ed10ddf39b3d798586757cfe5c39a119356b4886e40982d52ae5dec4222a7196

Analysis

max time kernel
150s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
20/11/2024, 05:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ed10ddf39b3d798586757cfe5c39a119356b4886e40982d52ae5dec4222a7196.exe
Size

468KB
MD5

78cb467e617d3291ec79074a6988e373
SHA1

093c7d5c6842d187cae034cc0789f5a068bbc772
SHA256

ed10ddf39b3d798586757cfe5c39a119356b4886e40982d52ae5dec4222a7196
SHA512

284607aab9aa92503e839fbe6e3b748d3f20f913501ae09422df4940c219e9f704f34b3a3dc601e68142342194634a281460d4c70794ab6cdc3b0fdf133f0ad6
SSDEEP

3072:WMoNow1fjtiUCbY4fzLOffHE2UN+GptpmHdPV/Z7Vb3t6UGndlU:WM6oY4UCrffOffvG677VDcUGn

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
5000	Unicorn-10244.exe
4144	Unicorn-15947.exe
4476	Unicorn-35813.exe
5020	Unicorn-38221.exe
588	Unicorn-40259.exe
3956	Unicorn-29861.exe
5104	Unicorn-51028.exe
4092	Unicorn-22565.exe
1592	Unicorn-18267.exe
4648	Unicorn-21413.exe
4632	Unicorn-42994.exe
4960	Unicorn-54853.exe
4644	Unicorn-38517.exe
3452	Unicorn-2123.exe
2424	Unicorn-21723.exe
5056	Unicorn-54308.exe
2072	Unicorn-18237.exe
4804	Unicorn-13083.exe
5088	Unicorn-25858.exe
2392	Unicorn-15268.exe
940	Unicorn-65045.exe
4736	Unicorn-45180.exe
400	Unicorn-61324.exe
4724	Unicorn-43364.exe
3484	Unicorn-50629.exe
3204	Unicorn-34293.exe
2916	Unicorn-17765.exe
4544	Unicorn-58035.exe
4424	Unicorn-14235.exe
3476	Unicorn-33836.exe
4208	Unicorn-27970.exe
2988	Unicorn-4308.exe
1852	Unicorn-48356.exe
3716	Unicorn-58724.exe
3792	Unicorn-58724.exe
3336	Unicorn-52741.exe
3052	Unicorn-41458.exe
3488	Unicorn-53125.exe
3668	Unicorn-42588.exe
2176	Unicorn-42277.exe
4956	Unicorn-57196.exe
4136	Unicorn-44581.exe
652	Unicorn-60149.exe
1140	Unicorn-9987.exe
3000	Unicorn-27285.exe
3344	Unicorn-27285.exe
620	Unicorn-10756.exe
1336	Unicorn-35261.exe
5064	Unicorn-35837.exe
4904	Unicorn-35074.exe
3944	Unicorn-44005.exe
2768	Unicorn-44005.exe
1132	Unicorn-15779.exe
3928	Unicorn-35645.exe
1408	Unicorn-44005.exe
456	Unicorn-56323.exe
3056	Unicorn-42587.exe
1304	Unicorn-26059.exe
4036	Unicorn-56323.exe
4468	Unicorn-62188.exe
3420	Unicorn-28629.exe
2544	Unicorn-42203.exe
2336	Unicorn-7715.exe
2508	Unicorn-45349.exe

Program crash 5 IoCs

pid	pid_target	Process	procid_target
5600	3420	WerFault.exe	154
5296	5316	WerFault.exe	221
9480	6568	WerFault.exe	233
9840	8124	WerFault.exe	390
13660	8544	WerFault.exe	372

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25858.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57196.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44229.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27952.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52193.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5603.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20823.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23623.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18397.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45349.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51913.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3024.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33836.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22501.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49472.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60048.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26687.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37323.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17877.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19917.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16362.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43767.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49290.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5914.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63105.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10948.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37079.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2405.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56888.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39291.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31995.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5427.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26136.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46519.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13270.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18253.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15874.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57833.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26136.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54044.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58114.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22910.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22565.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32177.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21290.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-375.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59936.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32930.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54771.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18875.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59820.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64524.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28115.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39655.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20557.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18631.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3173.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32957.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64036.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-361.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64096.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21364.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27645.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	15352	dwm.exe
Token: SeChangeNotifyPrivilege	15352	dwm.exe
Token: 33	15352	dwm.exe
Token: SeIncBasePriorityPrivilege	15352	dwm.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
1904	ed10ddf39b3d798586757cfe5c39a119356b4886e40982d52ae5dec4222a7196.exe
5000	Unicorn-10244.exe
4144	Unicorn-15947.exe
4476	Unicorn-35813.exe
3956	Unicorn-29861.exe
588	Unicorn-40259.exe
5104	Unicorn-51028.exe
5020	Unicorn-38221.exe
4092	Unicorn-22565.exe
1592	Unicorn-18267.exe
4648	Unicorn-21413.exe
3452	Unicorn-2123.exe
4644	Unicorn-38517.exe
2424	Unicorn-21723.exe
4960	Unicorn-54853.exe
4632	Unicorn-42994.exe
5056	Unicorn-54308.exe
2072	Unicorn-18237.exe
4804	Unicorn-13083.exe
5088	Unicorn-25858.exe
2392	Unicorn-15268.exe
4736	Unicorn-45180.exe
940	Unicorn-65045.exe
400	Unicorn-61324.exe
4544	Unicorn-58035.exe
4724	Unicorn-43364.exe
4208	Unicorn-27970.exe
4424	Unicorn-14235.exe
3484	Unicorn-50629.exe
3204	Unicorn-34293.exe
3476	Unicorn-33836.exe
2916	Unicorn-17765.exe
2988	Unicorn-4308.exe
1852	Unicorn-48356.exe
3792	Unicorn-58724.exe
3716	Unicorn-58724.exe
3336	Unicorn-52741.exe
3052	Unicorn-41458.exe
3488	Unicorn-53125.exe
3668	Unicorn-42588.exe
2176	Unicorn-42277.exe
4956	Unicorn-57196.exe
4136	Unicorn-44581.exe
652	Unicorn-60149.exe
1140	Unicorn-9987.exe
3344	Unicorn-27285.exe
3000	Unicorn-27285.exe
1336	Unicorn-35261.exe
620	Unicorn-10756.exe
1132	Unicorn-15779.exe
3928	Unicorn-35645.exe
3944	Unicorn-44005.exe
4904	Unicorn-35074.exe
5064	Unicorn-35837.exe
2768	Unicorn-44005.exe
4468	Unicorn-62188.exe
4036	Unicorn-56323.exe
1304	Unicorn-26059.exe
1408	Unicorn-44005.exe
3056	Unicorn-42587.exe
456	Unicorn-56323.exe
3420	Unicorn-28629.exe
2336	Unicorn-7715.exe
2544	Unicorn-42203.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1904 wrote to memory of 5000	1904	ed10ddf39b3d798586757cfe5c39a119356b4886e40982d52ae5dec4222a7196.exe	87
PID 1904 wrote to memory of 5000	1904	ed10ddf39b3d798586757cfe5c39a119356b4886e40982d52ae5dec4222a7196.exe	87
PID 1904 wrote to memory of 5000	1904	ed10ddf39b3d798586757cfe5c39a119356b4886e40982d52ae5dec4222a7196.exe	87
PID 1904 wrote to memory of 4144	1904	ed10ddf39b3d798586757cfe5c39a119356b4886e40982d52ae5dec4222a7196.exe	92
PID 1904 wrote to memory of 4144	1904	ed10ddf39b3d798586757cfe5c39a119356b4886e40982d52ae5dec4222a7196.exe	92
PID 1904 wrote to memory of 4144	1904	ed10ddf39b3d798586757cfe5c39a119356b4886e40982d52ae5dec4222a7196.exe	92
PID 5000 wrote to memory of 4476	5000	Unicorn-10244.exe	93
PID 5000 wrote to memory of 4476	5000	Unicorn-10244.exe	93
PID 5000 wrote to memory of 4476	5000	Unicorn-10244.exe	93
PID 4144 wrote to memory of 5020	4144	Unicorn-15947.exe	95
PID 4144 wrote to memory of 5020	4144	Unicorn-15947.exe	95
PID 4144 wrote to memory of 5020	4144	Unicorn-15947.exe	95
PID 1904 wrote to memory of 588	1904	ed10ddf39b3d798586757cfe5c39a119356b4886e40982d52ae5dec4222a7196.exe	96
PID 1904 wrote to memory of 588	1904	ed10ddf39b3d798586757cfe5c39a119356b4886e40982d52ae5dec4222a7196.exe	96
PID 1904 wrote to memory of 588	1904	ed10ddf39b3d798586757cfe5c39a119356b4886e40982d52ae5dec4222a7196.exe	96
PID 4476 wrote to memory of 3956	4476	Unicorn-35813.exe	97
PID 4476 wrote to memory of 3956	4476	Unicorn-35813.exe	97
PID 4476 wrote to memory of 3956	4476	Unicorn-35813.exe	97
PID 5000 wrote to memory of 5104	5000	Unicorn-10244.exe	98
PID 5000 wrote to memory of 5104	5000	Unicorn-10244.exe	98
PID 5000 wrote to memory of 5104	5000	Unicorn-10244.exe	98
PID 3956 wrote to memory of 4092	3956	Unicorn-29861.exe	101
PID 3956 wrote to memory of 4092	3956	Unicorn-29861.exe	101
PID 3956 wrote to memory of 4092	3956	Unicorn-29861.exe	101
PID 4476 wrote to memory of 1592	4476	Unicorn-35813.exe	102
PID 4476 wrote to memory of 1592	4476	Unicorn-35813.exe	102
PID 4476 wrote to memory of 1592	4476	Unicorn-35813.exe	102
PID 5104 wrote to memory of 4648	5104	Unicorn-51028.exe	103
PID 5104 wrote to memory of 4648	5104	Unicorn-51028.exe	103
PID 5104 wrote to memory of 4648	5104	Unicorn-51028.exe	103
PID 5000 wrote to memory of 4632	5000	Unicorn-10244.exe	104
PID 5000 wrote to memory of 4632	5000	Unicorn-10244.exe	104
PID 5000 wrote to memory of 4632	5000	Unicorn-10244.exe	104
PID 588 wrote to memory of 4960	588	Unicorn-40259.exe	105
PID 588 wrote to memory of 4960	588	Unicorn-40259.exe	105
PID 588 wrote to memory of 4960	588	Unicorn-40259.exe	105
PID 5020 wrote to memory of 4644	5020	Unicorn-38221.exe	106
PID 5020 wrote to memory of 4644	5020	Unicorn-38221.exe	106
PID 5020 wrote to memory of 4644	5020	Unicorn-38221.exe	106
PID 4144 wrote to memory of 3452	4144	Unicorn-15947.exe	108
PID 4144 wrote to memory of 3452	4144	Unicorn-15947.exe	108
PID 4144 wrote to memory of 3452	4144	Unicorn-15947.exe	108
PID 1904 wrote to memory of 2424	1904	ed10ddf39b3d798586757cfe5c39a119356b4886e40982d52ae5dec4222a7196.exe	107
PID 1904 wrote to memory of 2424	1904	ed10ddf39b3d798586757cfe5c39a119356b4886e40982d52ae5dec4222a7196.exe	107
PID 1904 wrote to memory of 2424	1904	ed10ddf39b3d798586757cfe5c39a119356b4886e40982d52ae5dec4222a7196.exe	107
PID 4092 wrote to memory of 5056	4092	Unicorn-22565.exe	109
PID 4092 wrote to memory of 5056	4092	Unicorn-22565.exe	109
PID 4092 wrote to memory of 5056	4092	Unicorn-22565.exe	109
PID 1592 wrote to memory of 2072	1592	Unicorn-18267.exe	110
PID 1592 wrote to memory of 2072	1592	Unicorn-18267.exe	110
PID 1592 wrote to memory of 2072	1592	Unicorn-18267.exe	110
PID 3956 wrote to memory of 4804	3956	Unicorn-29861.exe	111
PID 3956 wrote to memory of 4804	3956	Unicorn-29861.exe	111
PID 3956 wrote to memory of 4804	3956	Unicorn-29861.exe	111
PID 4476 wrote to memory of 5088	4476	Unicorn-35813.exe	112
PID 4476 wrote to memory of 5088	4476	Unicorn-35813.exe	112
PID 4476 wrote to memory of 5088	4476	Unicorn-35813.exe	112
PID 4648 wrote to memory of 2392	4648	Unicorn-21413.exe	113
PID 4648 wrote to memory of 2392	4648	Unicorn-21413.exe	113
PID 4648 wrote to memory of 2392	4648	Unicorn-21413.exe	113
PID 4644 wrote to memory of 940	4644	Unicorn-38517.exe	114
PID 4644 wrote to memory of 940	4644	Unicorn-38517.exe	114
PID 4644 wrote to memory of 940	4644	Unicorn-38517.exe	114
PID 5104 wrote to memory of 4736	5104	Unicorn-51028.exe	115

C:\Users\Admin\AppData\Local\Temp\ed10ddf39b3d798586757cfe5c39a119356b4886e40982d52ae5dec4222a7196.exe
"C:\Users\Admin\AppData\Local\Temp\ed10ddf39b3d798586757cfe5c39a119356b4886e40982d52ae5dec4222a7196.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1904
- C:\Users\Admin\AppData\Local\Temp\Unicorn-10244.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-10244.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5000
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35813.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35813.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29861.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29861.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22565.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54308.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4308.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28629.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3420
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3420 -s 464
        9⤵
        Program crash
        
        PID:5600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47036.exe
        8⤵
        
        PID:5700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50005.exe
        9⤵
        
        PID:8700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15752.exe
        9⤵
        
        PID:12876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62441.exe
        8⤵
        
        PID:10372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2391.exe
        8⤵
        
        PID:13856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37892.exe
        8⤵
        
        PID:9104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42203.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40949.exe
        8⤵
        
        PID:6816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43492.exe
        9⤵
        
        PID:5640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54185.exe
        9⤵
        
        PID:12172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8472.exe
        9⤵
        
        PID:16044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3838.exe
        9⤵
        
        PID:8512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20788.exe
        9⤵
        
        PID:1620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14794.exe
        8⤵
        
        PID:8704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43520.exe
        8⤵
        
        PID:11544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51222.exe
        8⤵
        
        PID:10464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14538.exe
        7⤵
        
        PID:6504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28882.exe
        8⤵
        
        PID:9560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22208.exe
        8⤵
        
        PID:16016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41188.exe
        7⤵
        
        PID:10072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26687.exe
        7⤵
        
        PID:12784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35889.exe
        7⤵
        
        PID:11888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64668.exe
        7⤵
        
        PID:4940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58724.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45349.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5292.exe
        8⤵
        
        PID:1924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37139.exe
        9⤵
        
        PID:8288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52265.exe
        9⤵
        
        PID:12564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55476.exe
        9⤵
        
        PID:11708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43579.exe
        8⤵
        
        PID:8088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14303.exe
        8⤵
        
        PID:9532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40840.exe
        8⤵
        
        PID:15492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21747.exe
        7⤵
        
        PID:5380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21837.exe
        8⤵
        
        PID:7340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8913.exe
        9⤵
        
        PID:13148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48906.exe
        9⤵
        
        PID:8864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13316.exe
        9⤵
        
        PID:11724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28231.exe
        8⤵
        
        PID:12096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65344.exe
        8⤵
        
        PID:15732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19482.exe
        8⤵
        
        PID:7440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11237.exe
        8⤵
        
        PID:14760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51259.exe
        7⤵
        
        PID:8004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40537.exe
        7⤵
        
        PID:11604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64005.exe
        7⤵
        
        PID:15712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36460.exe
        7⤵
        
        PID:15988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31732.exe
        6⤵
        
        PID:5720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-388.exe
        7⤵
        
        PID:6168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44644.exe
        8⤵
        
        PID:7464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-375.exe
        8⤵
        
        PID:11776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55753.exe
        8⤵
        
        PID:16352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20331.exe
        7⤵
        
        PID:8504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2089.exe
        8⤵
        
        PID:13508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31225.exe
        8⤵
        
        PID:2476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28039.exe
        7⤵
        
        PID:11928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42184.exe
        7⤵
        
        PID:13640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15874.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8188.exe
        7⤵
        
        PID:8692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13256.exe
        7⤵
        
        PID:11324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24425.exe
        7⤵
        
        PID:14604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-123.exe
        6⤵
        
        PID:8756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16553.exe
        6⤵
        
        PID:12092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55407.exe
        6⤵
        
        PID:6164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18397.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:12072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13083.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52741.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14788.exe
        7⤵
        
        PID:1588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40949.exe
        8⤵
        
        PID:6796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33653.exe
        9⤵
        
        PID:7436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36194.exe
        10⤵
        
        PID:12344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48928.exe
        10⤵
        
        PID:16064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38308.exe
        10⤵
        
        PID:14164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11040.exe
        9⤵
        
        PID:11080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15575.exe
        9⤵
        
        PID:15548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11818.exe
        9⤵
        
        PID:7360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62020.exe
        9⤵
        
        PID:13808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28115.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:8664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18631.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:10736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47969.exe
        8⤵
        
        PID:14328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1875.exe
        8⤵
        
        PID:1984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-803.exe
        7⤵
        
        PID:6512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48484.exe
        8⤵
        
        PID:8740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46400.exe
        8⤵
        
        PID:13172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46490.exe
        8⤵
        
        PID:8420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37316.exe
        8⤵
        
        PID:15544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59723.exe
        7⤵
        
        PID:7164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19007.exe
        7⤵
        
        PID:13876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37079.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27382.exe
        7⤵
        
        PID:14916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19811.exe
        6⤵
        
        PID:4516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17877.exe
        7⤵
        
        PID:6772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37139.exe
        8⤵
        
        PID:6156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3439.exe
        8⤵
        
        PID:13760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18823.exe
        8⤵
        
        PID:9476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51222.exe
        8⤵
        
        PID:14168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61836.exe
        7⤵
        
        PID:8052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26503.exe
        7⤵
        
        PID:11632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28161.exe
        7⤵
        
        PID:15072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58787.exe
        7⤵
        
        PID:15524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3173.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:13552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4066.exe
        6⤵
        
        PID:5604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8676.exe
        7⤵
        
        PID:7984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32664.exe
        7⤵
        
        PID:12316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46519.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29019.exe
        6⤵
        
        PID:10008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26687.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:13044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55380.exe
        6⤵
        
        PID:15648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41458.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9443.exe
        6⤵
        
        PID:2836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57316.exe
        7⤵
        
        PID:5208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40228.exe
        8⤵
        
        PID:7108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11113.exe
        9⤵
        
        PID:3292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62471.exe
        9⤵
        
        PID:4360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61469.exe
        9⤵
        
        PID:14144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20557.exe
        8⤵
        
        PID:10864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57080.exe
        8⤵
        
        PID:15308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61661.exe
        8⤵
        
        PID:6228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15723.exe
        7⤵
        
        PID:9660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26687.exe
        7⤵
        
        PID:12772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28956.exe
        7⤵
        
        PID:16132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38243.exe
        7⤵
        
        PID:15972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23667.exe
        6⤵
        
        PID:6208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16357.exe
        7⤵
        
        PID:7224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12768.exe
        7⤵
        
        PID:11580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16727.exe
        7⤵
        
        PID:15800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18752.exe
        7⤵
        
        PID:824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10169.exe
        7⤵
        
        PID:3124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51453.exe
        7⤵
        
        PID:15280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50403.exe
        6⤵
        
        PID:8520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60034.exe
        7⤵
        
        PID:9924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56027.exe
        7⤵
        
        PID:4628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62428.exe
        7⤵
        
        PID:11684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40065.exe
        6⤵
        
        PID:10832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52225.exe
        6⤵
        
        PID:2652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46795.exe
        6⤵
        
        PID:4184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22884.exe
        5⤵
        
        PID:1428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40949.exe
        6⤵
        
        PID:6824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32177.exe
        7⤵
        
        PID:8244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19199.exe
        7⤵
        
        PID:13820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51496.exe
        7⤵
        
        PID:9408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5427.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5856.exe
        6⤵
        
        PID:11960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12536.exe
        6⤵
        
        PID:6868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63412.exe
        6⤵
        
        PID:14772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36626.exe
        5⤵
        
        PID:6472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44068.exe
        6⤵
        
        PID:6724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53993.exe
        6⤵
        
        PID:10716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48545.exe
        6⤵
        
        PID:15980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40387.exe
        5⤵
        
        PID:8124
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8124 -s 464
        6⤵
        Program crash
        
        PID:9840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44130.exe
        5⤵
        
        PID:11268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14743.exe
        5⤵
        
        PID:14956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18267.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18267.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18237.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48356.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7715.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21821.exe
        8⤵
        
        PID:5300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40228.exe
        9⤵
        
        PID:6808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20154.exe
        10⤵
        
        PID:13672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58715.exe
        10⤵
        
        PID:16120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5443.exe
        10⤵
        
        PID:13540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20557.exe
        9⤵
        
        PID:10976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23169.exe
        9⤵
        
        PID:15772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61859.exe
        9⤵
        
        PID:11352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44156.exe
        8⤵
        
        PID:8184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49472.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21440.exe
        8⤵
        
        PID:15440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29570.exe
        8⤵
        
        PID:8564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21709.exe
        8⤵
        
        PID:15860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31259.exe
        7⤵
        
        PID:6668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61525.exe
        8⤵
        
        PID:7304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58114.exe
        9⤵
        
        PID:12860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13270.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:4968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26493.exe
        9⤵
        
        PID:8832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34584.exe
        8⤵
        
        PID:4900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10100.exe
        8⤵
        
        PID:14956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10470.exe
        8⤵
        
        PID:5556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34732.exe
        8⤵
        
        PID:14484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19162.exe
        7⤵
        
        PID:7788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31306.exe
        8⤵
        
        PID:15352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14806.exe
        8⤵
        
        PID:6636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62709.exe
        8⤵
        
        PID:11828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30641.exe
        7⤵
        
        PID:11004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12967.exe
        7⤵
        
        PID:15368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36081.exe
        7⤵
        
        PID:5904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7299.exe
        7⤵
        
        PID:12556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44124.exe
        6⤵
        
        PID:1332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24021.exe
        7⤵
        
        PID:5960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40228.exe
        8⤵
        
        PID:5284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64242.exe
        9⤵
        
        PID:10836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41040.exe
        9⤵
        
        PID:15152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55155.exe
        9⤵
        
        PID:8392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20557.exe
        8⤵
        
        PID:10904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64096.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:14996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52193.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:15416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44540.exe
        7⤵
        
        PID:7664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45234.exe
        8⤵
        
        PID:14048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34703.exe
        8⤵
        
        PID:6128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64820.exe
        8⤵
        
        PID:15820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23623.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:9140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15965.exe
        7⤵
        
        PID:13624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19015.exe
        7⤵
        
        PID:6812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51222.exe
        7⤵
        
        PID:7780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18954.exe
        6⤵
        
        PID:1144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8764.exe
        7⤵
        
        PID:7660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-375.exe
        7⤵
        
        PID:11704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52731.exe
        7⤵
        
        PID:5344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44486.exe
        7⤵
        
        PID:11040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21291.exe
        6⤵
        
        PID:8264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45234.exe
        7⤵
        
        PID:13952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43915.exe
        7⤵
        
        PID:8456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48484.exe
        7⤵
        
        PID:11436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63776.exe
        6⤵
        
        PID:11800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62929.exe
        6⤵
        
        PID:15668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64218.exe
        6⤵
        
        PID:5432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36068.exe
        6⤵
        
        PID:12688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58724.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14788.exe
        6⤵
        
        PID:2196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38541.exe
        7⤵
        
        PID:5272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51468.exe
        8⤵
        
        PID:8116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26503.exe
        8⤵
        
        PID:11588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21336.exe
        8⤵
        
        PID:13844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35159.exe
        8⤵
        
        PID:15500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27678.exe
        8⤵
        
        PID:13644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9370.exe
        7⤵
        
        PID:8608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41217.exe
        7⤵
        
        PID:10948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54145.exe
        7⤵
        
        PID:8516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63548.exe
        6⤵
        
        PID:6568
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6568 -s 628
        7⤵
        Program crash
        
        PID:9480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17154.exe
        6⤵
        
        PID:8552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14024.exe
        6⤵
        
        PID:11548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47088.exe
        6⤵
        
        PID:16340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35889.exe
        6⤵
        
        PID:16352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47179.exe
        6⤵
        
        PID:13496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33546.exe
        5⤵
        
        PID:2748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46517.exe
        6⤵
        
        PID:5324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40228.exe
        7⤵
        
        PID:6500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16002.exe
        8⤵
        
        PID:10768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34024.exe
        8⤵
        
        PID:14948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12202.exe
        8⤵
        
        PID:6096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18875.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:14852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20557.exe
        7⤵
        
        PID:10888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64096.exe
        7⤵
        
        PID:15028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21138.exe
        7⤵
        
        PID:5544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54236.exe
        7⤵
        
        PID:12364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60300.exe
        6⤵
        
        PID:5668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5856.exe
        6⤵
        
        PID:10852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18440.exe
        6⤵
        
        PID:13788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50860.exe
        5⤵
        
        PID:6676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64981.exe
        6⤵
        
        PID:7884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26991.exe
        6⤵
        
        PID:11284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55945.exe
        6⤵
        
        PID:16268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46835.exe
        5⤵
        
        PID:8592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62722.exe
        6⤵
        
        PID:14092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37924.exe
        6⤵
        
        PID:12508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63105.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:11296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43767.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:15876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25858.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25858.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:5088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53125.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39677.exe
        6⤵
        
        PID:912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26621.exe
        7⤵
        
        PID:6756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57965.exe
        8⤵
        
        PID:7772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20936.exe
        8⤵
        
        PID:11624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1268.exe
        8⤵
        
        PID:15752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43789.exe
        8⤵
        
        PID:12516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44452.exe
        7⤵
        
        PID:8640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16903.exe
        7⤵
        
        PID:11464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50427.exe
        7⤵
        
        PID:8948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28830.exe
        7⤵
        
        PID:12412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23771.exe
        6⤵
        
        PID:6428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24333.exe
        7⤵
        
        PID:7752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65528.exe
        7⤵
        
        PID:10120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64768.exe
        7⤵
        
        PID:15148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36460.exe
        7⤵
        
        PID:15812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43579.exe
        6⤵
        
        PID:7468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36016.exe
        6⤵
        
        PID:15128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22910.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36147.exe
        5⤵
        
        PID:1152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22973.exe
        6⤵
        
        PID:5268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32177.exe
        7⤵
        
        PID:7724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10839.exe
        7⤵
        
        PID:13904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58595.exe
        7⤵
        
        PID:13612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51222.exe
        7⤵
        
        PID:10044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24970.exe
        6⤵
        
        PID:7420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18042.exe
        7⤵
        
        PID:13392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41056.exe
        7⤵
        
        PID:8548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24775.exe
        6⤵
        
        PID:11272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21632.exe
        6⤵
        
        PID:15484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58595.exe
        6⤵
        
        PID:2260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12493.exe
        6⤵
        
        PID:16532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26074.exe
        5⤵
        
        PID:7100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40315.exe
        6⤵
        
        PID:8712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46400.exe
        6⤵
        
        PID:13240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3376.exe
        6⤵
        
        PID:16196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29193.exe
        6⤵
        
        PID:3576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20980.exe
        6⤵
        
        PID:12476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41075.exe
        5⤵
        
        PID:10204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10152.exe
        5⤵
        
        PID:12604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33849.exe
        5⤵
        
        PID:3508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43468.exe
        5⤵
        
        PID:5712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42588.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42588.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31509.exe
        5⤵
        
        PID:1052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46517.exe
        6⤵
        
        PID:5532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63725.exe
        7⤵
        
        PID:4712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36282.exe
        8⤵
        
        PID:10188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26136.exe
        8⤵
        
        PID:1692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44340.exe
        8⤵
        
        PID:14384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39192.exe
        7⤵
        
        PID:10288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6728.exe
        7⤵
        
        PID:15092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3795.exe
        7⤵
        
        PID:13564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60684.exe
        6⤵
        
        PID:7732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4777.exe
        7⤵
        
        PID:13608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5569.exe
        7⤵
        
        PID:6988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5148.exe
        7⤵
        
        PID:12448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6327.exe
        6⤵
        
        PID:10316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6728.exe
        6⤵
        
        PID:2372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37361.exe
        6⤵
        
        PID:9396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31259.exe
        5⤵
        
        PID:6684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60565.exe
        6⤵
        
        PID:7176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31010.exe
        7⤵
        
        PID:10320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54771.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20557.exe
        6⤵
        
        PID:10880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64096.exe
        6⤵
        
        PID:15004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10034.exe
        5⤵
        
        PID:8068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32369.exe
        5⤵
        
        PID:11556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22095.exe
        5⤵
        
        PID:15680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5603.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6050.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6050.exe
      4⤵
      PID:2180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16253.exe
        5⤵
        
        PID:6960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64981.exe
        6⤵
        
        PID:8012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59857.exe
        6⤵
        
        PID:11512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16727.exe
        6⤵
        
        PID:15620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43335.exe
        6⤵
        
        PID:15896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51261.exe
        6⤵
        
        PID:14504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5915.exe
        5⤵
        
        PID:8900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36780.exe
        6⤵
        
        PID:6332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51469.exe
        6⤵
        
        PID:16000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5559.exe
        5⤵
        
        PID:13028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11513.exe
        5⤵
        
        PID:7332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35012.exe
        5⤵
        
        PID:14888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20091.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20091.exe
      4⤵
      PID:6464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57005.exe
        5⤵
        
        PID:7568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-375.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11314.exe
        5⤵
        
        PID:6444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29302.exe
        5⤵
        
        PID:12552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57453.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57453.exe
      4⤵
      PID:8084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38935.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38935.exe
      4⤵
      PID:13080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32522.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32522.exe
      4⤵
      PID:8484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3404.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3404.exe
      4⤵
      PID:12704
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51028.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51028.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:5104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21413.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21413.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15268.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42277.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12204.exe
        7⤵
        
        PID:5276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60580.exe
        8⤵
        
        PID:6124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64436.exe
        9⤵
        
        PID:7728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46400.exe
        9⤵
        
        PID:13196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41441.exe
        9⤵
        
        PID:14992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60875.exe
        8⤵
        
        PID:9300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10839.exe
        8⤵
        
        PID:13860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62677.exe
        8⤵
        
        PID:11832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6091.exe
        7⤵
        
        PID:3008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8764.exe
        8⤵
        
        PID:7624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52649.exe
        8⤵
        
        PID:11328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15575.exe
        8⤵
        
        PID:15404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2494.exe
        8⤵
        
        PID:5892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58853.exe
        8⤵
        
        PID:16388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19650.exe
        7⤵
        
        PID:8892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11424.exe
        7⤵
        
        PID:13304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60515.exe
        7⤵
        
        PID:6540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5373.exe
        7⤵
        
        PID:11380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49516.exe
        6⤵
        
        PID:5308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57404.exe
        7⤵
        
        PID:6564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44642.exe
        8⤵
        
        PID:9240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26136.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:1268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19135.exe
        8⤵
        
        PID:5516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9851.exe
        8⤵
        
        PID:16396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54539.exe
        7⤵
        
        PID:9052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10376.exe
        7⤵
        
        PID:12532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18823.exe
        7⤵
        
        PID:9472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27486.exe
        7⤵
        
        PID:10984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18587.exe
        6⤵
        
        PID:4500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29458.exe
        7⤵
        
        PID:8688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2701.exe
        7⤵
        
        PID:13316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36515.exe
        7⤵
        
        PID:6552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62020.exe
        7⤵
        
        PID:7944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18607.exe
        6⤵
        
        PID:8208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49290.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29845.exe
        7⤵
        
        PID:15588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61486.exe
        6⤵
        
        PID:13600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32614.exe
        6⤵
        
        PID:1232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8788.exe
        6⤵
        
        PID:13272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57196.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53621.exe
        6⤵
        
        PID:5356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51317.exe
        7⤵
        
        PID:7048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57981.exe
        8⤵
        
        PID:10060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15752.exe
        8⤵
        
        PID:12920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44216.exe
        8⤵
        
        PID:5968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38011.exe
        7⤵
        
        PID:7996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62736.exe
        7⤵
        
        PID:13096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53615.exe
        7⤵
        
        PID:7448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29148.exe
        7⤵
        
        PID:10788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29826.exe
        6⤵
        
        PID:6176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41837.exe
        7⤵
        
        PID:10236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15752.exe
        7⤵
        
        PID:12588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18258.exe
        7⤵
        
        PID:3172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2451.exe
        7⤵
        
        PID:16552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10744.exe
        6⤵
        
        PID:9552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12676.exe
        6⤵
        
        PID:13728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5258.exe
        6⤵
        
        PID:1648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62550.exe
        6⤵
        
        PID:2700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14626.exe
        5⤵
        
        PID:5372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9324.exe
        6⤵
        
        PID:2840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8764.exe
        7⤵
        
        PID:7812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27952.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:11440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1268.exe
        7⤵
        
        PID:15900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34853.exe
        7⤵
        
        PID:16560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1691.exe
        6⤵
        
        PID:4492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10948.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:12904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11000.exe
        6⤵
        
        PID:5472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38819.exe
        6⤵
        
        PID:12160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1379.exe
        5⤵
        
        PID:5340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64981.exe
        6⤵
        
        PID:7908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26991.exe
        6⤵
        
        PID:10740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55753.exe
        6⤵
        
        PID:16376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26799.exe
        6⤵
        
        PID:5028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27678.exe
        6⤵
        
        PID:15800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56923.exe
        5⤵
        
        PID:1704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27064.exe
        5⤵
        
        PID:13164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56542.exe
        5⤵
        
        PID:15484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25212.exe
        5⤵
        
        PID:15208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45180.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45180.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44005.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38541.exe
        6⤵
        
        PID:5236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4265.exe
        7⤵
        
        PID:7264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-361.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2306.exe
        8⤵
        
        PID:10820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58897.exe
        7⤵
        
        PID:11068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17199.exe
        7⤵
        
        PID:14472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19451.exe
        7⤵
        
        PID:14412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3315.exe
        6⤵
        
        PID:8136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52457.exe
        7⤵
        
        PID:11400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1268.exe
        7⤵
        
        PID:15720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14303.exe
        6⤵
        
        PID:10496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15965.exe
        6⤵
        
        PID:4984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45639.exe
        6⤵
        
        PID:6020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21364.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:12616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47788.exe
        5⤵
        
        PID:6592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65365.exe
        6⤵
        
        PID:6544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12768.exe
        6⤵
        
        PID:11536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16727.exe
        6⤵
        
        PID:15656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36965.exe
        6⤵
        
        PID:16300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28337.exe
        5⤵
        
        PID:8572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22769.exe
        5⤵
        
        PID:11480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47088.exe
        5⤵
        
        PID:14196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4067.exe
        5⤵
        
        PID:15520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22379.exe
        5⤵
        
        PID:14864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56323.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56323.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8452.exe
        5⤵
        
        PID:5824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9340.exe
        6⤵
        
        PID:5652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45410.exe
        7⤵
        
        PID:8912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18928.exe
        7⤵
        
        PID:14120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25811.exe
        6⤵
        
        PID:9172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4127.exe
        6⤵
        
        PID:13428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29193.exe
        6⤵
        
        PID:8784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26844.exe
        6⤵
        
        PID:14784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49506.exe
        5⤵
        
        PID:244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37626.exe
        6⤵
        
        PID:9160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15951.exe
        6⤵
        
        PID:15896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43327.exe
        6⤵
        
        PID:16044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2213.exe
        6⤵
        
        PID:12420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22533.exe
        5⤵
        
        PID:8176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45737.exe
        5⤵
        
        PID:13336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44671.exe
        5⤵
        
        PID:8036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44294.exe
        5⤵
        
        PID:12180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-507.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-507.exe
      4⤵
      PID:5620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44613.exe
        5⤵
        
        PID:5748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58114.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:12912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54495.exe
        6⤵
        
        PID:6648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60317.exe
        6⤵
        
        PID:12384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61097.exe
        5⤵
        
        PID:10924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64096.exe
        5⤵
        
        PID:15036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35358.exe
        5⤵
        
        PID:11876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43284.exe
        5⤵
        
        PID:14060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64603.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64603.exe
      4⤵
      PID:8048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7168.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7168.exe
      4⤵
      PID:11596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64535.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64535.exe
      4⤵
      PID:15760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29140.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29140.exe
      4⤵
      PID:1176
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42994.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42994.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17765.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17765.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35645.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24021.exe
        6⤵
        
        PID:5972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58349.exe
        7⤵
        
        PID:7148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28882.exe
        8⤵
        
        PID:10168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18928.exe
        8⤵
        
        PID:14112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2799.exe
        8⤵
        
        PID:4944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56576.exe
        7⤵
        
        PID:10364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11056.exe
        7⤵
        
        PID:13768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29954.exe
        7⤵
        
        PID:1728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16666.exe
        6⤵
        
        PID:8016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12192.exe
        6⤵
        
        PID:10440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59050.exe
        6⤵
        
        PID:16068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31995.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62012.exe
        5⤵
        
        PID:3976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8676.exe
        6⤵
        
        PID:9184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49001.exe
        6⤵
        
        PID:13064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36515.exe
        6⤵
        
        PID:5616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43380.exe
        6⤵
        
        PID:14796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15426.exe
        5⤵
        
        PID:8320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6904.exe
        5⤵
        
        PID:11788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13927.exe
        5⤵
        
        PID:15628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26059.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26059.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8452.exe
        5⤵
        
        PID:5816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54597.exe
        6⤵
        
        PID:5956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37626.exe
        7⤵
        
        PID:10128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2208.exe
        7⤵
        
        PID:14200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25219.exe
        7⤵
        
        PID:11656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56681.exe
        6⤵
        
        PID:9308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30935.exe
        6⤵
        
        PID:13704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51364.exe
        5⤵
        
        PID:7400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29074.exe
        6⤵
        
        PID:10232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26712.exe
        6⤵
        
        PID:14016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15263.exe
        5⤵
        
        PID:11064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62369.exe
        5⤵
        
        PID:13620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44227.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44227.exe
      4⤵
      PID:6060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12324.exe
        5⤵
        
        PID:7292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-361.exe
        6⤵
        
        PID:12644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54303.exe
        6⤵
        
        PID:5716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10924.exe
        6⤵
        
        PID:14236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26416.exe
        5⤵
        
        PID:11156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-863.exe
        5⤵
        
        PID:14588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27645.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:13368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57700.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57700.exe
      4⤵
      PID:7592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19002.exe
        5⤵
        
        PID:13352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42679.exe
        5⤵
        
        PID:6480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37820.exe
        5⤵
        
        PID:14900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21975.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21975.exe
      4⤵
      PID:11000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-337.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-337.exe
      4⤵
      PID:15112
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33836.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33836.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:3476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60149.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60149.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28157.exe
        5⤵
        
        PID:5444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17877.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13210.exe
        7⤵
        
        PID:7472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10839.exe
        7⤵
        
        PID:13912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61052.exe
        7⤵
        
        PID:7280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39291.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:14072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45692.exe
        6⤵
        
        PID:904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2191.exe
        6⤵
        
        PID:11716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64960.exe
        6⤵
        
        PID:2532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34156.exe
        6⤵
        
        PID:16416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64036.exe
        5⤵
        
        PID:3356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21290.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56888.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:13968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2992.exe
        6⤵
        
        PID:14960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4113.exe
        6⤵
        
        PID:5480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59517.exe
        6⤵
        
        PID:6416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44835.exe
        5⤵
        
        PID:9948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35353.exe
        5⤵
        
        PID:12756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54075.exe
        5⤵
        
        PID:9504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59412.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59412.exe
      4⤵
      PID:5524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51317.exe
        5⤵
        
        PID:7040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29074.exe
        6⤵
        
        PID:7992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2016.exe
        6⤵
        
        PID:14000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54880.exe
        6⤵
        
        PID:5456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54044.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37819.exe
        5⤵
        
        PID:6912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36801.exe
        5⤵
        
        PID:13780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59671.exe
        5⤵
        
        PID:4504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51453.exe
        5⤵
        
        PID:11616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37507.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37507.exe
      4⤵
      PID:6388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28882.exe
        5⤵
        
        PID:10184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18928.exe
        5⤵
        
        PID:14128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62664.exe
        5⤵
        
        PID:16112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54003.exe
        5⤵
        
        PID:11300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50700.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50700.exe
      4⤵
      PID:9968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26687.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26687.exe
      4⤵
      PID:12720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61737.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61737.exe
      4⤵
      PID:3964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41019.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41019.exe
      4⤵
      PID:10408
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35074.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35074.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32957.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32957.exe
      4⤵
      PID:5792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38884.exe
        5⤵
        
        PID:6948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30628.exe
        6⤵
        
        PID:8404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5576.exe
        6⤵
        
        PID:1760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46027.exe
        6⤵
        
        PID:9084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25352.exe
        5⤵
        
        PID:9468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40448.exe
        5⤵
        
        PID:13980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37859.exe
        5⤵
        
        PID:8944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37515.exe
        5⤵
        
        PID:12472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35027.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35027.exe
      4⤵
      PID:7528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5337.exe
        5⤵
        
        PID:10464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62161.exe
        5⤵
        
        PID:11752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16727.exe
        5⤵
        
        PID:15808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8280.exe
        5⤵
        
        PID:2760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23623.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23623.exe
      4⤵
      PID:11188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15965.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15965.exe
      4⤵
      PID:13808
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57756.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57756.exe
    3⤵
    PID:5772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40228.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40228.exe
      4⤵
      PID:6440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18042.exe
        5⤵
        
        PID:13400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64387.exe
        5⤵
        
        PID:6660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29947.exe
        5⤵
        
        PID:14548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20557.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20557.exe
      4⤵
      PID:10912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64096.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64096.exe
      4⤵
      PID:15012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51932.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51932.exe
      4⤵
      PID:12212
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36436.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36436.exe
    3⤵
    PID:968
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-975.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-975.exe
    3⤵
    PID:10860
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51976.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51976.exe
    3⤵
    PID:15416
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29291.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29291.exe
    3⤵
    PID:5708
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2308.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2308.exe
    3⤵
    PID:14056
- C:\Users\Admin\AppData\Local\Temp\Unicorn-15947.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-15947.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4144
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38221.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38221.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:5020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38517.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38517.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65045.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35261.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8452.exe
        7⤵
        
        PID:5804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32177.exe
        8⤵
        
        PID:8468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10839.exe
        8⤵
        
        PID:13896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34967.exe
        8⤵
        
        PID:3420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51364.exe
        7⤵
        
        PID:7376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32930.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51913.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:15448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48320.exe
        7⤵
        
        PID:9136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15965.exe
        7⤵
        
        PID:2816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1875.exe
        7⤵
        
        PID:14856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46444.exe
        6⤵
        
        PID:5812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40228.exe
        7⤵
        
        PID:5860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22058.exe
        8⤵
        
        PID:10528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15576.exe
        8⤵
        
        PID:14444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62664.exe
        8⤵
        
        PID:10504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52341.exe
        8⤵
        
        PID:14480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20557.exe
        7⤵
        
        PID:10872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64096.exe
        7⤵
        
        PID:15020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3375.exe
        7⤵
        
        PID:4292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37323.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:15848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36891.exe
        6⤵
        
        PID:8872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2759.exe
        6⤵
        
        PID:13016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37892.exe
        6⤵
        
        PID:7600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15779.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8836.exe
        6⤵
        
        PID:5852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32177.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3064.exe
        7⤵
        
        PID:13072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18253.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59532.exe
        6⤵
        
        PID:7412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12161.exe
        7⤵
        
        PID:8492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26136.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:13388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31085.exe
        7⤵
        
        PID:11680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48320.exe
        6⤵
        
        PID:11252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15965.exe
        6⤵
        
        PID:13964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61008.exe
        6⤵
        
        PID:14196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44486.exe
        6⤵
        
        PID:10988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36059.exe
        5⤵
        
        PID:5980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50788.exe
        6⤵
        
        PID:5884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2089.exe
        7⤵
        
        PID:13524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38159.exe
        7⤵
        
        PID:11908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61661.exe
        7⤵
        
        PID:15348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21517.exe
        6⤵
        
        PID:10672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45456.exe
        6⤵
        
        PID:14528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64524.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20823.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:11232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56302.exe
        5⤵
        
        PID:15044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26718.exe
        5⤵
        
        PID:10968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61324.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61324.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44005.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65053.exe
        6⤵
        
        PID:5944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61525.exe
        7⤵
        
        PID:7312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37626.exe
        8⤵
        
        PID:7616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57464.exe
        8⤵
        
        PID:15356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59863.exe
        8⤵
        
        PID:6100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50493.exe
        8⤵
        
        PID:14720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34584.exe
        7⤵
        
        PID:9480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10100.exe
        7⤵
        
        PID:15052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21793.exe
        7⤵
        
        PID:7356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45292.exe
        7⤵
        
        PID:12376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50788.exe
        6⤵
        
        PID:7492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20263.exe
        7⤵
        
        PID:13320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6327.exe
        6⤵
        
        PID:10332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6728.exe
        6⤵
        
        PID:15084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27849.exe
        6⤵
        
        PID:6108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54229.exe
        6⤵
        
        PID:4168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40714.exe
        5⤵
        
        PID:6036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49709.exe
        6⤵
        
        PID:8600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49001.exe
        6⤵
        
        PID:13260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5103.exe
        6⤵
        
        PID:13592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53965.exe
        6⤵
        
        PID:5068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1203.exe
        5⤵
        
        PID:9288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43600.exe
        5⤵
        
        PID:13212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44589.exe
        5⤵
        
        PID:2360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4643.exe
        5⤵
        
        PID:5152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13355.exe
        5⤵
        
        PID:15212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54508.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54508.exe
      4⤵
      PID:5484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14996.exe
        5⤵
        
        PID:5500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40228.exe
        6⤵
        
        PID:7236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28114.exe
        7⤵
        
        PID:9832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32287.exe
        7⤵
        
        PID:4728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44185.exe
        6⤵
        
        PID:10812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6727.exe
        6⤵
        
        PID:14964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62826.exe
        6⤵
        
        PID:8460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5427.exe
        5⤵
        
        PID:2728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5856.exe
        5⤵
        
        PID:10936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40064.exe
        5⤵
        
        PID:3320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37190.exe
        5⤵
        
        PID:13288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8946.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8946.exe
      4⤵
      PID:6556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64981.exe
        5⤵
        
        PID:7924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26991.exe
        5⤵
        
        PID:11260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27375.exe
        5⤵
        
        PID:15732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28830.exe
        5⤵
        
        PID:11088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63356.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63356.exe
      4⤵
      PID:8544
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8544 -s 604
        5⤵
        Program crash
        
        PID:13660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31930.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31930.exe
      4⤵
      PID:6568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15226.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15226.exe
      4⤵
      PID:7320
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2123.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2123.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50629.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50629.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44005.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49869.exe
        6⤵
        
        PID:5868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25869.exe
        7⤵
        
        PID:5736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20906.exe
        8⤵
        
        PID:10016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8072.exe
        8⤵
        
        PID:13888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19327.exe
        8⤵
        
        PID:2168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43292.exe
        8⤵
        
        PID:11748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57716.exe
        7⤵
        
        PID:8672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4127.exe
        7⤵
        
        PID:13420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29577.exe
        7⤵
        
        PID:10668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10611.exe
        6⤵
        
        PID:6804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20906.exe
        7⤵
        
        PID:10024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8072.exe
        7⤵
        
        PID:13928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11159.exe
        7⤵
        
        PID:9400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30833.exe
        6⤵
        
        PID:10800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7300.exe
        6⤵
        
        PID:14976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3024.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30491.exe
        5⤵
        
        PID:5924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37523.exe
        6⤵
        
        PID:8160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26503.exe
        6⤵
        
        PID:11644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21056.exe
        6⤵
        
        PID:15520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58595.exe
        6⤵
        
        PID:13788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51172.exe
        5⤵
        
        PID:8880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59936.exe
        5⤵
        
        PID:13124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29724.exe
        5⤵
        
        PID:7856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49187.exe
        5⤵
        
        PID:10400
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5795.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5795.exe
      4⤵
      PID:6112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15100.exe
        5⤵
        
        PID:5704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45410.exe
        6⤵
        
        PID:9984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26712.exe
        6⤵
        
        PID:13992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2903.exe
        6⤵
        
        PID:10640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18637.exe
        5⤵
        
        PID:5676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15943.exe
        5⤵
        
        PID:14208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36515.exe
        5⤵
        
        PID:6492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4843.exe
        5⤵
        
        PID:13572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55475.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55475.exe
      4⤵
      PID:7672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34082.exe
        5⤵
        
        PID:11208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43722.exe
        5⤵
        
        PID:8720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4288.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4288.exe
      4⤵
      PID:11224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7830.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7830.exe
      4⤵
      PID:14924
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27970.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27970.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10756.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10756.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46578.exe
        5⤵
        
        PID:6184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64436.exe
        6⤵
        
        PID:8316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62736.exe
        6⤵
        
        PID:13252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5457.exe
        6⤵
        
        PID:4448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51.exe
        5⤵
        
        PID:7832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59936.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:13132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12536.exe
        5⤵
        
        PID:5756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40526.exe
        5⤵
        
        PID:15976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40522.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40522.exe
      4⤵
      PID:5176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7996.exe
        5⤵
        
        PID:8096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60048.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15426.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15426.exe
      4⤵
      PID:8304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57833.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57833.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:11052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56593.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56593.exe
      4⤵
      PID:15400
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62188.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62188.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8452.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8452.exe
      4⤵
      PID:5832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53637.exe
        5⤵
        
        PID:5648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31010.exe
        6⤵
        
        PID:11972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43380.exe
        6⤵
        
        PID:14808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64465.exe
        5⤵
        
        PID:9888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14900.exe
        5⤵
        
        PID:13836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37091.exe
        5⤵
        
        PID:15636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2643.exe
        5⤵
        
        PID:13536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51364.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51364.exe
      4⤵
      PID:7384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44554.exe
        5⤵
        
        PID:10508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65264.exe
        5⤵
        
        PID:7076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23623.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23623.exe
      4⤵
      PID:11180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15965.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15965.exe
      4⤵
      PID:4656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34967.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34967.exe
      4⤵
      PID:7432
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60350.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60350.exe
      4⤵
      PID:13772
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41427.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41427.exe
    3⤵
    PID:6072
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22501.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22501.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25914.exe
        5⤵
        
        PID:12964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6337.exe
        5⤵
        
        PID:1000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29845.exe
        5⤵
        
        PID:15576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2000.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2000.exe
      4⤵
      PID:10556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29311.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29311.exe
      4⤵
      PID:14436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63323.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63323.exe
      4⤵
      PID:7524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62596.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62596.exe
      4⤵
      PID:216
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55084.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55084.exe
    3⤵
    PID:7740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40314.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40314.exe
      4⤵
      PID:10660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31720.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31720.exe
      4⤵
      PID:14520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63322.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63322.exe
      4⤵
      PID:8940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4655.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4655.exe
      4⤵
      PID:5184
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4057.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4057.exe
    3⤵
    PID:10388
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42599.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42599.exe
    3⤵
    PID:1484
- C:\Users\Admin\AppData\Local\Temp\Unicorn-40259.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-40259.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:588
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54853.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54853.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43364.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43364.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27285.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7684.exe
        6⤵
        
        PID:5928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20773.exe
        7⤵
        
        PID:6456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20906.exe
        8⤵
        
        PID:9996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8072.exe
        8⤵
        
        PID:13920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4225.exe
        8⤵
        
        PID:16112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59357.exe
        8⤵
        
        PID:14388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25544.exe
        7⤵
        
        PID:10096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57168.exe
        7⤵
        
        PID:14172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20671.exe
        7⤵
        
        PID:5692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43380.exe
        7⤵
        
        PID:14876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50788.exe
        6⤵
        
        PID:7484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22842.exe
        7⤵
        
        PID:11852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2031.exe
        7⤵
        
        PID:15168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6327.exe
        6⤵
        
        PID:10324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6728.exe
        6⤵
        
        PID:15100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9593.exe
        6⤵
        
        PID:5612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45676.exe
        5⤵
        
        PID:2448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24333.exe
        6⤵
        
        PID:7872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-375.exe
        6⤵
        
        PID:11664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2405.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:14892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58563.exe
        5⤵
        
        PID:9192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50329.exe
        5⤵
        
        PID:13452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57886.exe
        5⤵
        
        PID:1168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11180.exe
        5⤵
        
        PID:1360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48643.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48643.exe
      4⤵
      PID:5492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17685.exe
        5⤵
        
        PID:5800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57965.exe
        6⤵
        
        PID:7608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63282.exe
        7⤵
        
        PID:10264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11060.exe
        7⤵
        
        PID:14188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5570.exe
        7⤵
        
        PID:1260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43380.exe
        7⤵
        
        PID:14804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35736.exe
        6⤵
        
        PID:372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15575.exe
        6⤵
        
        PID:15472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43405.exe
        6⤵
        
        PID:14840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1691.exe
        5⤵
        
        PID:8252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51968.exe
        5⤵
        
        PID:12128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40840.exe
        5⤵
        
        PID:2912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60965.exe
        5⤵
        
        PID:14076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34332.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34332.exe
      4⤵
      PID:6700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44229.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22634.exe
        6⤵
        
        PID:10456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65161.exe
        6⤵
        
        PID:14348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43832.exe
        6⤵
        
        PID:580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35507.exe
        6⤵
        
        PID:14140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34584.exe
        5⤵
        
        PID:6052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10100.exe
        5⤵
        
        PID:14920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43911.exe
        5⤵
        
        PID:2688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34540.exe
        5⤵
        
        PID:14736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16362.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16362.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5440.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5440.exe
      4⤵
      PID:11008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13305.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13305.exe
      4⤵
      PID:15456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16999.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16999.exe
      4⤵
      PID:3960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44700.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44700.exe
      4⤵
      PID:15412
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14235.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14235.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27285.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27285.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40522.exe
        5⤵
        
        PID:5292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19917.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9888.exe
        6⤵
        
        PID:11244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10100.exe
        6⤵
        
        PID:1216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12966.exe
        6⤵
        
        PID:5452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45484.exe
        6⤵
        
        PID:5060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26562.exe
        5⤵
        
        PID:7112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32369.exe
        5⤵
        
        PID:11568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13927.exe
        5⤵
        
        PID:15648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60201.exe
        5⤵
        
        PID:5260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5219.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5219.exe
      4⤵
      PID:5628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37139.exe
        5⤵
        
        PID:8216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28135.exe
        5⤵
        
        PID:13792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59664.exe
        5⤵
        
        PID:9460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38706.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38706.exe
      4⤵
      PID:7228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30641.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30641.exe
      4⤵
      PID:11028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4607.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4607.exe
      4⤵
      PID:15388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10123.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10123.exe
      4⤵
      PID:2472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30651.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30651.exe
      4⤵
      PID:11660
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56323.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56323.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2531.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2531.exe
      4⤵
      PID:6004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40228.exe
        5⤵
        
        PID:6384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20557.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:10956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23169.exe
        5⤵
        
        PID:15780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18823.exe
        5⤵
        
        PID:6880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36371.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36371.exe
      4⤵
      PID:7636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39655.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:10276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57870.exe
        5⤵
        
        PID:12796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38159.exe
        5⤵
        
        PID:6708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36965.exe
        5⤵
        
        PID:14488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23623.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23623.exe
      4⤵
      PID:11196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15965.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15965.exe
      4⤵
      PID:992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52182.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52182.exe
      4⤵
      PID:16568
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60123.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60123.exe
    3⤵
    PID:5408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32693.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32693.exe
      4⤵
      PID:5368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44948.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44948.exe
      4⤵
      PID:11696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1268.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1268.exe
      4⤵
      PID:15744
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12626.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12626.exe
    3⤵
    PID:8232
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47240.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47240.exe
    3⤵
    PID:11812
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36367.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36367.exe
    3⤵
    PID:15676
- C:\Users\Admin\AppData\Local\Temp\Unicorn-21723.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-21723.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2424
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34293.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34293.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35837.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35837.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:5064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32957.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33741.exe
        6⤵
        
        PID:6140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49221.exe
        7⤵
        
        PID:3148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54185.exe
        7⤵
        
        PID:11668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1268.exe
        7⤵
        
        PID:15736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3153.exe
        7⤵
        
        PID:15824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20980.exe
        7⤵
        
        PID:14400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45988.exe
        6⤵
        
        PID:8432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62736.exe
        6⤵
        
        PID:13116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2259.exe
        6⤵
        
        PID:14152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30699.exe
        5⤵
        
        PID:7140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44642.exe
        6⤵
        
        PID:10080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26136.exe
        6⤵
        
        PID:12628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12394.exe
        6⤵
        
        PID:732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54044.exe
        6⤵
        
        PID:13944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5914.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9992.exe
        5⤵
        
        PID:13444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45631.exe
        5⤵
        
        PID:7160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45638.exe
        5⤵
        
        PID:12648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63356.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63356.exe
      4⤵
      PID:5316
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5316 -s 632
        5⤵
        Program crash
        
        PID:5296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15426.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15426.exe
      4⤵
      PID:8296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57833.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57833.exe
      4⤵
      PID:12280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47088.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47088.exe
      4⤵
      PID:14216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60965.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60965.exe
      4⤵
      PID:12528
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42587.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42587.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8452.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8452.exe
      4⤵
      PID:5840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40228.exe
        5⤵
        
        PID:6300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29858.exe
        6⤵
        
        PID:13460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14806.exe
        6⤵
        
        PID:6632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19180.exe
        6⤵
        
        PID:14824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20557.exe
        5⤵
        
        PID:10896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64096.exe
        5⤵
        
        PID:15264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28425.exe
        5⤵
        
        PID:15808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36460.exe
        5⤵
        
        PID:15408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51364.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51364.exe
      4⤵
      PID:7392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47138.exe
        5⤵
        
        PID:10392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56993.exe
        5⤵
        
        PID:13696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46711.exe
        5⤵
        
        PID:1920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23623.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23623.exe
      4⤵
      PID:11216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15965.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15965.exe
      4⤵
      PID:1504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43135.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43135.exe
      4⤵
      PID:5468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51222.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51222.exe
      4⤵
      PID:6352
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27698.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27698.exe
    3⤵
    PID:6136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56813.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56813.exe
      4⤵
      PID:7644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60048.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60048.exe
      4⤵
      PID:12320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65374.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65374.exe
      4⤵
      PID:5036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18823.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18823.exe
      4⤵
      PID:4560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36038.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36038.exe
      4⤵
      PID:7080
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58075.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58075.exe
    3⤵
    PID:9264
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27064.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27064.exe
    3⤵
    PID:13188
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54129.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54129.exe
    3⤵
    PID:6120
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24356.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24356.exe
    3⤵
    PID:15840
- C:\Users\Admin\AppData\Local\Temp\Unicorn-58035.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-58035.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4544
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44581.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44581.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11436.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11436.exe
      4⤵
      PID:5392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16755.exe
        5⤵
        
        PID:5732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37242.exe
        6⤵
        
        PID:10084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2016.exe
        6⤵
        
        PID:14008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54539.exe
        5⤵
        
        PID:9068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19613.exe
        5⤵
        
        PID:10624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64036.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64036.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8676.exe
        5⤵
        
        PID:9176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32664.exe
        5⤵
        
        PID:13232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44173.exe
        5⤵
        
        PID:14284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44835.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44835.exe
      4⤵
      PID:9956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35353.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35353.exe
      4⤵
      PID:12892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38314.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38314.exe
      4⤵
      PID:8348
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-65084.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-65084.exe
    3⤵
    PID:5424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57404.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57404.exe
      4⤵
      PID:6624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19445.exe
        5⤵
        
        PID:7836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54585.exe
        5⤵
        
        PID:13220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52000.exe
        5⤵
        
        PID:13592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59820.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:11940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54539.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54539.exe
      4⤵
      PID:9056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10376.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10376.exe
      4⤵
      PID:3364
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20402.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20402.exe
    3⤵
    PID:6340
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8676.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8676.exe
      4⤵
      PID:9208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32664.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32664.exe
      4⤵
      PID:13204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4522.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4522.exe
      4⤵
      PID:14036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27261.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27261.exe
      4⤵
      PID:1720
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28228.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28228.exe
    3⤵
    PID:9452
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61678.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61678.exe
    3⤵
    PID:13744
- C:\Users\Admin\AppData\Local\Temp\Unicorn-9987.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-9987.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1140
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7684.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7684.exe
    3⤵
    PID:5936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4436.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4436.exe
      4⤵
      PID:6496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12929.exe
        5⤵
        
        PID:8332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9800.exe
        5⤵
        
        PID:14332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13846.exe
        5⤵
        
        PID:3996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59933.exe
        5⤵
        
        PID:684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58601.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58601.exe
      4⤵
      PID:8732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23535.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23535.exe
      4⤵
      PID:14312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60361.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60361.exe
      4⤵
      PID:15352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37899.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37899.exe
      4⤵
      PID:15920
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50788.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50788.exe
    3⤵
    PID:7500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57937.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57937.exe
      4⤵
      PID:10552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-863.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-863.exe
      4⤵
      PID:14608
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6327.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6327.exe
    3⤵
    PID:10404
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40941.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40941.exe
    3⤵
    PID:15272
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53526.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53526.exe
    3⤵
    PID:16408
- C:\Users\Admin\AppData\Local\Temp\Unicorn-16684.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-16684.exe
  2⤵
  PID:2528
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47908.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47908.exe
    3⤵
    PID:8172
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36801.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36801.exe
    3⤵
    PID:13684
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59864.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59864.exe
    3⤵
    PID:13584
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4874.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4874.exe
    3⤵
    PID:11100
- C:\Users\Admin\AppData\Local\Temp\Unicorn-57162.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-57162.exe
  2⤵
  PID:8220
- C:\Users\Admin\AppData\Local\Temp\Unicorn-14088.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-14088.exe
  2⤵
  PID:11736
- C:\Users\Admin\AppData\Local\Temp\Unicorn-57329.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-57329.exe
  2⤵
  PID:15640
- C:\Users\Admin\AppData\Local\Temp\Unicorn-43571.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-43571.exe
  2⤵
  PID:9512

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3420 -ip 3420
1⤵
PID:5256

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 5316 -ip 5316
1⤵
PID:7472

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 6568 -ip 6568
1⤵
PID:8684

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 8124 -ip 8124
1⤵
PID:9596

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 8544 -ip 8544
1⤵
PID:13572

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:15352

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-10244.exe

Filesize
468KB

MD5
b66b006514eb15ca2f08f5d400028c84

SHA1
a03045a688fdaf88cf375e61137f4da37463bfab

SHA256
e1c1176484f7e135b370258bb1456a7f0e24ef2ecb07e611647c90247e86c5a4

SHA512
e51a20039b0b525c40cbe4ca7bacb5315d09672b4e711c06597f0c423526a6f3a20c24df6df202f305cbef2e1a6884a0331fdf5854b5f2bcc80f3b4dfd428c3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-13083.exe

Filesize
468KB

MD5
d9e3b79a1f4d2821a2f9b7a980f055cb

SHA1
90051ea72b5e5bf4694c0f1c4567dac14eb8d6ad

SHA256
cbdc29cfc67c087897c31fe478ce195330ff5152ff9f4d646a17873b03f996e9

SHA512
0a54bc6af9a33bb3bf15cc8b19066ea0bfc9616f3f3e67406513e32d76a9c9e4d468f7187402034ffdcb82d70dd50944ddad9cdd9e28cc26e017244fec0f98ef

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-14235.exe

Filesize
468KB

MD5
5b1e48c69159d189e30a9a20aa4ee36b

SHA1
55c709eb58588db326c5af1be0582f4e1daba0a3

SHA256
1e1c082e47b843fea6fd892315a703a5a001d61e955d5f806e454bac3b4c3477

SHA512
3fb2ac1d480e5ff67fd193449abc6285de5b9034806a462a958e00cc379d574650eab1179fad0fd261311f8f43923c3e1acbb40b60310e5e44b8966b831eb115

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-15268.exe

Filesize
468KB

MD5
8526b3a509b19458e31ec16310bec024

SHA1
de39c0ebbabc9faa168beadbdea041134069a1af

SHA256
4a7c8f952fb9f60214a4e4824b6c013e0321068e925b2bb7babbd30d5de60bd0

SHA512
ff6a95e8f874749735033ca6bc82226996797eb3b47269ed7466d2e2206bb9429c83c48d9158e38b37f6b8c6f91f8645081c50342e4ec64df7a6a7fa3d98f22f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-15947.exe

Filesize
468KB

MD5
0c17b7471918381707e28d93ac67c97d

SHA1
c8bbf70577a055bbd9de7ab33c772a9f9348d3e2

SHA256
2f6e249d5c4b5cf5d3e1470804fd80ee3bacd7c8902528e512b740e787cecd2d

SHA512
7c7a0c901c2b7a2dc774cb01cdf0a78b0525cb6cab4c821b04fcb33e8be17d81a8780be065192dd5b9ea274830a0d5fd21c8111c08ce642e9233ced76903335e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-17765.exe

Filesize
468KB

MD5
2407c5ca12eb6e1aafd814d2651999c9

SHA1
417dc75e62b5f958db0fd52adc530e867704530a

SHA256
4915ecf4b90936676bcad007ca7304718f882cd878daeaf82e49ca645ff0415b

SHA512
631ded45fbe347203d9b019bcda512a54a0061f26bbf544f9b243cdf31a49edfe44d112c36d8fbbabefcb9f707b84060df911358587bf5e8e174885040b56a7d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-18237.exe

Filesize
468KB

MD5
34d2d03c5c665ce3663df94f8ed61e5a

SHA1
10876e4f38f2670a7cabcbc25c4aca275397d53d

SHA256
42a04d779c229b4562ebbd7ce47b984f9e049c437626710fca610823773852cd

SHA512
cc56bfc4f954c95c1606e1e178b9392e5b82d950a19abd4b6ebecbd1112ce23dd6bedcdf10c627e9726009f2d79d9063f7879df97e1d46a450f086dcfe4ce27d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-18267.exe

Filesize
468KB

MD5
f36214ac2e019c9daed9ae8e3e47713c

SHA1
ea92c8cb9cb7006aaba95786e1c3f2c003f7629f

SHA256
0c6626e261403c4411aa10cf050e8a1fee234a206fd744e9453fbcac6fd3acc5

SHA512
ce0e18da50d910989448eb01f99e0e501194f1c8e7fad2db5931422773aaeb7a473fe5c2e780f3f6bd501327ba8b19f80c3ee0640a49ebb113d96983de8dc467

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-2123.exe

Filesize
468KB

MD5
30cd642bb013ca712a11623a672a068e

SHA1
8afeff703296f4665dc70ba3c35f3d5e5a4060ec

SHA256
694d083bd8feac42c2069538a6131216e8aeeedcdfa69ef01e70f6a5f74aec71

SHA512
2e8b94b907354313154c86cdbd559cd509bca44a22c5267ebd4592eb24b9626d4e927926f263f6e43e49190ac55bd58e95cd763baa236cbf7cae8976ed9838bf

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-21413.exe

Filesize
468KB

MD5
7234667a583cbf61e336fbcf949f0de2

SHA1
24b8995d5b18c5e655ae06f8406736a50a265344

SHA256
2fd8a8aba775284f76e215bf8dbb5ba89a8000d4e91de6ed6652727e73680ba8

SHA512
313393bd2706fbe60003b5d2e8b65e8f1972d0ee2cb406b48531dd7853c2d7d8556ab245ff302d0ecfbfabdb3c3eb89b61cb354b146f928e8bd3142cf843bf60

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-21723.exe

Filesize
468KB

MD5
420ec8fc51911ef14f3eddef3c729cc8

SHA1
9a67fdf54e2f5dd41b8015c7562bbfa8427087de

SHA256
bb19810518695e2c50d816384cee20d2050c4cbf910842e7444f40f5fbf60a2a

SHA512
e4d58c1206ae881923ed1f608e4f82830e8abb8c507f8f3d636c14ba4e0b1b3815b0af568d4349ca589b42d4dd4fa15651beddec273ee6cddd9d9776c08ecabf

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-22565.exe

Filesize
468KB

MD5
14a053a3f2e1f65b5b7de343bfaec95a

SHA1
b63ec745fcc4c6b20b0153aeacc3f55ef497a90d

SHA256
02f07dfba05b2f5ec5039080518b3ebd6986cd954493904cb7649018feb6652c

SHA512
865f1d5f80f7f3a6610f07a9beb706a055596ef2d547198252ef9c4ac4b699be323c5dd52890ebf71ca9eb1aee2dd2b15a2e49cacefad2515c32425d17843217

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-25858.exe

Filesize
468KB

MD5
3e643269dd05ee6fe4378bfd892b64ca

SHA1
5debeae701274b734d7c15b2e3ee7afb9c64e0d6

SHA256
1f3eb91a88a6326491762ffacc2b4446092a1aaf4eb76a7184e181245597ef94

SHA512
ffc79b3dbb6b8f789520ca48dc0af565ae13c33729cde7d6b10e728c76804c1dd409522f8c1e022ecdcbac3c20a019de4e447baa42332e0fbebf3834a075d2ce

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-27970.exe

Filesize
468KB

MD5
02c3d6ac877b2db2a74ea47061d9eeb9

SHA1
6db316d9392f28dd4bf2819a1ed79bb54b27244d

SHA256
85da864c63c97345480165a8392ec27a1da9177b403cded2c543b20e361844be

SHA512
f1cba0c87520ea8e0f30fa01fde9307cf16ec65912062e76241bf39f5f1b0cef1ee963a1c0bea5bad007d3346b97e0159210250fb3911684a84e4789a5abcae1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-29861.exe

Filesize
468KB

MD5
5702ce2ea70ace016cf445bc7dcb60b8

SHA1
838bdd247dc583f9369a40d3729107ffc084612d

SHA256
5885a48e9817da517fd6f8ef9f7dbdb66339e0a51ba0f16ddae18211140a1102

SHA512
9384b58c48403f1f4e8f7323479af25de9cc9cd1975c88aa2c9d9d73a77d447cfea82e3c248eee9bb6977798aea49b17a638aa70202eb0d026505e7234adb176

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-33836.exe

Filesize
468KB

MD5
d94783299d3baa5baf49c75e8c736cbc

SHA1
61af110388237cb9ed0a6b79f519ad860bd968f1

SHA256
c5388eea7c5a810c0498478140b0cc061cc1b3f36373743382e06131b0291eac

SHA512
9fcf08e063fcf1b5d315c013aaccfebd539efd58361d08d72ec6de09023c8044637d2b0d645788459fa28948a54088856828c1301f0cd435e9e951bc35cba078

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-34293.exe

Filesize
468KB

MD5
1a3b86d5d020eb75d073abd2ffa7f396

SHA1
0d98654096eda85710bc99533030e05560083faa

SHA256
87a5423144d448290899bc32b0ecce91ff897504d96714f33024645bbf076cac

SHA512
f015ccd2c309da47580ffc990cacfbf8f2cddcd49b2b06595539e7c2957ce36fb5b6cecc5af32d75912b60c4d561ea344c61c43e0f4e159264b960fcd282ae44

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-35813.exe

Filesize
468KB

MD5
fca7d5e23a75340d4c8bb803603ae6d6

SHA1
c3860388251dc499834bc3e383e921025c7be009

SHA256
234e327fc197c75b7f2eca2d4f3e85cbc0e24cc63fc6cee9c7cfc0e79722d7d5

SHA512
2de6c94485dc8bcce738f91830a4dd989be48e068a120b764fd032a7d98e1259f90bf583b12140e314bcc03d1a1452fdf0f29cf7c4b4293f5e6abfc4f7d0d4ce

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-38221.exe

Filesize
468KB

MD5
8a1f8051dc4757c0290fa504d9067453

SHA1
006a89d8cb0e4bce10f4835b1029325033684ae8

SHA256
6d39c5e589041135b0b4e86a81c9fd2b1f8735500f9b9baf93b014241fbcf9bb

SHA512
e87d4ce5b75f745913f944f5fb7ba53ad55165df19b4d3ac35cb399a59a6373a9c76a958b7a88cd30bc60f8b334d2806c189447ec41a61f971dc2bb1848b6b6d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-38517.exe

Filesize
468KB

MD5
c749eaa828308123e743f7e646f01d54

SHA1
9e078fe236822174b6915bf40c735cc8263825fa

SHA256
31f8ac9e21717cd3cea163a46236f5918fbe13ec0722052da11532022357095b

SHA512
5a7a13a90061493320f3264b316c98d0a6c1561f876503b20d174579d5852a0871476d374b779f9bf781e0a568221b1b4e3611df0bdc1da96a84f4851c685b1b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-40259.exe

Filesize
468KB

MD5
8b40e8e7096d3d2c88640deb2652a29e

SHA1
e46ca4dfec008a2082d0432135bf2971ca66c898

SHA256
db0a43650051994711d384cc85431075cb206d0469a4b64187dc383fd81078cb

SHA512
c193f37cab3fa4a8180bc74df6defe5842ff88a2fa52f53ea68b4217b29d4fba388e8d64619a72ed52d57a525f19bb6d0dace00ebb110cdb61af61879254e722

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-42994.exe

Filesize
468KB

MD5
7ec2b36a720fc3055731d98e00b49ecd

SHA1
48e980c5803726228693746267b39db7f532059d

SHA256
5b55332e4637f8267f46fa96afa373e10ca236baf5f963fdf187fa71e3b3ece9

SHA512
99d5d9e4e39b0ce593331ed825a6b08371fd9ad49a6ee5c34eb773e36b72f7d973583fdc75cd260330ea68cc43521155dbdf997b43a9ad973b9d7ba0a77a5cdf

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-4308.exe

Filesize
468KB

MD5
31c33af739afbd68a5874f8056385ff1

SHA1
9809c16628c327d6f21002c844a12fa0be75f9cd

SHA256
4f2c7143b834cc0e30953ad5919d104b5685ca3cc60e108db82f8f82536a244c

SHA512
175bad53978c968bd0f7cb6e36c9a0f59e1723f5d24fa073fb87dc7b643a165de08e4133615014fb2edc70f00e5f97b80d739dfe597c5480921ce756b913f44f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-43364.exe

Filesize
468KB

MD5
8aed99fbec8cea64d8c95630c822eac9

SHA1
698a300ff68892b229fc3094419bf1ff24570a51

SHA256
dab6f918457b7ca3f39e06a4e5c558d7334ea07a705a638ecf26338052a94bd2

SHA512
66174bd4283e85e589e9c73cb073585e0b4aa16bcefcb7784cbb2ec4bd3cee77b473dce6ec35d854f7330edd420d97757892063fcfa4c9df0012e70aaf5d827a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-45180.exe

Filesize
468KB

MD5
c7ea438d81420d75c9f79f36c044cdb3

SHA1
2900e0b39d49eb06276814774363c30d09570759

SHA256
7c83bc96c015cf4450b85892458cf7a243f64bf0b5aee308206a12cd21843d0d

SHA512
1b8177f9392f2221cde57daba78ad59fdb1aacc7f2d6024b1d60a520089573749b2ec82a0245d978f6ebebebbde00ee3a8ee12d0c91a554313244d430d5ac182

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-50629.exe

Filesize
468KB

MD5
d97de501ac54febd96b1b2f8b0462bf2

SHA1
53630b8d92ba8b7adefbb8e65416b48e2a132f4b

SHA256
f39c7c8c2f54f51cb7c5f4d27c5b4614483b74da163a86815654787fb63bfe2e

SHA512
e71647f14acddd2133a53b2673d22e7045931b5d821f6810a3f4fe83758573a6ec74ab92cc9227b0f24671bf4edbe6545f06c2b0bf08c43278951e046bdaa168

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-51028.exe

Filesize
468KB

MD5
4a178b9102a8dda6b1c17439a2b99b7c

SHA1
9dd5be1dba462c04097a4e5be7aa4c3fb6e2efcf

SHA256
bc20497a0da2206f0b55894fb8c9e9040b011f0b20f1926bdcf613eaa23a63f5

SHA512
3de963f5faff4f7d9fddeb5fcc4b99fe17ea5aeea814eb363cff2e787e657169144e14cebafbe8bd9703a5fa5185ede84f4810c2a9e85a975d95924bfe4e4db6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-54308.exe

Filesize
468KB

MD5
6d92a9c73577ce8a683d7d407abe5c74

SHA1
93eff77d5afaaec2f6c39e5f36734847d29524c4

SHA256
429abb12fd48ea7d18231ec5c9f0e44025161fb9fc206dbf3d31d4479c2785f8

SHA512
5177e32a3bd6af26e16cb90de72396b3430a4afb124da9d9f1c11f4254421b4b09f89b74a85d22aa6c5136afca5c113100b1f583bb046490882018c45de12fc6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-54853.exe

Filesize
468KB

MD5
6ff7d3cc9f6a686531358d0bbcbabfcf

SHA1
11900f1e53e03431ea67b3c0a2a7ac1a30551fe1

SHA256
8da8b3dfc3581dc5917723b178faef9b3e19ffba92e881a532e5b9ec0b8c0182

SHA512
fd80a65f13a900bfd6f5c446f85a27e7f287cbecd701d74963ea0384dc4aa9ab6d3d9c9cc890039f5c218e3a17bf11ea556014e51a1d2077b83663c529d17354

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-58035.exe

Filesize
468KB

MD5
e3b9d561224e2a80f376f5bcdd4c9e1f

SHA1
84544c02cb7807ae9c8859d5abfa3cfa33a30e84

SHA256
092fa995ddde1805fd3c24dc0aba9d1f8dacbc96826d08fbd516ade2fd9267d7

SHA512
fe3409476673c7262a5e845cc651cd08fbc017dc9e450c6fec50440cb570edfd52263d72146245022c224a66c91517a5409f0d9e393084c94117a5451ea84b77

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-61324.exe

Filesize
468KB

MD5
3b669f7a1c0db56c0e0ea3cf7ba01b6e

SHA1
fbdaa5b4093d6eafd2bd32f90e1523beb3af7777

SHA256
7ef35680e61e6047b1a632998ea91d448e77e9e7ad5c71d5f5d129b3bd269957

SHA512
955476074c6e9ac70741f690b6c1f3ac202a34bbd008a6ba1db768957e9304ffbb9d45a0e523b7ee847e238742813d4465617fb6843f2b24b7cd0044acfbf3b8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-65045.exe

Filesize
468KB

MD5
f851c5be40c8022ebcd959f81f84651c

SHA1
f3d414275168b68e0873ca81eb33c0072643c3b8

SHA256
20c77f1ab8ab9042dd73cf9ea61339ea9c73e3e4a4edc2ccbca8ee0aa3003234

SHA512
6e79ca26fad0db8af68d4d51bd6bc93ee7df0364d62b01b870facb452f4bbb30570c199bfa945a253ceb012c08e87d93d1ae742b2271274f4c6093e966579dbf

Download Submit
memory/400-167-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/456-330-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/588-33-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/620-299-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/652-281-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/912-430-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/940-147-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1052-452-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1132-328-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1140-290-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1152-454-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1304-350-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1332-420-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1336-309-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1428-484-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1588-416-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1592-63-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1852-227-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1904-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2072-117-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2176-264-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2180-453-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2196-417-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2336-406-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2392-139-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2424-96-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2508-407-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2544-405-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2748-443-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2768-325-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2836-429-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2916-204-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2988-226-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3000-295-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3052-252-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3056-349-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3204-197-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3336-244-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3420-404-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3452-95-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3476-216-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3484-189-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3488-254-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3668-259-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3716-239-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3792-240-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3928-329-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3944-348-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3956-40-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4092-55-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4136-274-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4144-14-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4208-217-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4424-211-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4468-351-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4476-21-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4516-440-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4544-219-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4632-89-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4644-91-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4648-73-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4724-188-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4736-152-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4804-126-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4904-324-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4956-269-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4960-90-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5000-6-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5020-27-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5056-111-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5064-345-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5088-133-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5104-44-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5276-485-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5308-455-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5356-486-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5372-467-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5392-468-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5424-469-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5444-470-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5484-487-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5492-471-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5524-478-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5720-498-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5792-499-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5804-509-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5840-510-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5852-511-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5868-520-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5928-574-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5936-523-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5944-530-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5960-579-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5972-582-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/6004-531-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/6112-532-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads