811816c9e7001f8e509ec761ee63

SHA256
14aa4792958abc50b94b45e36dfbf3dc22a6e29af516b2d273319c5c4fe070ec

SHA512
aaa46e25830bdd1000d983c74da0f2ab7a158d4e07c94fa5046a27fbc86e705b4bcd32de6156e705c2649c4eca472bec12e957b4a7b1eee2ee3b70a7c5ead771

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-29167.exe

Filesize
468KB

MD5
6c049af6e2774272acfcc185850844f2

SHA1
83bcf45fc2eec3bcd81005b8e80908e04dad4088

SHA256
6e088a6390d49c5baff48e87d0ec54d7b689b5aa2a64cacc0a8cad752dd8006e

SHA512
2c04d72f501df1f06e03c15dd10235c1e8af034f140523408e7d6236cfb14f2d0fd1848898a7a452e41f7c374d70430810f2b12c822dc997c03d8b50929adcbc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-3022.exe

Filesize
468KB

MD5
18e27303b5a5f47201d33ac40b637632

SHA1
ad37e73467864d329f48ebac377d28cc216695c8

SHA256
ecf6b507900a849cc00ad6d0941a8d25c1070753a915305abca9ae58b5ebce76

SHA512
e4db12de63919fb340539a8b3f8085669ccc38289a4d5e9a85f28eb4effc3f8ea14308cd51464aea7acaf4b3b097c0a9a94898ff7c5b7e2345bad88f740edff5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-31288.exe

Filesize
468KB

MD5
ad6f71a1955abc8047ca0982dca5eb63

SHA1
5dbeb577396c4929c7c1ea59fde1f3c2533f976e

SHA256
3cb06862c47a05c5e9324e385a484debce6635de8367da526f52b6c0cc31b6cc

SHA512
6d78a5a75db7f1f7b24c571eac36c0eeb847b7d3334c9e6f48f77805abeb1a95a6b32c2cee50c0128ad4e7b4b5635a664d5237d62af7fb90a8411d9c79613c15

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-34278.exe

Filesize
468KB

MD5
bf68155887ad78925aa9ab1f856955cb

SHA1
b3a62944912071e9aa611737d660be28c51baadf

SHA256
d6ec21720f815ef2834fa599cdcecaadd72b8e2926e73abe0030236c8341d4a6

SHA512
60ba33cb188bfa4c0dba6008873eb17b529ac2d754c834e2c018e55fbd302b619246a9fcbdeea700156ce7b4fea9f1e66e7324915fd46625beb412b8f9892878

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-37143.exe

Filesize
468KB

MD5
c86675e9f83623075869d0d719489cf9

SHA1
1a0c410e1330c290921092fba8df22fe7345f109

SHA256
f87136b983e3c5b7547b2ed285848cce4fd22b223b2ab5e22a5a6dbac65246d8

SHA512
07e3c859a9efd12eb29b83e40012a33b14a6e81da136e5c66e5932ac9d31f161c3ef06d9b7961aff604efbd4cac88de2d9667a63868591166557b7499d9031cd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-37743.exe

Filesize
468KB

MD5
a1d4308a2ffeeb21d00c46a7453aa8f9

SHA1
93a3f9bf3a3575a7608a74dbb378ab722c2af76d

SHA256
8ac569cc3bfca5c8b51c2d9ec281f3a6d0f036f98ce64d9ef196acca0588d1e7

SHA512
2c1027a9f069327ef0b8706c5aeaad69d112f37bc784f683a84d87233da20606625ebfe2012a0bf15162f801bc0a9a9d19219718a56b5689fec6be74fcc2cd28

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-40879.exe

Filesize
468KB

MD5
dca7ff672ff2c9559ac9d167d02333c3

SHA1
2ab17528db0a9358274f992b18b0ebe59e88686f

SHA256
434befba2dc4a6c62031c7381ddd14b9e0c03bd388ac60b30050ea79f1bc754f

SHA512
d101439ea66b97d960c9e22e622d8220dc2b7e71f965fe2dfd2d90b73b1e6207529a111540081a8842c5c987ca13be85b4cb7b3688256288216f0c7677f21c58

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-42706.exe

Filesize
468KB

MD5
bf3550ab6837f6e9675da360e0f06eae

SHA1
72176c6a0986dcf50f256a50cbe3b7f323953e41

SHA256
ec6c9144a3423d372a5a60027f99d382f11c2fc5df6ea30c408952ffd882bec2

SHA512
a2d858d17664d56f7a29c876a70d0c7cffa6e1a5fe5450b84cdd814797c34eb73f31098fa3e386b8e26d74fe5c2f0ddb17920781d882a9cdede3e1b694c13672

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-4278.exe

Filesize
468KB

MD5
d31368da594fbdeb103ef45a11ea5937

SHA1
e435fe0971321db12a7edab662fc5bf19b39a1ca

SHA256
8d9ecf7f431f01b1c5aa364eacebf935114bcb8c1ebdac222368ddb285686c34

SHA512
d40c9fd594a4d8311c39bfb1155f074f45d990419ecf4d51bd85e200206db5de95a40ce226be1caa65f632632d0eec093d5282a5fc896588afd6aefa43709a58

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-43680.exe

Filesize
468KB

MD5
3912b895c5556481508279d86ff393a1

SHA1
eea89e5fe71fdeb772021a0bc179adcd9f0da39f

SHA256
836d0d8d8f70357506240cd5ec3594581580f4e0892b1c7923ce6cd4caf8cc9f

SHA512
5e5b9cc8d5073868210ad16d9e8f2e2bcc6f8d12c78fda57d20fdaaf9eb33170bf6032e6a225755a5da28ca13a4c6d34bc8a62bca08790d88cd0238d9b2e661d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-43977.exe

Filesize
468KB

MD5
dcce0afd6880c126e21f4838294a2fdb

SHA1
a6b84072fa86c5813bd9def8e1f0bc73d5d28058

SHA256
f169f9c5218595c9f210d3ee7fde3f99ff129018e61ca52adc909d703f93eaba

SHA512
dda5928d780f4abf9b9fb40ea0b33a4af2a44037165a8286b99665a7d1b5496b1dbf8aabfd3fdaf328f82db8cdd0f95d8912760cbcef2c41c51487bf4fdfac16

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-50578.exe

Filesize
468KB

MD5
f66624bb9b006a29537f43d9ec5f56d4

SHA1
419d8f6f6e12384d4fa64352f96000f095d12ccd

SHA256
3e54c0cd0c7bf54a7da8d365b954182aa2ce8795ca69489893d76904bc6a6776

SHA512
a2da78bb9279b2902e605ea521bfd5947d6ab7f1ca8468b325fca77a0eb796b86f117757c0b5657e5e33c4ead4785a4d06b01d09caab3613c4a5e0e8527f3d56

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-55517.exe

Filesize
468KB

MD5
013d1791ca745221087811e9e3d66f44

SHA1
10f673340d122c05cafbfc15baa74f32d907a135

SHA256
a4a4085884ce5b2d0ed41a7ffb74818b6183de8004c7783f4e7f603d54954b02

SHA512
7221441ebb0189ad60bd1d315b94323c4373d51e48079907dd45670b111da2b813cc619267bcbc4a1aa5e1f124540c8594f8f332e13a64d3bf820d7b38100abe

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-55518.exe

Filesize
468KB

MD5
24392969fb0d907a788adeaa214e3063

SHA1
1d5983cbcdf2a987c7d0ac2bbb081e9e2125ed3f

SHA256
3936ca5b66f9652f971ba4a5a8b9093faa9a42d217c3785ea1ae5db409726e8d

SHA512
a05704bf03fd50b68c3f8da98277715578837aef7636962becb994ed76e3823f51adced50f1e3404c737cbb93afafb2e8365fae67cd80eb69d8114fe4ba38bb9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-56146.exe

Filesize
468KB

MD5
e1fa25187ec519b73ae747f2f45f1197

SHA1
0dd8b271b39d73043fde5c7f26b6405fd8477b85

SHA256
8eca30ad8a48c8643f36238e1a7e6c8b6281536269553cabc6b855e8390bba41

SHA512
0c31cb7e1a91e646994650e3f41dbed8f0cc51bff3338964c2dd644ce725d32b3f3e45ce88a3bbd40869562147204dba201344b11628ecf10b6d1a5a785eedd7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-56494.exe

Filesize
468KB

MD5
c122f8a40b6178f4d0d2112b284d2115

SHA1
c9bc62c6675402042aacd633672d86a7b4ba39cb

SHA256
7a436df6d80a05af424326e33f3a41d4cc11e5a41bc95bcde7b8753581d7da00

SHA512
9e93b2d3e9d71355c3fbe43ef474d79a7e71698f4ddf2c92883341422b46df6b49f53ec249eff502927ad2caeb417801441c54afa639fbf59e7e1c86fe2fe014

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-58310.exe

Filesize
468KB

MD5
f7cea3d3f9fd9f0d7732aefa0df06b46

SHA1
fb109f9b71cd91f0c880cd6ebd297bf7e33810a6

SHA256
b4401ab6626264929304f8a55db1c803cf32f97db6008948f20930070ed173d7

SHA512
838a46c0d2bb53b05287b513be6411f82a1eab77615bbf7bd71371e28b9776899aecf618986ffb126888d79adbc39c738f3392e7cce64375079514f4424fdfcf

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-59831.exe

Filesize
468KB

MD5
5b73fbabf4408d606f4437e50ec2155d

SHA1
745772424285786aa671fb1ef8a74faf1f97bc61

SHA256
ddddc4bcbe7a35b8bd1d1eb11f7f9596b86fc9f20f4a4183071a3249c3c32452

SHA512
0be0c115f9b25fef8bfe8ed2e8eb9b3d7b9d6e4df13787a089e80957446e7db38b94d4bbb640e312f079fd11a53ab9d598e07a217ee729be3311b6ccf544e0f7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-61647.exe

Filesize
468KB

MD5
6eafd035106e07a5a5b3a0bca68d8b5c

SHA1
f385aac2029eb5ad8f195268239b12f7829bc80c

SHA256
f46d58f714b4f92c46c468e126be2472b97176dfa8a62a498287c88b842f9860

SHA512
c5e35ae9332b08563bc28f9afad33c5b3c2aa8b8b39ef75333199856e28719b4ba76e23524b89e01c9c76110187d9b592e6e547edf387d62eef9b96a12652a79

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-62533.exe

Filesize
468KB

MD5
55a3633c155802fa9110e6007aa44de8

SHA1
6d568ca4d23df50469118be98252a1af31f3dfa8

SHA256
979a7a3a86688468a902a3df8d1aa3087b7ac3131b7ebc7c66450c41b452b66b

SHA512
449df553811ffb0957b0995243c105a308e932a414c45e79a2ebaf93d88127ea32294e24562887c7110eb786160de5cc0e3bbe68bfc42b52c41369362c57c69e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-7085.exe

Filesize
468KB

MD5
82fe1971922020e5fa353b756d12bcb7

SHA1
4d4e4411c553d051482d511c918518e322a92c38

SHA256
32b48ee231f8e9d6ee87c763cd610e0d46894a0f064dd2e9a1f4ce9a035f4323

SHA512
35833fce53c8e342e70c46bdb05c95142eaff6df00d647d270ac3aebd051937e3db2aa4305bf1f5a21a0d0e8213ff767d4f757e026bf082d549855c25edc3b21

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-7573.exe

Filesize
468KB

MD5
baffae1ae290daf9f589b969e7da22f3

SHA1
162ea955eaa7e600f2fddbb3bd1e57a312e427ae

SHA256
882f76750e88f321d1fef00d03b59d85002494a4fe826e951bd24a9e004bb425

SHA512
6ddc5127a151fe898ee1dbee8958a3c61924f64381aec8b257d2197244e61fed57b785bf53da5869d23bb655c91bc0d2d3ad8d9c48806f7b6d5ad9db0ccda8b4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-9301.exe

Filesize
468KB

MD5
45dfa704a67957a873d774618d432395

SHA1
01f70dccfc2e1a91b887adc1aa9e8ea3cf880891

SHA256
9dd13fa3f5bf1b51eba7073b3555eb2ef87a3d192b2048c50d24116f417b8fc2

SHA512
4c7b31f717eeca92632d17b4832f8ab33aa8c80f704604ef2b68cc1b5aef05cb292d91ec63290fa3be2bbb19a684222ddb9b3979e73cb8559ba0a3f6561ebd2d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-9846.exe

Filesize
468KB

MD5
7d135e4364d23d9bb0e2e206a4fe16ba

SHA1
03a3f9dd12fd0fd23ba35aa7f15639b9787da32c

SHA256
078d74a54ff7651c144cf7a4c3514880da74ab488858f5d6a9d9d62012dc0a45

SHA512
811cbb0e47dae96919ab9572f04be2e09acb882cef8018ed4401b31bcc6a668c4db30484f197c83e09dfd7d4ff75ada60974f0da1d4076edb6d9cd8b2654f9f5

Download Submit
memory/60-303-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/116-249-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/316-186-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/388-333-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/640-87-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/776-365-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/780-272-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/900-434-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/968-483-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1044-330-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1148-349-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1232-38-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1276-142-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1596-433-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1664-375-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1676-105-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1780-478-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1804-423-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2020-6-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2024-374-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2076-279-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2096-390-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2124-436-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2140-414-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2152-111-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2164-88-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2172-150-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2180-218-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2208-482-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2224-437-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2232-226-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2316-280-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2328-245-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2456-20-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2664-159-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2760-391-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2824-532-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2836-13-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2916-61-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2932-331-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2960-100-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2968-194-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2984-69-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3096-246-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3108-328-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3152-393-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3156-528-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3364-187-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3388-247-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3516-281-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3548-306-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3568-495-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3644-122-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3680-264-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3708-44-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3848-342-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3928-329-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3936-389-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3996-125-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4012-305-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4100-360-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4224-171-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4272-183-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4404-89-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4432-356-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4488-206-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4552-304-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4560-170-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4588-54-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4596-475-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4656-248-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4740-484-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4836-27-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4844-134-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4884-421-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4892-332-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4908-229-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4936-263-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4944-432-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4948-469-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4964-357-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4972-210-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4976-422-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5028-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5100-499-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5108-435-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5152-529-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5164-530-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5176-531-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5280-533-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5300-542-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5448-540-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5464-541-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5520-543-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5560-545-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5568-544-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/13436-3227-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/14072-4279-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/14660-2713-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/15204-3087-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/15444-2719-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/15512-3783-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/15532-3256-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/15544-3229-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/15552-3255-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/16284-4280-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/16296-3820-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads