6f593fff88d2884190df453445e28e4a6c58451d6c56c340a593ead7539613f6

Analysis

max time kernel
117s
max time network
16s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
18/10/2024, 08:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6f593fff88d2884190df453445e28e4a6c58451d6c56c340a593ead7539613f6N.exe
Size

468KB
MD5

bbf7b36df0ae153bbe70714708508720
SHA1

1a94d1480da58a4ac144ad16fab720ee7d7f507a
SHA256

6f593fff88d2884190df453445e28e4a6c58451d6c56c340a593ead7539613f6
SHA512

d2835cb64b62e9931b89a22be6a99853954a6777c949a7d3b5322cb5a3b933140e93d2f2c6b8837ebb92dee1ad1e857eca472d5b910e1cb84db8482e137f7439
SSDEEP

3072:h4DKowjNjy8U6bYPfzsjYfL/lhZoIpBhmHeAVXWC0aXbroNORlo:h4mowLU6kfwjYfS0VlC0E3oNO

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2228	Unicorn-5878.exe
2208	Unicorn-8784.exe
2904	Unicorn-53154.exe
2756	Unicorn-60969.exe
2888	Unicorn-23336.exe
2880	Unicorn-17205.exe
2628	Unicorn-16983.exe
2272	Unicorn-18671.exe
1680	Unicorn-31669.exe
1640	Unicorn-28951.exe
1708	Unicorn-29143.exe
1976	Unicorn-24081.exe
1224	Unicorn-20975.exe
1828	Unicorn-28878.exe
1748	Unicorn-1109.exe
2596	Unicorn-1945.exe
940	Unicorn-54908.exe
672	Unicorn-2137.exe
2020	Unicorn-45208.exe
1528	Unicorn-53450.exe
2524	Unicorn-36081.exe
2148	Unicorn-49345.exe
2280	Unicorn-9792.exe
1724	Unicorn-18723.exe
348	Unicorn-18723.exe
768	Unicorn-40081.exe
2364	Unicorn-53817.exe
2560	Unicorn-8847.exe
2260	Unicorn-56439.exe
2360	Unicorn-43632.exe
2776	Unicorn-64799.exe
2960	Unicorn-16113.exe
2936	Unicorn-16113.exe
3028	Unicorn-32376.exe
2648	Unicorn-44710.exe
2788	Unicorn-30974.exe
3036	Unicorn-50840.exe
1352	Unicorn-48209.exe
2032	Unicorn-8526.exe
3048	Unicorn-8520.exe
1608	Unicorn-19987.exe
1920	Unicorn-25853.exe
2492	Unicorn-50814.exe
788	Unicorn-36014.exe
1092	Unicorn-40844.exe
824	Unicorn-28038.exe
1732	Unicorn-49205.exe
1392	Unicorn-28422.exe
2256	Unicorn-63324.exe
568	Unicorn-43988.exe
1588	Unicorn-757.exe
1596	Unicorn-10741.exe
2168	Unicorn-14654.exe
2296	Unicorn-6486.exe
2412	Unicorn-23900.exe
2212	Unicorn-1997.exe
2620	Unicorn-539.exe
2156	Unicorn-30066.exe
1792	Unicorn-58100.exe
1968	Unicorn-33596.exe
1420	Unicorn-24084.exe
1972	Unicorn-7482.exe
1012	Unicorn-23705.exe
1908	Unicorn-4794.exe

Loads dropped DLL 64 IoCs

pid	Process
2432	6f593fff88d2884190df453445e28e4a6c58451d6c56c340a593ead7539613f6N.exe
2432	6f593fff88d2884190df453445e28e4a6c58451d6c56c340a593ead7539613f6N.exe
2228	Unicorn-5878.exe
2432	6f593fff88d2884190df453445e28e4a6c58451d6c56c340a593ead7539613f6N.exe
2432	6f593fff88d2884190df453445e28e4a6c58451d6c56c340a593ead7539613f6N.exe
2228	Unicorn-5878.exe
2208	Unicorn-8784.exe
2208	Unicorn-8784.exe
2904	Unicorn-53154.exe
2904	Unicorn-53154.exe
2432	6f593fff88d2884190df453445e28e4a6c58451d6c56c340a593ead7539613f6N.exe
2432	6f593fff88d2884190df453445e28e4a6c58451d6c56c340a593ead7539613f6N.exe
2228	Unicorn-5878.exe
2228	Unicorn-5878.exe
2756	Unicorn-60969.exe
2756	Unicorn-60969.exe
2208	Unicorn-8784.exe
2208	Unicorn-8784.exe
2880	Unicorn-17205.exe
2880	Unicorn-17205.exe
2904	Unicorn-53154.exe
2888	Unicorn-23336.exe
2904	Unicorn-53154.exe
2628	Unicorn-16983.exe
2888	Unicorn-23336.exe
2628	Unicorn-16983.exe
2228	Unicorn-5878.exe
2228	Unicorn-5878.exe
2432	6f593fff88d2884190df453445e28e4a6c58451d6c56c340a593ead7539613f6N.exe
2432	6f593fff88d2884190df453445e28e4a6c58451d6c56c340a593ead7539613f6N.exe
1368	WerFault.exe
1368	WerFault.exe
1368	WerFault.exe
1368	WerFault.exe
1368	WerFault.exe
1368	WerFault.exe
1368	WerFault.exe
2272	Unicorn-18671.exe
2272	Unicorn-18671.exe
2756	Unicorn-60969.exe
1680	Unicorn-31669.exe
2756	Unicorn-60969.exe
1680	Unicorn-31669.exe
2208	Unicorn-8784.exe
2208	Unicorn-8784.exe
1976	Unicorn-24081.exe
1976	Unicorn-24081.exe
772	WerFault.exe
772	WerFault.exe
772	WerFault.exe
772	WerFault.exe
772	WerFault.exe
2228	Unicorn-5878.exe
2228	Unicorn-5878.exe
2888	Unicorn-23336.exe
2888	Unicorn-23336.exe
2432	6f593fff88d2884190df453445e28e4a6c58451d6c56c340a593ead7539613f6N.exe
2432	6f593fff88d2884190df453445e28e4a6c58451d6c56c340a593ead7539613f6N.exe
1828	Unicorn-28878.exe
1748	Unicorn-1109.exe
1748	Unicorn-1109.exe
1828	Unicorn-28878.exe
2176	WerFault.exe
2176	WerFault.exe

Program crash 5 IoCs

pid	pid_target	Process	procid_target
1368	1640	WerFault.exe	40
772	1708	WerFault.exe	42
2176	1224	WerFault.exe	43
976	2824	WerFault.exe	108
2916	2868	WerFault.exe	109

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55167.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33651.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24212.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11080.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55780.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8784.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39133.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37291.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44203.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9444.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46191.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61423.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30553.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22432.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30058.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60018.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14701.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13313.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47683.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1752.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44880.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16442.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49454.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55338.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-705.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65479.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32660.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17791.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41970.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19679.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53817.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-539.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45969.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21012.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36214.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56439.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22955.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2181.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26612.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17764.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51058.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27956.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5876.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15487.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9589.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52980.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48209.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33662.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10817.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62699.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29667.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63593.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22432.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43148.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64799.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65357.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35513.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42908.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36214.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10093.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53510.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43632.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22166.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53739.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2432	6f593fff88d2884190df453445e28e4a6c58451d6c56c340a593ead7539613f6N.exe
2228	Unicorn-5878.exe
2208	Unicorn-8784.exe
2904	Unicorn-53154.exe
2756	Unicorn-60969.exe
2888	Unicorn-23336.exe
2880	Unicorn-17205.exe
2628	Unicorn-16983.exe
2272	Unicorn-18671.exe
1680	Unicorn-31669.exe
1640	Unicorn-28951.exe
1976	Unicorn-24081.exe
1708	Unicorn-29143.exe
1828	Unicorn-28878.exe
1748	Unicorn-1109.exe
1224	Unicorn-20975.exe
2596	Unicorn-1945.exe
940	Unicorn-54908.exe
672	Unicorn-2137.exe
2020	Unicorn-45208.exe
1528	Unicorn-53450.exe
2524	Unicorn-36081.exe
348	Unicorn-18723.exe
2148	Unicorn-49345.exe
2280	Unicorn-9792.exe
1724	Unicorn-18723.exe
2364	Unicorn-53817.exe
2560	Unicorn-8847.exe
2260	Unicorn-56439.exe
2360	Unicorn-43632.exe
2960	Unicorn-16113.exe
2936	Unicorn-16113.exe
3028	Unicorn-32376.exe
2788	Unicorn-30974.exe
2648	Unicorn-44710.exe
3036	Unicorn-50840.exe
2776	Unicorn-64799.exe
1352	Unicorn-48209.exe
2032	Unicorn-8526.exe
2428	Unicorn-57529.exe
3048	Unicorn-8520.exe
1608	Unicorn-19987.exe
1920	Unicorn-25853.exe
2492	Unicorn-50814.exe
1092	Unicorn-40844.exe
1732	Unicorn-49205.exe
1392	Unicorn-28422.exe
788	Unicorn-36014.exe
824	Unicorn-28038.exe
568	Unicorn-43988.exe
2256	Unicorn-63324.exe
2168	Unicorn-14654.exe
1588	Unicorn-757.exe
1596	Unicorn-10741.exe
2296	Unicorn-6486.exe
2412	Unicorn-23900.exe
2212	Unicorn-1997.exe
2620	Unicorn-539.exe
2156	Unicorn-30066.exe
1792	Unicorn-58100.exe
1968	Unicorn-33596.exe
1972	Unicorn-7482.exe
1420	Unicorn-24084.exe
1012	Unicorn-23705.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2432 wrote to memory of 2228	2432	6f593fff88d2884190df453445e28e4a6c58451d6c56c340a593ead7539613f6N.exe	31
PID 2432 wrote to memory of 2228	2432	6f593fff88d2884190df453445e28e4a6c58451d6c56c340a593ead7539613f6N.exe	31
PID 2432 wrote to memory of 2228	2432	6f593fff88d2884190df453445e28e4a6c58451d6c56c340a593ead7539613f6N.exe	31
PID 2432 wrote to memory of 2228	2432	6f593fff88d2884190df453445e28e4a6c58451d6c56c340a593ead7539613f6N.exe	31
PID 2432 wrote to memory of 2208	2432	6f593fff88d2884190df453445e28e4a6c58451d6c56c340a593ead7539613f6N.exe	33
PID 2432 wrote to memory of 2208	2432	6f593fff88d2884190df453445e28e4a6c58451d6c56c340a593ead7539613f6N.exe	33
PID 2432 wrote to memory of 2208	2432	6f593fff88d2884190df453445e28e4a6c58451d6c56c340a593ead7539613f6N.exe	33
PID 2432 wrote to memory of 2208	2432	6f593fff88d2884190df453445e28e4a6c58451d6c56c340a593ead7539613f6N.exe	33
PID 2228 wrote to memory of 2904	2228	Unicorn-5878.exe	32
PID 2228 wrote to memory of 2904	2228	Unicorn-5878.exe	32
PID 2228 wrote to memory of 2904	2228	Unicorn-5878.exe	32
PID 2228 wrote to memory of 2904	2228	Unicorn-5878.exe	32
PID 2208 wrote to memory of 2756	2208	Unicorn-8784.exe	34
PID 2208 wrote to memory of 2756	2208	Unicorn-8784.exe	34
PID 2208 wrote to memory of 2756	2208	Unicorn-8784.exe	34
PID 2208 wrote to memory of 2756	2208	Unicorn-8784.exe	34
PID 2904 wrote to memory of 2888	2904	Unicorn-53154.exe	35
PID 2904 wrote to memory of 2888	2904	Unicorn-53154.exe	35
PID 2904 wrote to memory of 2888	2904	Unicorn-53154.exe	35
PID 2904 wrote to memory of 2888	2904	Unicorn-53154.exe	35
PID 2432 wrote to memory of 2880	2432	6f593fff88d2884190df453445e28e4a6c58451d6c56c340a593ead7539613f6N.exe	36
PID 2432 wrote to memory of 2880	2432	6f593fff88d2884190df453445e28e4a6c58451d6c56c340a593ead7539613f6N.exe	36
PID 2432 wrote to memory of 2880	2432	6f593fff88d2884190df453445e28e4a6c58451d6c56c340a593ead7539613f6N.exe	36
PID 2432 wrote to memory of 2880	2432	6f593fff88d2884190df453445e28e4a6c58451d6c56c340a593ead7539613f6N.exe	36
PID 2228 wrote to memory of 2628	2228	Unicorn-5878.exe	37
PID 2228 wrote to memory of 2628	2228	Unicorn-5878.exe	37
PID 2228 wrote to memory of 2628	2228	Unicorn-5878.exe	37
PID 2228 wrote to memory of 2628	2228	Unicorn-5878.exe	37
PID 2756 wrote to memory of 2272	2756	Unicorn-60969.exe	38
PID 2756 wrote to memory of 2272	2756	Unicorn-60969.exe	38
PID 2756 wrote to memory of 2272	2756	Unicorn-60969.exe	38
PID 2756 wrote to memory of 2272	2756	Unicorn-60969.exe	38
PID 2208 wrote to memory of 1680	2208	Unicorn-8784.exe	39
PID 2208 wrote to memory of 1680	2208	Unicorn-8784.exe	39
PID 2208 wrote to memory of 1680	2208	Unicorn-8784.exe	39
PID 2208 wrote to memory of 1680	2208	Unicorn-8784.exe	39
PID 2880 wrote to memory of 1640	2880	Unicorn-17205.exe	40
PID 2880 wrote to memory of 1640	2880	Unicorn-17205.exe	40
PID 2880 wrote to memory of 1640	2880	Unicorn-17205.exe	40
PID 2880 wrote to memory of 1640	2880	Unicorn-17205.exe	40
PID 2888 wrote to memory of 1708	2888	Unicorn-23336.exe	42
PID 2888 wrote to memory of 1708	2888	Unicorn-23336.exe	42
PID 2888 wrote to memory of 1708	2888	Unicorn-23336.exe	42
PID 2888 wrote to memory of 1708	2888	Unicorn-23336.exe	42
PID 2628 wrote to memory of 1224	2628	Unicorn-16983.exe	43
PID 2628 wrote to memory of 1224	2628	Unicorn-16983.exe	43
PID 2628 wrote to memory of 1224	2628	Unicorn-16983.exe	43
PID 2628 wrote to memory of 1224	2628	Unicorn-16983.exe	43
PID 2904 wrote to memory of 1748	2904	Unicorn-53154.exe	41
PID 2904 wrote to memory of 1748	2904	Unicorn-53154.exe	41
PID 2904 wrote to memory of 1748	2904	Unicorn-53154.exe	41
PID 2904 wrote to memory of 1748	2904	Unicorn-53154.exe	41
PID 2228 wrote to memory of 1976	2228	Unicorn-5878.exe	44
PID 2228 wrote to memory of 1976	2228	Unicorn-5878.exe	44
PID 2228 wrote to memory of 1976	2228	Unicorn-5878.exe	44
PID 2228 wrote to memory of 1976	2228	Unicorn-5878.exe	44
PID 1640 wrote to memory of 1368	1640	Unicorn-28951.exe	45
PID 1640 wrote to memory of 1368	1640	Unicorn-28951.exe	45
PID 1640 wrote to memory of 1368	1640	Unicorn-28951.exe	45
PID 1640 wrote to memory of 1368	1640	Unicorn-28951.exe	45
PID 2432 wrote to memory of 1828	2432	6f593fff88d2884190df453445e28e4a6c58451d6c56c340a593ead7539613f6N.exe	46
PID 2432 wrote to memory of 1828	2432	6f593fff88d2884190df453445e28e4a6c58451d6c56c340a593ead7539613f6N.exe	46
PID 2432 wrote to memory of 1828	2432	6f593fff88d2884190df453445e28e4a6c58451d6c56c340a593ead7539613f6N.exe	46
PID 2432 wrote to memory of 1828	2432	6f593fff88d2884190df453445e28e4a6c58451d6c56c340a593ead7539613f6N.exe	46

C:\Users\Admin\AppData\Local\Temp\6f593fff88d2884190df453445e28e4a6c58451d6c56c340a593ead7539613f6N.exe
"C:\Users\Admin\AppData\Local\Temp\6f593fff88d2884190df453445e28e4a6c58451d6c56c340a593ead7539613f6N.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2432
- C:\Users\Admin\AppData\Local\Temp\Unicorn-5878.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-5878.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2228
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53154.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53154.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23336.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23336.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29143.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1708
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1708 -s 240
        6⤵
        Loads dropped DLL
        Program crash
        
        PID:772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49345.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28038.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61297.exe
        7⤵
        
        PID:2460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5566.exe
        8⤵
        
        PID:3076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28609.exe
        8⤵
        
        PID:5484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44880.exe
        8⤵
        
        PID:6220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61423.exe
        8⤵
        
        PID:7024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54730.exe
        7⤵
        
        PID:3916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15487.exe
        7⤵
        
        PID:4496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48493.exe
        7⤵
        
        PID:6060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57877.exe
        6⤵
        
        PID:1068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41638.exe
        7⤵
        
        PID:3228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32455.exe
        7⤵
        
        PID:4936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21527.exe
        7⤵
        
        PID:6152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28558.exe
        7⤵
        
        PID:3356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59960.exe
        6⤵
        
        PID:3232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21352.exe
        6⤵
        
        PID:4508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36271.exe
        6⤵
        
        PID:5388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1229.exe
        6⤵
        
        PID:6492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63324.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47955.exe
        6⤵
        
        PID:2800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22432.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7673.exe
        7⤵
        
        PID:4112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62699.exe
        7⤵
        
        PID:5228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10093.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2566.exe
        6⤵
        
        PID:3528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5020.exe
        6⤵
        
        PID:4948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44179.exe
        6⤵
        
        PID:5424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56945.exe
        6⤵
        
        PID:7092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65479.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49370.exe
        6⤵
        
        PID:3148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32128.exe
        6⤵
        
        PID:4704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57158.exe
        6⤵
        
        PID:5988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13501.exe
        5⤵
        
        PID:3500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8461.exe
        5⤵
        
        PID:4760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36044.exe
        5⤵
        
        PID:5328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15214.exe
        5⤵
        
        PID:6284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35087.exe
        5⤵
        
        PID:7108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1109.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1109.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:1748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18723.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50814.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6652.exe
        7⤵
        
        PID:1224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13313.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:1688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33365.exe
        8⤵
        
        PID:4080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46191.exe
        8⤵
        
        PID:4216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2181.exe
        8⤵
        
        PID:5964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52980.exe
        8⤵
        
        PID:6952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34864.exe
        7⤵
        
        PID:2484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5108.exe
        7⤵
        
        PID:3732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52056.exe
        7⤵
        
        PID:4852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59053.exe
        7⤵
        
        PID:5868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36444.exe
        7⤵
        
        PID:7012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5619.exe
        6⤵
        
        PID:2768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33620.exe
        7⤵
        
        PID:2816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18346.exe
        7⤵
        
        PID:4632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11314.exe
        7⤵
        
        PID:4444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28814.exe
        7⤵
        
        PID:5740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29127.exe
        7⤵
        
        PID:7072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10769.exe
        6⤵
        
        PID:2708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15546.exe
        6⤵
        
        PID:4644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51651.exe
        6⤵
        
        PID:5172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36745.exe
        6⤵
        
        PID:6232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40422.exe
        6⤵
        
        PID:7144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40844.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13554.exe
        6⤵
        
        PID:668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22432.exe
        7⤵
        
        PID:3692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55338.exe
        7⤵
        
        PID:4172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62699.exe
        7⤵
        
        PID:6136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34790.exe
        7⤵
        
        PID:6784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2566.exe
        6⤵
        
        PID:3552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45093.exe
        6⤵
        
        PID:5016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60776.exe
        6⤵
        
        PID:5396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50430.exe
        6⤵
        
        PID:6548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47881.exe
        5⤵
        
        PID:1488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48145.exe
        6⤵
        
        PID:3748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15487.exe
        6⤵
        
        PID:4468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44937.exe
        6⤵
        
        PID:6068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26124.exe
        6⤵
        
        PID:6832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22166.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24996.exe
        5⤵
        
        PID:4768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43482.exe
        5⤵
        
        PID:5248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21047.exe
        5⤵
        
        PID:6868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35087.exe
        5⤵
        
        PID:7104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53817.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53817.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8520.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-207.exe
        6⤵
        
        PID:2740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56842.exe
        7⤵
        
        PID:908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1845.exe
        7⤵
        
        PID:3752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46191.exe
        7⤵
        
        PID:4356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2181.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52980.exe
        7⤵
        
        PID:6964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45851.exe
        6⤵
        
        PID:2684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24212.exe
        6⤵
        
        PID:4660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28672.exe
        6⤵
        
        PID:5844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42908.exe
        6⤵
        
        PID:6368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11862.exe
        5⤵
        
        PID:2884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2473.exe
        6⤵
        
        PID:3784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1752.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62699.exe
        6⤵
        
        PID:5356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10093.exe
        6⤵
        
        PID:6612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16301.exe
        5⤵
        
        PID:3536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26727.exe
        5⤵
        
        PID:4796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27904.exe
        5⤵
        
        PID:5204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42908.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25853.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25853.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26388.exe
        5⤵
        
        PID:2220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54538.exe
        6⤵
        
        PID:980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33557.exe
        6⤵
        
        PID:3264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52347.exe
        6⤵
        
        PID:5312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25512.exe
        6⤵
        
        PID:6852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61953.exe
        6⤵
        
        PID:6452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44953.exe
        5⤵
        
        PID:1164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29996.exe
        5⤵
        
        PID:3440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52056.exe
        5⤵
        
        PID:4736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59053.exe
        5⤵
        
        PID:5772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24122.exe
        5⤵
        
        PID:7672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31162.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31162.exe
      4⤵
      PID:600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25291.exe
        5⤵
        
        PID:1916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53739.exe
        5⤵
        
        PID:3224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5215.exe
        5⤵
        
        PID:4992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48493.exe
        5⤵
        
        PID:6064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36444.exe
        5⤵
        
        PID:6992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24521.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24521.exe
      4⤵
      PID:3056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65204.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65204.exe
      4⤵
      PID:3168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46951.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46951.exe
      4⤵
      PID:4976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21012.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21012.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3108.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3108.exe
      4⤵
      PID:6608
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16983.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16983.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20975.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20975.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1224
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1224 -s 240
        5⤵
        Loads dropped DLL
        Program crash
        
        PID:2176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40081.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40081.exe
      4⤵
      Executes dropped EXE
      PID:768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57529.exe
        5⤵
        Suspicious use of SetWindowsHookEx
        
        PID:2428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-705.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28734.exe
        7⤵
        
        PID:2080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41970.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40296.exe
        8⤵
        
        PID:4728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62699.exe
        8⤵
        
        PID:6112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10093.exe
        8⤵
        
        PID:6704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46225.exe
        7⤵
        
        PID:3256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15487.exe
        7⤵
        
        PID:4520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3027.exe
        7⤵
        
        PID:5192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28743.exe
        7⤵
        
        PID:6600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9444.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26722.exe
        7⤵
        
        PID:928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4314.exe
        7⤵
        
        PID:5856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55780.exe
        7⤵
        
        PID:6636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12871.exe
        6⤵
        
        PID:3868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43391.exe
        6⤵
        
        PID:2160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13392.exe
        6⤵
        
        PID:5728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7558.exe
        6⤵
        
        PID:5732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22256.exe
        5⤵
        
        PID:1496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25291.exe
        6⤵
        
        PID:2832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24212.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43171.exe
        6⤵
        
        PID:6080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18294.exe
        6⤵
        
        PID:6444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45969.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47683.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17791.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43363.exe
        5⤵
        
        PID:5508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1958.exe
        5⤵
        
        PID:6540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19987.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19987.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14244.exe
        5⤵
        
        PID:1676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38394.exe
        6⤵
        
        PID:1752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32405.exe
        6⤵
        
        PID:4092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44179.exe
        6⤵
        
        PID:5416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45964.exe
        6⤵
        
        PID:6624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4304.exe
        5⤵
        
        PID:2304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15580.exe
        5⤵
        
        PID:4036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52056.exe
        5⤵
        
        PID:4836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42194.exe
        5⤵
        
        PID:6796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40422.exe
        5⤵
        
        PID:7140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63564.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63564.exe
      4⤵
      PID:760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25291.exe
        5⤵
        
        PID:2244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53739.exe
        5⤵
        
        PID:3316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20591.exe
        5⤵
        
        PID:4808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3027.exe
        5⤵
        
        PID:6104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28743.exe
        5⤵
        
        PID:6440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8384.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8384.exe
      4⤵
      PID:1736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22098.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22098.exe
      4⤵
      PID:3796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2945.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2945.exe
      4⤵
      PID:5044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30538.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30538.exe
      4⤵
      PID:6048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16042.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16042.exe
      4⤵
      PID:6200
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24081.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24081.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53450.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53450.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50840.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-539.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6512.exe
        7⤵
        
        PID:2404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24020.exe
        8⤵
        
        PID:4084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57017.exe
        8⤵
        
        PID:5068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47240.exe
        8⤵
        
        PID:5364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34790.exe
        8⤵
        
        PID:6840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2566.exe
        7⤵
        
        PID:3520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45093.exe
        7⤵
        
        PID:5024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44179.exe
        7⤵
        
        PID:5444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36214.exe
        7⤵
        
        PID:6404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44887.exe
        7⤵
        
        PID:6500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41431.exe
        6⤵
        
        PID:1132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52271.exe
        7⤵
        
        PID:1796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32455.exe
        7⤵
        
        PID:5052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61853.exe
        7⤵
        
        PID:5932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61645.exe
        7⤵
        
        PID:6744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16301.exe
        6⤵
        
        PID:3484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18861.exe
        6⤵
        
        PID:4788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43678.exe
        6⤵
        
        PID:5708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31979.exe
        6⤵
        
        PID:6864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30066.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12298.exe
        6⤵
        
        PID:1816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36691.exe
        6⤵
        
        PID:3964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43391.exe
        6⤵
        
        PID:3096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42517.exe
        6⤵
        
        PID:5756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53510.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55167.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52271.exe
        6⤵
        
        PID:3860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32455.exe
        6⤵
        
        PID:2580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21527.exe
        6⤵
        
        PID:6160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61423.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40423.exe
        5⤵
        
        PID:3756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18608.exe
        5⤵
        
        PID:5108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43678.exe
        5⤵
        
        PID:5672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31979.exe
        5⤵
        
        PID:6900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30974.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30974.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55852.exe
        5⤵
        
        PID:372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31358.exe
        6⤵
        
        PID:3080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32455.exe
        6⤵
        
        PID:4984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21527.exe
        6⤵
        
        PID:5736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51409.exe
        5⤵
        
        PID:3836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12687.exe
        5⤵
        
        PID:4628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43363.exe
        5⤵
        
        PID:5532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26655.exe
        5⤵
        
        PID:6824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35307.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35307.exe
      4⤵
      PID:2824
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2824 -s 240
        5⤵
        Program crash
        
        PID:976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63593.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63593.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3076.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3076.exe
      4⤵
      PID:3828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17784.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17784.exe
      4⤵
      PID:5004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36802.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36802.exe
      4⤵
      PID:5372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5124.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5124.exe
      4⤵
      PID:6884
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36081.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36081.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48209.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48209.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40093.exe
        5⤵
        
        PID:1820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33651.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53739.exe
        6⤵
        
        PID:988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20591.exe
        6⤵
        
        PID:4696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3027.exe
        6⤵
        
        PID:5136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28091.exe
        6⤵
        
        PID:2092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65290.exe
        5⤵
        
        PID:1924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58346.exe
        5⤵
        
        PID:3108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11080.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26612.exe
        5⤵
        
        PID:5660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53510.exe
        5⤵
        
        PID:6920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4083.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4083.exe
      4⤵
      PID:2848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34227.exe
        5⤵
        
        PID:1532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53739.exe
        5⤵
        
        PID:3288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20591.exe
        5⤵
        
        PID:4500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43148.exe
        5⤵
        
        PID:984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10992.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10992.exe
      4⤵
      PID:1540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7802.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7802.exe
      4⤵
      PID:3272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17791.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17791.exe
      4⤵
      PID:4740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43363.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43363.exe
      4⤵
      PID:5516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1958.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1958.exe
      4⤵
      PID:6684
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8526.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8526.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56066.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56066.exe
      4⤵
      PID:2632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35571.exe
        5⤵
        
        PID:884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28082.exe
        5⤵
        
        PID:4064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20591.exe
        5⤵
        
        PID:4456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3027.exe
        5⤵
        
        PID:5256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17764.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49146.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49146.exe
      4⤵
      PID:2764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5876.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5876.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59321.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59321.exe
      4⤵
      PID:4824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26612.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26612.exe
      4⤵
      PID:5648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12477.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12477.exe
      4⤵
      PID:6604
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5328.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5328.exe
    3⤵
    PID:1856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22432.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22432.exe
      4⤵
      PID:3684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55338.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55338.exe
      4⤵
      PID:4164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57158.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57158.exe
      4⤵
      PID:5928
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50876.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50876.exe
    3⤵
    PID:3152
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13757.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13757.exe
    3⤵
    PID:4276
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17055.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17055.exe
    3⤵
    PID:4424
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36917.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36917.exe
    3⤵
    PID:5788
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3108.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3108.exe
    3⤵
    PID:6728
- C:\Users\Admin\AppData\Local\Temp\Unicorn-8784.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-8784.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2208
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60969.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60969.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18671.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18671.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1945.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8847.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-757.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30794.exe
        8⤵
        
        PID:2592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43132.exe
        9⤵
        
        PID:3216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64855.exe
        9⤵
        
        PID:4408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46191.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:2188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2181.exe
        9⤵
        
        PID:5820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52980.exe
        9⤵
        
        PID:6960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14906.exe
        8⤵
        
        PID:3196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37558.exe
        8⤵
        
        PID:4268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52056.exe
        8⤵
        
        PID:4656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61864.exe
        8⤵
        
        PID:6176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61953.exe
        8⤵
        
        PID:6436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27264.exe
        7⤵
        
        PID:1624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25291.exe
        8⤵
        
        PID:1560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53739.exe
        8⤵
        
        PID:3352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20591.exe
        8⤵
        
        PID:4780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3027.exe
        8⤵
        
        PID:5360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28743.exe
        8⤵
        
        PID:7152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29440.exe
        7⤵
        
        PID:336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47683.exe
        7⤵
        
        PID:4012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18751.exe
        7⤵
        
        PID:4876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43363.exe
        7⤵
        
        PID:5524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1958.exe
        7⤵
        
        PID:6576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10741.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14701.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11387.exe
        8⤵
        
        PID:4924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50552.exe
        8⤵
        
        PID:5608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48463.exe
        8⤵
        
        PID:7064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22955.exe
        7⤵
        
        PID:3972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15487.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43148.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56812.exe
        6⤵
        
        PID:2856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37745.exe
        7⤵
        
        PID:5616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42127.exe
        7⤵
        
        PID:5600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42556.exe
        6⤵
        
        PID:4016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12687.exe
        6⤵
        
        PID:4600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43363.exe
        6⤵
        
        PID:5540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1958.exe
        6⤵
        
        PID:6652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56439.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14654.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15781.exe
        7⤵
        
        PID:2732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-319.exe
        8⤵
        
        PID:792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65524.exe
        8⤵
        
        PID:3368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5215.exe
        8⤵
        
        PID:4724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53105.exe
        8⤵
        
        PID:5408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60333.exe
        8⤵
        
        PID:6972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14361.exe
        7⤵
        
        PID:1548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1937.exe
        7⤵
        
        PID:3176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26457.exe
        7⤵
        
        PID:4684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59899.exe
        7⤵
        
        PID:5236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50430.exe
        7⤵
        
        PID:6592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45308.exe
        6⤵
        
        PID:2876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17123.exe
        7⤵
        
        PID:2084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53739.exe
        7⤵
        
        PID:3296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13850.exe
        7⤵
        
        PID:4428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18434.exe
        7⤵
        
        PID:5908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7057.exe
        7⤵
        
        PID:7684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19160.exe
        6⤵
        
        PID:2232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34757.exe
        6⤵
        
        PID:4244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26855.exe
        6⤵
        
        PID:5064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59583.exe
        6⤵
        
        PID:5796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31979.exe
        6⤵
        
        PID:6816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23900.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37291.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64647.exe
        7⤵
        
        PID:3124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23822.exe
        7⤵
        
        PID:4292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46191.exe
        7⤵
        
        PID:2564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2181.exe
        7⤵
        
        PID:5912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52980.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2566.exe
        6⤵
        
        PID:3568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5020.exe
        6⤵
        
        PID:4956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59707.exe
        6⤵
        
        PID:6032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9589.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32231.exe
        5⤵
        
        PID:2536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55249.exe
        6⤵
        
        PID:2760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10619.exe
        6⤵
        
        PID:3848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10817.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19679.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61953.exe
        6⤵
        
        PID:3360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64902.exe
        5⤵
        
        PID:2664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35227.exe
        5⤵
        
        PID:3464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2945.exe
        5⤵
        
        PID:5080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23439.exe
        5⤵
        
        PID:6008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16042.exe
        5⤵
        
        PID:5604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54908.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54908.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16113.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39133.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8295.exe
        7⤵
        
        PID:2784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16323.exe
        7⤵
        
        PID:3656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5215.exe
        7⤵
        
        PID:5088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53105.exe
        7⤵
        
        PID:5296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42378.exe
        7⤵
        
        PID:6360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21294.exe
        6⤵
        
        PID:2964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13722.exe
        6⤵
        
        PID:3788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27417.exe
        6⤵
        
        PID:4884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51539.exe
        6⤵
        
        PID:4908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25842.exe
        6⤵
        
        PID:7160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11291.exe
        5⤵
        
        PID:1564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24170.exe
        6⤵
        
        PID:1684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11492.exe
        6⤵
        
        PID:3136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26307.exe
        6⤵
        
        PID:5456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36214.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44887.exe
        6⤵
        
        PID:6512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38315.exe
        5⤵
        
        PID:2132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43423.exe
        5⤵
        
        PID:4260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43391.exe
        5⤵
        
        PID:2224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13392.exe
        5⤵
        
        PID:5704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7558.exe
        5⤵
        
        PID:6344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44710.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44710.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58100.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12397.exe
        6⤵
        
        PID:2240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4611.exe
        7⤵
        
        PID:4604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62818.exe
        7⤵
        
        PID:5212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44880.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61423.exe
        7⤵
        
        PID:7076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13552.exe
        6⤵
        
        PID:3324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20064.exe
        6⤵
        
        PID:4332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53105.exe
        6⤵
        
        PID:5452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42378.exe
        6⤵
        
        PID:6216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43845.exe
        5⤵
        
        PID:2688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60600.exe
        6⤵
        
        PID:4460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32455.exe
        6⤵
        
        PID:5000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21527.exe
        6⤵
        
        PID:5612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12871.exe
        5⤵
        
        PID:3880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21352.exe
        5⤵
        
        PID:4528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59899.exe
        5⤵
        
        PID:5260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50430.exe
        5⤵
        
        PID:6560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7482.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7482.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13554.exe
        5⤵
        
        PID:2676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33568.exe
        6⤵
        
        PID:2060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10619.exe
        6⤵
        
        PID:3820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52056.exe
        6⤵
        
        PID:2436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59053.exe
        6⤵
        
        PID:5896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36444.exe
        6⤵
        
        PID:7000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53967.exe
        5⤵
        
        PID:584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30058.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26457.exe
        5⤵
        
        PID:4404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26612.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2592.exe
        5⤵
        
        PID:7656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37104.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37104.exe
      4⤵
      PID:2992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22432.exe
        5⤵
        
        PID:3700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7673.exe
        5⤵
        
        PID:4152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62699.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26430.exe
        5⤵
        
        PID:6456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62503.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62503.exe
      4⤵
      PID:3592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2750.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2750.exe
      4⤵
      PID:4916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14513.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14513.exe
      4⤵
      PID:5240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9879.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9879.exe
      4⤵
      PID:6256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39287.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39287.exe
      4⤵
      PID:7028
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31669.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31669.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2137.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2137.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43632.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6486.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52667.exe
        7⤵
        
        PID:2420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8155.exe
        8⤵
        
        PID:3088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18346.exe
        8⤵
        
        PID:4620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3146.exe
        8⤵
        
        PID:5280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36214.exe
        8⤵
        
        PID:6396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44887.exe
        8⤵
        
        PID:6532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2566.exe
        7⤵
        
        PID:3576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5020.exe
        7⤵
        
        PID:4928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26612.exe
        7⤵
        
        PID:5664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53510.exe
        7⤵
        
        PID:6892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51058.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22432.exe
        7⤵
        
        PID:3708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55338.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62699.exe
        7⤵
        
        PID:5156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10093.exe
        7⤵
        
        PID:6648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16301.exe
        6⤵
        
        PID:3476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33662.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60018.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19679.exe
        6⤵
        
        PID:6248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61953.exe
        6⤵
        
        PID:6572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1997.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46611.exe
        6⤵
        
        PID:1776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22432.exe
        7⤵
        
        PID:3652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31616.exe
        7⤵
        
        PID:3640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15487.exe
        7⤵
        
        PID:4476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48493.exe
        7⤵
        
        PID:5900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24122.exe
        7⤵
        
        PID:7664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2566.exe
        6⤵
        
        PID:3544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20588.exe
        6⤵
        
        PID:5036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44179.exe
        6⤵
        
        PID:5432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36214.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44887.exe
        6⤵
        
        PID:7060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24637.exe
        5⤵
        
        PID:552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22432.exe
        6⤵
        
        PID:3716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7673.exe
        6⤵
        
        PID:4148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62699.exe
        6⤵
        
        PID:5128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26430.exe
        6⤵
        
        PID:6504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22166.exe
        5⤵
        
        PID:3448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24996.exe
        5⤵
        
        PID:4752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60237.exe
        5⤵
        
        PID:5180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21377.exe
        5⤵
        
        PID:6188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64799.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64799.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10902.exe
        5⤵
        
        PID:560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60449.exe
        6⤵
        
        PID:3768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55338.exe
        6⤵
        
        PID:4132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39072.exe
        6⤵
        
        PID:5380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34790.exe
        6⤵
        
        PID:6768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16301.exe
        5⤵
        
        PID:3492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51726.exe
        5⤵
        
        PID:4868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35513.exe
        5⤵
        
        PID:5408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44240.exe
        5⤵
        
        PID:5188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1958.exe
        5⤵
        
        PID:6664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35307.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35307.exe
      4⤵
      PID:2868
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2868 -s 240
        5⤵
        Program crash
        
        PID:2916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16442.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16442.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34757.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34757.exe
      4⤵
      PID:4252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26855.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26855.exe
      4⤵
      PID:5116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59583.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59583.exe
      4⤵
      PID:5880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31979.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31979.exe
      4⤵
      PID:6848
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45208.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45208.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16113.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16113.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24084.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9527.exe
        6⤵
        
        PID:2028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30553.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64948.exe
        7⤵
        
        PID:3212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12231.exe
        7⤵
        
        PID:4388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3027.exe
        7⤵
        
        PID:6088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1428.exe
        7⤵
        
        PID:6688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53967.exe
        6⤵
        
        PID:2544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30058.exe
        6⤵
        
        PID:3740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26457.exe
        6⤵
        
        PID:4716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59899.exe
        6⤵
        
        PID:5140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50430.exe
        6⤵
        
        PID:6696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55199.exe
        5⤵
        
        PID:1860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22432.exe
        6⤵
        
        PID:3660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55338.exe
        6⤵
        
        PID:4140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62699.exe
        6⤵
        
        PID:5148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10093.exe
        6⤵
        
        PID:6640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16301.exe
        5⤵
        
        PID:3560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10885.exe
        5⤵
        
        PID:4964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35513.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19679.exe
        5⤵
        
        PID:6324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61953.exe
        5⤵
        
        PID:7080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4794.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4794.exe
      4⤵
      Executes dropped EXE
      PID:1908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45153.exe
        5⤵
        
        PID:2804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21711.exe
        6⤵
        
        PID:3100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28609.exe
        6⤵
        
        PID:5492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44880.exe
        6⤵
        
        PID:6292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61423.exe
        6⤵
        
        PID:7120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5876.exe
        5⤵
        
        PID:3736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51153.exe
        5⤵
        
        PID:4864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29667.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40422.exe
        5⤵
        
        PID:7132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22603.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22603.exe
      4⤵
      PID:2372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43688.exe
        5⤵
        
        PID:4324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28609.exe
        5⤵
        
        PID:5500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44880.exe
        5⤵
        
        PID:6304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61423.exe
        5⤵
        
        PID:7048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-288.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-288.exe
      4⤵
      PID:3240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12687.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12687.exe
      4⤵
      PID:4196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43363.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43363.exe
      4⤵
      PID:5548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18294.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18294.exe
      4⤵
      PID:6484
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32376.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32376.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33596.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33596.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34227.exe
        5⤵
        
        PID:2008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53739.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29911.exe
        5⤵
        
        PID:5096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53105.exe
        5⤵
        
        PID:5300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42378.exe
        5⤵
        
        PID:6272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62794.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62794.exe
      4⤵
      PID:3024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43423.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43423.exe
      4⤵
      PID:4284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43391.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43391.exe
      4⤵
      PID:4108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42517.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42517.exe
      4⤵
      PID:5764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53510.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53510.exe
      4⤵
      PID:6944
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23705.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23705.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55734.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55734.exe
      4⤵
      PID:352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35655.exe
        5⤵
        
        PID:4896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24578.exe
        5⤵
        
        PID:5344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39015.exe
        5⤵
        
        PID:6276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4551.exe
        5⤵
        
        PID:6468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22955.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22955.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20064.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20064.exe
      4⤵
      PID:4232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3027.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3027.exe
      4⤵
      PID:6096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1428.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1428.exe
      4⤵
      PID:6564
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53813.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53813.exe
    3⤵
    PID:1628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10521.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10521.exe
      4⤵
      PID:6516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42319.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42319.exe
      4⤵
      PID:6420
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34421.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34421.exe
    3⤵
    PID:3824
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61801.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61801.exe
    3⤵
    PID:4208
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18104.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18104.exe
    3⤵
    PID:6024
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44829.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44829.exe
    3⤵
    PID:6720
- C:\Users\Admin\AppData\Local\Temp\Unicorn-17205.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-17205.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2880
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28951.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28951.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1640
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1640 -s 200
      4⤵
      Loads dropped DLL
      Program crash
      PID:1368
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11120.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11120.exe
    3⤵
    PID:1984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32660.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32660.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23822.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23822.exe
      4⤵
      PID:4300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46191.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46191.exe
      4⤵
      PID:4384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2181.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2181.exe
      4⤵
      PID:5872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52980.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52980.exe
      4⤵
      PID:6936
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27956.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27956.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3280
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18918.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18918.exe
    3⤵
    PID:4364
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43391.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43391.exe
    3⤵
    PID:3508
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20663.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20663.exe
    3⤵
    PID:6788
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35087.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35087.exe
    3⤵
    PID:7056
- C:\Users\Admin\AppData\Local\Temp\Unicorn-28878.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-28878.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:1828
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18723.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18723.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36014.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36014.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24380.exe
        5⤵
        
        PID:2044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22955.exe
        5⤵
        
        PID:3996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20064.exe
        5⤵
        
        PID:4320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53105.exe
        5⤵
        
        PID:5476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42378.exe
        5⤵
        
        PID:6244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44203.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44203.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36691.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36691.exe
      4⤵
      PID:3956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25930.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25930.exe
      4⤵
      PID:4336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59899.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59899.exe
      4⤵
      PID:6128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45809.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45809.exe
      4⤵
      PID:7052
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49205.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49205.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-399.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-399.exe
      4⤵
      PID:2668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33501.exe
        5⤵
        
        PID:4068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6329.exe
        5⤵
        
        PID:4212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51813.exe
        5⤵
        
        PID:5636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52980.exe
        5⤵
        
        PID:6752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27287.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27287.exe
      4⤵
      PID:3340
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25930.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25930.exe
      4⤵
      PID:4416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44440.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44440.exe
      4⤵
      PID:5164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50430.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50430.exe
      4⤵
      PID:6584
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25981.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25981.exe
    3⤵
    PID:1484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65083.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65083.exe
      4⤵
      PID:3976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52347.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52347.exe
      4⤵
      PID:5304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36214.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36214.exe
      4⤵
      PID:6388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44887.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44887.exe
      4⤵
      PID:6988
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22166.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22166.exe
    3⤵
    PID:3512
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59397.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59397.exe
    3⤵
    PID:4840
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18978.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18978.exe
    3⤵
    PID:5288
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36745.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36745.exe
    3⤵
    PID:6264
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40422.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40422.exe
    3⤵
    PID:6184
- C:\Users\Admin\AppData\Local\Temp\Unicorn-9792.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-9792.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2280
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28422.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28422.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1392
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43076.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43076.exe
    3⤵
    PID:1348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65357.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65357.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32487.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32487.exe
      4⤵
      PID:5748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55780.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55780.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6732
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36691.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36691.exe
    3⤵
    PID:3948
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1425.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1425.exe
    3⤵
    PID:4392
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26612.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26612.exe
    3⤵
    PID:5696
- C:\Users\Admin\AppData\Local\Temp\Unicorn-43988.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-43988.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:568
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47130.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47130.exe
    3⤵
    PID:1268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22432.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22432.exe
      4⤵
      PID:3724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55338.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55338.exe
      4⤵
      PID:4180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57158.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57158.exe
      4⤵
      PID:5996
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14906.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14906.exe
    3⤵
    PID:3188
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24212.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24212.exe
    3⤵
    PID:4668
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2649.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2649.exe
    3⤵
    PID:4912
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12279.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12279.exe
    3⤵
    PID:1396
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46193.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46193.exe
    3⤵
    PID:7088
- C:\Users\Admin\AppData\Local\Temp\Unicorn-22585.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-22585.exe
  2⤵
  PID:316
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22432.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22432.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3676
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55338.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55338.exe
    3⤵
    PID:4124
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62699.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62699.exe
    3⤵
    PID:6120
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34790.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34790.exe
    3⤵
    PID:6776
- C:\Users\Admin\AppData\Local\Temp\Unicorn-3964.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-3964.exe
  2⤵
  PID:3248
- C:\Users\Admin\AppData\Local\Temp\Unicorn-49454.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-49454.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4376
- C:\Users\Admin\AppData\Local\Temp\Unicorn-21255.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-21255.exe
  2⤵
  PID:4440
- C:\Users\Admin\AppData\Local\Temp\Unicorn-9181.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-9181.exe
  2⤵
  PID:5780
- C:\Users\Admin\AppData\Local\Temp\Unicorn-50445.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-50445.exe
  2⤵
  PID:6808

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-16983.exe

Filesize
468KB

MD5
62f366d086be8bf311deaaee8675af23

SHA1
7d039ec8805f2adc50e657453cec040da04045b6

SHA256
5cfe7e4496410137f078951be5fc3c06e076dc28e62b67f03dfa8412c9fa48b9

SHA512
6eeb7d58e01e29b56ef0e3d244db603b813fd79fc25d20f4f6cc4d6d8b3e3aacc3ed7a855edbed487be8181d11fe5684d54c5d660ff7908ccd8a292e3f1ed893

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-18671.exe

Filesize
468KB

MD5
cb72981c2d6a9b5185bf8b75657245f7

SHA1
762763058e7cbd51df902df0a1bced9949f8e0a7

SHA256
afcc0fb9fbdece0730fa33eea25c75b95d9d53138ced0fdf24c2bf1b96ea85aa

SHA512
b6d1b7fd1090a3f1e36118efd8359b069234ada112d357ed4e459db7b29232f1769fcb7fe8a9b28d5c2c9a83673624b9b9e27795aeef9ecb1512a55e4d808d11

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-1945.exe

Filesize
468KB

MD5
3c5c5b2111434d5cd0d3b98a8b513565

SHA1
60e1ddff7c33db6ca3de4edf675a77f8a3b9d049

SHA256
f8e0666a35536b466548d1756c255fa8733c992feae22114b52676a7fb56ed06

SHA512
5f2074d73f709155f9211b80fa81f1f10e6e49f34a701e220d0c994218f2a7c93fe699d8f4a70cb53c81286c20fa0bef2f94c6c52e6b25cb2ae49083b34e7c94

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-20975.exe

Filesize
468KB

MD5
30e58f2e8cf1eaeb80b0062303145299

SHA1
334a7df88a8f9dc05efc344877d26c03f87762cc

SHA256
f44f3ee6a001cbab37db083592446b8a3ec406bc458f153621577017ba3d219e

SHA512
8f6d73dbb6b831186936a07a1d1ce5ae0015b5a612607370b23a32005c8fe46a0ec0b9860a6acfa721ba0ad5524784ab0a90909186adb998605be7e088c7ca07

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-23336.exe

Filesize
468KB

MD5
870961e558dd35cb676589026d76772c

SHA1
a11b71f8567a17885f5934e28f23a520d3826c20

SHA256
52fb318e01e74c702ece7752545fde65b9605f2b7b094a372ed3b1a8f98b17d4

SHA512
5ba6c72e28fa9edb694a624f8981de6001267b4c5162feabee0426ca8b71f86686e84143a4062ca655ab00a5e2cb783ded154ca889544624fb491ac4dcafcd98

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-24081.exe

Filesize
468KB

MD5
a26deb8cbc6c128857b7734c71ce53c3

SHA1
4fe3d4754c6f7432e3e0cd8ae4a5991bc7a3afd0

SHA256
5f0ea32cb7c3717075cfa09e63e0768783f35d7fee43982167206c8de7dd844b

SHA512
6cdab6ada2ccb01aed9967fd654cc7e665a108c257919a51b78ca0b7748bac64903afc1389b400671b093131f08350e40e83bf651e31add645fb65a727c0d114

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-29143.exe

Filesize
468KB

MD5
78de64ef59e079ac1e06385ade97cb5b

SHA1
da3deeb5f7b83f7fab0647dc4a21422f929778a8

SHA256
ef4cd8029da18881aeb2ffe469b37937d6b67286fca922c0c157337a78656c96

SHA512
713533abcd8f16e37c534891ca57c883a592633e8b1c45b8754009c7d443c618527ab040f3f227b6d4312c11494ff96b33e07df3b446c0a860b54b867276033f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-31616.exe

Filesize
468KB

MD5
2a49dfb85a5f113cf0f5fb933cf2956d

SHA1
dbe642f86588aae92ca2de7f7f2be4d9230dd3ec

SHA256
d63ea08c086ad0973e4ecc0f91486805c54b0fdeef8d29d16ea9e4a7678de70b

SHA512
c2e48f9ed0131a49a62015b4bec5692e191428bac9ac72578cae87a530428cbe8c9c13b67b90b9d3958d245bad8c840a17ebe875566a955f8e377fc9c846b2ab

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-40081.exe

Filesize
468KB

MD5
6262336650a671f1f35928fe5f4f43eb

SHA1
9fe2aa5fd3f020090610c6e9802c2df3253f7921

SHA256
070d5d645c0acf921568893898f4026708137b0a5fcd7ff45621b8a041359381

SHA512
2c0c4a172e959a9b4585b96e0bc664cfa68a39daa896591371a61d2600acf56f25fce78d524d133cf53d12f2675273e672d3db602f69412f68ac5df56c39e2e0

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-1109.exe

Filesize
468KB

MD5
4ac5cac4c3387628e00a8f1a0424ce53

SHA1
63dc1e75230f5c7ce6ffeaf19146dc1a0f371b9a

SHA256
392bfce6976cdde9dcb0e6e07ef08a64b22e0fe8d83ed250985d0d6ba5039b52

SHA512
ba9992a148e90d96ea84f239564d4b62eaf46856b511cdf3be86ed965364c8352b978643d210a9030d6ba79dde4e070c20536d1c25c11677a82a1c789e6f7b87

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-17205.exe

Filesize
468KB

MD5
6d240aeecf2701b5aa481b2a5c2ca479

SHA1
c31a8035a8d1b9c138b7eae70de599fb9b0670c2

SHA256
7265e87617fa2b86d72f9ed7df33b6cb9bc5ed184145710d8656a12426c88018

SHA512
8568290dabb85d1eb068927c8298e8c052d437fbbb1bd9ee8c541d4a974be901794871195e347a368aee1016306842272d99e9664726f7a8bf4a559173f1c28a

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-28878.exe

Filesize
468KB

MD5
2a2ed556c792487de540b6e0a561b486

SHA1
3d568053f99e1b29e3ad6ea12d701f38276db9eb

SHA256
f8a68f8b765cd0ea071085d6d8e6bb7af27d5fb770f3edae78b4eef2b4fb9935

SHA512
903ee247908e7b6c8bc50e1743ed8f673ce659877527157ee4650104a967a84e6dda41593cc6014ea02ce8f3e3bd26b0b273a7ed261d8b9ed40991bb4b4df79f

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-28951.exe

Filesize
468KB

MD5
4fb4649fc4ec53b0b27a687b0361b233

SHA1
701da088e6cc19af87c34414247bc732690261c5

SHA256
ac208ed4d668a0b41c5d3c2978d26cdb0d8be8f44ad450e5c49aeae432c7e374

SHA512
8d7dc89bc0cfc5bf469aa4b2d1ccd7bceba027590b3c167c4d855611c72529d84aa9bf005e955c863aee410c1a571d68f258c7883f7d0cc4b27266c2a1347d4d

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-31669.exe

Filesize
468KB

MD5
8374571707f4be62569ee6da5feb4cc0

SHA1
70af283c945a6e1acc2ffe86f07b8aa184c2c8ed

SHA256
4ab96bd3a609b830a525e5bcdc191cd318055613b96418a38daee923abc9e6e7

SHA512
f43548429f20efb94d967cfa1becbbe9e1979f49a78d5acb9ec0f99e64179a18111fc80375bd2629424af9df06e654b0f0cf4295d676081cff3f10a877d7a73f

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-53154.exe

Filesize
468KB

MD5
194e2f02dc2206984375c977e2d00229

SHA1
6454b6461fc43e378a126a325cb198855c4cef55

SHA256
528d26573dd24b86dab9169a4394a4d8ca624461f595174e4bb13bf443881c2b

SHA512
ec958197bb7fc5349913247a7f1cb6f69f0de01649f086da3e8c3dca55aa53519083a90e8f68197db940e11256fdc2c56fa8915b3710b390508c9591c45e6baf

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-54908.exe

Filesize
468KB

MD5
53520b5c225ed3572345594d0ee0c52e

SHA1
993c2c0e7fa45ab8e01b3cd17c904bfbb83e8827

SHA256
78ff50192b0a462b7941129c5af185b99d930d668c92c64d89c41eb6f015529e

SHA512
b5a61d832231972110862ac5e636c0293c307fbc1a07fdfe8a23910f98b93bbe80034371ac2a995e3c4721a426f604ee69360d859fe60ec70beeaecea88f5274

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-5878.exe

Filesize
468KB

MD5
7c45287fea3d64bb46d73f0116adcd26

SHA1
211d003ad4a83306b34c59a0e8dc832919ef67ab

SHA256
d3419991a01d87a9cb764bdd9bc4eae3aae759bfd8ea148e7dbc3ba7d3369efd

SHA512
4bd8d25e682aec6beeb231ae6092c40abaa14c3516ebd9a7da5c5b12c3f272e84a2202da8902561432af3f50dc1913527a3c1e461ab851c456a1e24d91653479

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-60969.exe

Filesize
468KB

MD5
e4ddde5905d405ca66057485ac88ec24

SHA1
b392948488c3b19199097b38d5578a7af3cd9183

SHA256
5355347005f60095f3797957ddd089978d8eec654260d4515dddfa435a205748

SHA512
afe7b119091642c032748dbff5ac084d887e5eabe28603c04ea57504f4054935b9bdf7f49a1ad13a0399273fbf2620cc7d7924b5031d13b5d38973ba477af035

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-8784.exe

Filesize
468KB

MD5
36a968654404759be7d22ef194654e27

SHA1
7e6c30d23476e059e046fda8cd3f634c01aff143

SHA256
d83da360dc9eca2de15bc887e2238a152518db0225049c52c4b35652d127d53c

SHA512
2f4665742afe3f7f189f1746d498702674766d45885e70a408003d9d7cf3de1f3f60ee5dbb7734b188c210ab01020150a00f8925ab7479d53d229fd5e15ba588

Download Submit
memory/672-326-0x0000000002810000-0x0000000002885000-memory.dmp

Filesize
468KB

Download
memory/672-220-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/768-286-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/768-407-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/768-1363-0x0000000002B70000-0x0000000002CCC000-memory.dmp

Filesize
1.4MB

Download
memory/940-219-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/940-339-0x00000000025D0000-0x0000000002645000-memory.dmp

Filesize
468KB

Download
memory/940-337-0x00000000025D0000-0x0000000002645000-memory.dmp

Filesize
468KB

Download
memory/1224-162-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1224-300-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1352-394-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1608-436-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1680-216-0x00000000025F0000-0x0000000002665000-memory.dmp

Filesize
468KB

Download
memory/1680-218-0x00000000025F0000-0x0000000002665000-memory.dmp

Filesize
468KB

Download
memory/1680-338-0x00000000025F0000-0x0000000002665000-memory.dmp

Filesize
468KB

Download
memory/1748-271-0x0000000000550000-0x00000000005C5000-memory.dmp

Filesize
468KB

Download
memory/1748-272-0x0000000000550000-0x00000000005C5000-memory.dmp

Filesize
468KB

Download
memory/1828-172-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1828-273-0x00000000026B0000-0x0000000002725000-memory.dmp

Filesize
468KB

Download
memory/1976-160-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1976-355-0x0000000002830000-0x00000000028A5000-memory.dmp

Filesize
468KB

Download
memory/1976-240-0x0000000002830000-0x00000000028A5000-memory.dmp

Filesize
468KB

Download
memory/2020-227-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2020-341-0x00000000028F0000-0x0000000002965000-memory.dmp

Filesize
468KB

Download
memory/2032-403-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2148-260-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2208-42-0x00000000023F0000-0x0000000002465000-memory.dmp

Filesize
468KB

Download
memory/2208-229-0x00000000023F0000-0x0000000002465000-memory.dmp

Filesize
468KB

Download
memory/2208-104-0x00000000023F0000-0x0000000002465000-memory.dmp

Filesize
468KB

Download
memory/2208-32-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2208-343-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2208-226-0x00000000023F0000-0x0000000002465000-memory.dmp

Filesize
468KB

Download
memory/2228-249-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2228-322-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2228-157-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2228-402-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2228-248-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2228-21-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2228-401-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2260-319-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2272-317-0x0000000002420000-0x0000000002495000-memory.dmp

Filesize
468KB

Download
memory/2272-315-0x0000000002420000-0x0000000002495000-memory.dmp

Filesize
468KB

Download
memory/2272-199-0x0000000002420000-0x0000000002495000-memory.dmp

Filesize
468KB

Download
memory/2272-200-0x0000000002420000-0x0000000002495000-memory.dmp

Filesize
468KB

Download
memory/2280-270-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2360-327-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2364-417-0x0000000000370000-0x00000000003E5000-memory.dmp

Filesize
468KB

Download
memory/2364-416-0x0000000000370000-0x00000000003E5000-memory.dmp

Filesize
468KB

Download
memory/2364-294-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2428-408-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2432-31-0x0000000000550000-0x00000000005C5000-memory.dmp

Filesize
468KB

Download
memory/2432-265-0x0000000000550000-0x00000000005C5000-memory.dmp

Filesize
468KB

Download
memory/2432-293-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2432-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2432-269-0x0000000000550000-0x00000000005C5000-memory.dmp

Filesize
468KB

Download
memory/2432-6-0x0000000000550000-0x00000000005C5000-memory.dmp

Filesize
468KB

Download
memory/2432-165-0x0000000000550000-0x00000000005C5000-memory.dmp

Filesize
468KB

Download
memory/2432-170-0x0000000000550000-0x00000000005C5000-memory.dmp

Filesize
468KB

Download
memory/2524-392-0x00000000025D0000-0x0000000002645000-memory.dmp

Filesize
468KB

Download
memory/2524-251-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2524-393-0x00000000025D0000-0x0000000002645000-memory.dmp

Filesize
468KB

Download
memory/2560-308-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2596-306-0x0000000002510000-0x0000000002585000-memory.dmp

Filesize
468KB

Download
memory/2596-202-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2628-144-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2628-285-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2628-284-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2628-435-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2628-147-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2628-411-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2628-82-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2648-369-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2756-88-0x00000000026F0000-0x0000000002765000-memory.dmp

Filesize
468KB

Download
memory/2756-217-0x00000000026F0000-0x0000000002765000-memory.dmp

Filesize
468KB

Download
memory/2756-358-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2776-340-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2788-370-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2880-117-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2880-118-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2880-406-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2880-72-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2888-395-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2888-62-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2888-131-0x0000000001E50000-0x0000000001EC5000-memory.dmp

Filesize
468KB

Download
memory/2888-146-0x0000000001E50000-0x0000000001EC5000-memory.dmp

Filesize
468KB

Download
memory/2888-259-0x0000000001E50000-0x0000000001EC5000-memory.dmp

Filesize
468KB

Download
memory/2888-255-0x0000000001E50000-0x0000000001EC5000-memory.dmp

Filesize
468KB

Download
memory/2904-292-0x0000000001EE0000-0x0000000001F55000-memory.dmp

Filesize
468KB

Download
memory/2904-346-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2904-288-0x0000000001EE0000-0x0000000001F55000-memory.dmp

Filesize
468KB

Download
memory/2904-128-0x0000000001EE0000-0x0000000001F55000-memory.dmp

Filesize
468KB

Download
memory/2904-60-0x0000000001EE0000-0x0000000001F55000-memory.dmp

Filesize
468KB

Download
memory/2904-439-0x0000000001EE0000-0x0000000001F55000-memory.dmp

Filesize
468KB

Download
memory/2960-342-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3028-353-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3036-371-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3048-418-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download