a5924b2278e11460da7eb5d79e67b0b27ad34f22c2d9a89e5b53f66669ac3755

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
21/11/2024, 04:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a5924b2278e11460da7eb5d79e67b0b27ad34f22c2d9a89e5b53f66669ac3755.exe
Size

468KB
MD5

f95d3addc76bd40fc02544c2420a8061
SHA1

423165a07e28ae56503d9749f1deb57e6247047e
SHA256

a5924b2278e11460da7eb5d79e67b0b27ad34f22c2d9a89e5b53f66669ac3755
SHA512

68285c8b7f47fae187f209ac8fc276091a9147ffd4da0d1933c9fbab5143c4aa16b0a6e351369692c3b5ab03609c42d8853d560466db3f1a8710f9c49b18049c
SSDEEP

3072:B1NFoggday8Anb/y5z5vff1DfhWtI8zzmHe7VpZnMunu3gcLN3nl+:B1zomLAnu51vff8xx9Munk9LN3

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
3868	Unicorn-43235.exe
1836	Unicorn-13650.exe
2676	Unicorn-42985.exe
4660	Unicorn-59011.exe
2868	Unicorn-26339.exe
1936	Unicorn-20208.exe
4644	Unicorn-45786.exe
3652	Unicorn-45091.exe
892	Unicorn-12418.exe
4064	Unicorn-64115.exe
1364	Unicorn-25417.exe
4588	Unicorn-31443.exe
464	Unicorn-15910.exe
1732	Unicorn-25312.exe
3092	Unicorn-42625.exe
2092	Unicorn-16275.exe
1640	Unicorn-60986.exe
2020	Unicorn-1090.exe
3528	Unicorn-47639.exe
636	Unicorn-47639.exe
2836	Unicorn-33763.exe
4360	Unicorn-32922.exe
1928	Unicorn-16467.exe
1340	Unicorn-62910.exe
208	Unicorn-60110.exe
4324	Unicorn-48106.exe
1596	Unicorn-2434.exe
3004	Unicorn-61059.exe
1688	Unicorn-47930.exe
4124	Unicorn-52263.exe
3304	Unicorn-52528.exe
4476	Unicorn-18019.exe
2332	Unicorn-63690.exe
2724	Unicorn-11312.exe
3812	Unicorn-49274.exe
5108	Unicorn-52227.exe
2384	Unicorn-17753.exe
4704	Unicorn-4946.exe
2244	Unicorn-47057.exe
4924	Unicorn-38771.exe
1632	Unicorn-51386.exe
3792	Unicorn-28787.exe
652	Unicorn-44666.exe
1892	Unicorn-44931.exe
2104	Unicorn-44931.exe
3872	Unicorn-44931.exe
4740	Unicorn-44355.exe
556	Unicorn-18889.exe
3416	Unicorn-60883.exe
3404	Unicorn-51953.exe
3944	Unicorn-5744.exe
4516	Unicorn-7769.exe
1464	Unicorn-40633.exe
3084	Unicorn-44547.exe
1616	Unicorn-54369.exe
1332	Unicorn-64339.exe
1944	Unicorn-60618.exe
1920	Unicorn-5922.exe
4424	Unicorn-5922.exe
4088	Unicorn-50826.exe
2328	Unicorn-40515.exe
1740	Unicorn-41776.exe
3108	Unicorn-8034.exe
3864	Unicorn-40323.exe

Program crash 8 IoCs

pid	pid_target	Process	procid_target
11844	6548	WerFault.exe	522
1660	10120	WerFault.exe	516
12604	5964	WerFault.exe	517
4524	10512	WerFault.exe	526
4972	16100	WerFault.exe	787
14376	6548	WerFault.exe	522
16012	15684	WerFault.exe	776
5588	5172	WerFault.exe	289

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12418.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62623.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62951.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43716.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51864.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46595.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45841.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1835.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37934.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-765.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56791.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59075.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26688.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61656.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31826.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44954.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45550.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11750.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10829.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57011.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19546.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37201.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23088.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10246.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45175.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19042.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22019.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48686.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35192.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41776.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45824.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23687.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39433.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32045.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53392.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43374.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51914.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3497.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18534.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21750.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54702.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-642.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59075.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23673.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39110.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17821.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44734.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41063.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42014.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52088.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36915.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3506.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41153.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-258.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61795.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25053.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39110.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32195.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6185.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57175.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28198.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	4312	dwm.exe
Token: SeChangeNotifyPrivilege	4312	dwm.exe
Token: 33	4312	dwm.exe
Token: SeIncBasePriorityPrivilege	4312	dwm.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
432	a5924b2278e11460da7eb5d79e67b0b27ad34f22c2d9a89e5b53f66669ac3755.exe
3868	Unicorn-43235.exe
1836	Unicorn-13650.exe
2676	Unicorn-42985.exe
2868	Unicorn-26339.exe
4660	Unicorn-59011.exe
1936	Unicorn-20208.exe
4644	Unicorn-45786.exe
3652	Unicorn-45091.exe
892	Unicorn-12418.exe
4064	Unicorn-64115.exe
1732	Unicorn-25312.exe
464	Unicorn-15910.exe
1364	Unicorn-25417.exe
4588	Unicorn-31443.exe
3092	Unicorn-42625.exe
2092	Unicorn-16275.exe
1640	Unicorn-60986.exe
2020	Unicorn-1090.exe
2836	Unicorn-33763.exe
4360	Unicorn-32922.exe
636	Unicorn-47639.exe
3528	Unicorn-47639.exe
1928	Unicorn-16467.exe
4324	Unicorn-48106.exe
1340	Unicorn-62910.exe
208	Unicorn-60110.exe
1596	Unicorn-2434.exe
3004	Unicorn-61059.exe
1688	Unicorn-47930.exe
3304	Unicorn-52528.exe
4124	Unicorn-52263.exe
4476	Unicorn-18019.exe
2332	Unicorn-63690.exe
2724	Unicorn-11312.exe
3812	Unicorn-49274.exe
5108	Unicorn-52227.exe
2384	Unicorn-17753.exe
4704	Unicorn-4946.exe
2244	Unicorn-47057.exe
1632	Unicorn-51386.exe
4924	Unicorn-38771.exe
3792	Unicorn-28787.exe
652	Unicorn-44666.exe
3872	Unicorn-44931.exe
556	Unicorn-18889.exe
2104	Unicorn-44931.exe
3404	Unicorn-51953.exe
3944	Unicorn-5744.exe
1892	Unicorn-44931.exe
3416	Unicorn-60883.exe
4740	Unicorn-44355.exe
3084	Unicorn-44547.exe
1464	Unicorn-40633.exe
4516	Unicorn-7769.exe
1616	Unicorn-54369.exe
1944	Unicorn-60618.exe
1332	Unicorn-64339.exe
1920	Unicorn-5922.exe
1740	Unicorn-41776.exe
4088	Unicorn-50826.exe
2328	Unicorn-40515.exe
4424	Unicorn-5922.exe
3108	Unicorn-8034.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 432 wrote to memory of 3868	432	a5924b2278e11460da7eb5d79e67b0b27ad34f22c2d9a89e5b53f66669ac3755.exe	89
PID 432 wrote to memory of 3868	432	a5924b2278e11460da7eb5d79e67b0b27ad34f22c2d9a89e5b53f66669ac3755.exe	89
PID 432 wrote to memory of 3868	432	a5924b2278e11460da7eb5d79e67b0b27ad34f22c2d9a89e5b53f66669ac3755.exe	89
PID 3868 wrote to memory of 1836	3868	Unicorn-43235.exe	92
PID 3868 wrote to memory of 1836	3868	Unicorn-43235.exe	92
PID 3868 wrote to memory of 1836	3868	Unicorn-43235.exe	92
PID 432 wrote to memory of 2676	432	a5924b2278e11460da7eb5d79e67b0b27ad34f22c2d9a89e5b53f66669ac3755.exe	93
PID 432 wrote to memory of 2676	432	a5924b2278e11460da7eb5d79e67b0b27ad34f22c2d9a89e5b53f66669ac3755.exe	93
PID 432 wrote to memory of 2676	432	a5924b2278e11460da7eb5d79e67b0b27ad34f22c2d9a89e5b53f66669ac3755.exe	93
PID 1836 wrote to memory of 4660	1836	Unicorn-13650.exe	98
PID 1836 wrote to memory of 4660	1836	Unicorn-13650.exe	98
PID 1836 wrote to memory of 4660	1836	Unicorn-13650.exe	98
PID 2676 wrote to memory of 2868	2676	Unicorn-42985.exe	99
PID 2676 wrote to memory of 2868	2676	Unicorn-42985.exe	99
PID 2676 wrote to memory of 2868	2676	Unicorn-42985.exe	99
PID 432 wrote to memory of 1936	432	a5924b2278e11460da7eb5d79e67b0b27ad34f22c2d9a89e5b53f66669ac3755.exe	100
PID 432 wrote to memory of 1936	432	a5924b2278e11460da7eb5d79e67b0b27ad34f22c2d9a89e5b53f66669ac3755.exe	100
PID 432 wrote to memory of 1936	432	a5924b2278e11460da7eb5d79e67b0b27ad34f22c2d9a89e5b53f66669ac3755.exe	100
PID 3868 wrote to memory of 4644	3868	Unicorn-43235.exe	101
PID 3868 wrote to memory of 4644	3868	Unicorn-43235.exe	101
PID 3868 wrote to memory of 4644	3868	Unicorn-43235.exe	101
PID 2868 wrote to memory of 3652	2868	Unicorn-26339.exe	102
PID 2868 wrote to memory of 3652	2868	Unicorn-26339.exe	102
PID 2868 wrote to memory of 3652	2868	Unicorn-26339.exe	102
PID 4660 wrote to memory of 892	4660	Unicorn-59011.exe	103
PID 4660 wrote to memory of 892	4660	Unicorn-59011.exe	103
PID 4660 wrote to memory of 892	4660	Unicorn-59011.exe	103
PID 2676 wrote to memory of 1364	2676	Unicorn-42985.exe	104
PID 2676 wrote to memory of 1364	2676	Unicorn-42985.exe	104
PID 2676 wrote to memory of 1364	2676	Unicorn-42985.exe	104
PID 1936 wrote to memory of 4064	1936	Unicorn-20208.exe	105
PID 1936 wrote to memory of 4064	1936	Unicorn-20208.exe	105
PID 1936 wrote to memory of 4064	1936	Unicorn-20208.exe	105
PID 4644 wrote to memory of 4588	4644	Unicorn-45786.exe	106
PID 4644 wrote to memory of 4588	4644	Unicorn-45786.exe	106
PID 4644 wrote to memory of 4588	4644	Unicorn-45786.exe	106
PID 432 wrote to memory of 464	432	a5924b2278e11460da7eb5d79e67b0b27ad34f22c2d9a89e5b53f66669ac3755.exe	107
PID 432 wrote to memory of 464	432	a5924b2278e11460da7eb5d79e67b0b27ad34f22c2d9a89e5b53f66669ac3755.exe	107
PID 432 wrote to memory of 464	432	a5924b2278e11460da7eb5d79e67b0b27ad34f22c2d9a89e5b53f66669ac3755.exe	107
PID 3868 wrote to memory of 1732	3868	Unicorn-43235.exe	108
PID 3868 wrote to memory of 1732	3868	Unicorn-43235.exe	108
PID 3868 wrote to memory of 1732	3868	Unicorn-43235.exe	108
PID 1836 wrote to memory of 3092	1836	Unicorn-13650.exe	109
PID 1836 wrote to memory of 3092	1836	Unicorn-13650.exe	109
PID 1836 wrote to memory of 3092	1836	Unicorn-13650.exe	109
PID 3652 wrote to memory of 2092	3652	Unicorn-45091.exe	110
PID 3652 wrote to memory of 2092	3652	Unicorn-45091.exe	110
PID 3652 wrote to memory of 2092	3652	Unicorn-45091.exe	110
PID 2868 wrote to memory of 1640	2868	Unicorn-26339.exe	111
PID 2868 wrote to memory of 1640	2868	Unicorn-26339.exe	111
PID 2868 wrote to memory of 1640	2868	Unicorn-26339.exe	111
PID 4064 wrote to memory of 2020	4064	Unicorn-64115.exe	112
PID 4064 wrote to memory of 2020	4064	Unicorn-64115.exe	112
PID 4064 wrote to memory of 2020	4064	Unicorn-64115.exe	112
PID 1936 wrote to memory of 636	1936	Unicorn-20208.exe	114
PID 1936 wrote to memory of 636	1936	Unicorn-20208.exe	114
PID 1936 wrote to memory of 636	1936	Unicorn-20208.exe	114
PID 4660 wrote to memory of 3528	4660	Unicorn-59011.exe	113
PID 4660 wrote to memory of 3528	4660	Unicorn-59011.exe	113
PID 4660 wrote to memory of 3528	4660	Unicorn-59011.exe	113
PID 1732 wrote to memory of 2836	1732	Unicorn-25312.exe	115
PID 1732 wrote to memory of 2836	1732	Unicorn-25312.exe	115
PID 1732 wrote to memory of 2836	1732	Unicorn-25312.exe	115
PID 3868 wrote to memory of 4360	3868	Unicorn-43235.exe	116

C:\Users\Admin\AppData\Local\Temp\a5924b2278e11460da7eb5d79e67b0b27ad34f22c2d9a89e5b53f66669ac3755.exe
"C:\Users\Admin\AppData\Local\Temp\a5924b2278e11460da7eb5d79e67b0b27ad34f22c2d9a89e5b53f66669ac3755.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:432
- C:\Users\Admin\AppData\Local\Temp\Unicorn-43235.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-43235.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3868
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13650.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13650.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59011.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59011.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12418.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47930.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5922.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62339.exe
        8⤵
        
        PID:5388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45843.exe
        9⤵
        
        PID:6800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32000.exe
        10⤵
        
        PID:11120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60519.exe
        10⤵
        
        PID:15596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18534.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:9600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36638.exe
        9⤵
        
        PID:12528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33799.exe
        9⤵
        
        PID:16008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36169.exe
        8⤵
        
        PID:6664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23536.exe
        9⤵
        
        PID:11644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61287.exe
        9⤵
        
        PID:15420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52472.exe
        9⤵
        
        PID:3392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11133.exe
        8⤵
        
        PID:8912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40494.exe
        8⤵
        
        PID:1656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57920.exe
        8⤵
        
        PID:16104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52282.exe
        7⤵
        
        PID:4928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22595.exe
        8⤵
        
        PID:5768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44954.exe
        8⤵
        
        PID:10096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41153.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:13372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18406.exe
        8⤵
        
        PID:4680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46846.exe
        7⤵
        
        PID:7840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57175.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57486.exe
        7⤵
        
        PID:13504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5039.exe
        7⤵
        
        PID:3996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63371.exe
        7⤵
        
        PID:5140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33808.exe
        6⤵
        
        PID:3288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23523.exe
        7⤵
        
        PID:1068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23088.exe
        8⤵
        
        PID:6948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44686.exe
        8⤵
        
        PID:10380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40215.exe
        8⤵
        
        PID:14132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59752.exe
        8⤵
        
        PID:4388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15513.exe
        7⤵
        
        PID:7980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4221.exe
        7⤵
        
        PID:9948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25031.exe
        7⤵
        
        PID:13944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41639.exe
        6⤵
        
        PID:4472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58531.exe
        7⤵
        
        PID:5172
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5172 -s 724
        8⤵
        Program crash
        
        PID:5588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62935.exe
        7⤵
        
        PID:8776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27421.exe
        7⤵
        
        PID:13656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37757.exe
        7⤵
        
        PID:1956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18406.exe
        7⤵
        
        PID:7464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11373.exe
        6⤵
        
        PID:7940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47734.exe
        6⤵
        
        PID:6524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63408.exe
        6⤵
        
        PID:14116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47639.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4946.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9186.exe
        7⤵
        
        PID:2168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9314.exe
        8⤵
        
        PID:6188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17824.exe
        9⤵
        
        PID:7712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21734.exe
        9⤵
        
        PID:12252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52910.exe
        9⤵
        
        PID:1532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54702.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:6756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52088.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:15876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47486.exe
        9⤵
        
        PID:8988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32358.exe
        8⤵
        
        PID:8220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58839.exe
        8⤵
        
        PID:12544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25133.exe
        8⤵
        
        PID:16080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51914.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6208.exe
        7⤵
        
        PID:8208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33655.exe
        7⤵
        
        PID:11916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38096.exe
        7⤵
        
        PID:15476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64871.exe
        7⤵
        
        PID:860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57920.exe
        7⤵
        
        PID:220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45841.exe
        7⤵
        
        PID:8280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13833.exe
        6⤵
        
        PID:3912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33523.exe
        7⤵
        
        PID:4880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31856.exe
        8⤵
        
        PID:8472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44407.exe
        8⤵
        
        PID:12028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23117.exe
        8⤵
        
        PID:15260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15862.exe
        8⤵
        
        PID:5300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9998.exe
        8⤵
        
        PID:15764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4761.exe
        7⤵
        
        PID:8412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58718.exe
        7⤵
        
        PID:11800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61079.exe
        7⤵
        
        PID:13396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50062.exe
        7⤵
        
        PID:3600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36016.exe
        7⤵
        
        PID:1400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12032.exe
        6⤵
        
        PID:6432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9183.exe
        7⤵
        
        PID:8396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21734.exe
        7⤵
        
        PID:12036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48686.exe
        7⤵
        
        PID:15032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24535.exe
        7⤵
        
        PID:1660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58917.exe
        7⤵
        
        PID:3464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55166.exe
        7⤵
        
        PID:5648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64446.exe
        6⤵
        
        PID:9688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28454.exe
        6⤵
        
        PID:11760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59888.exe
        6⤵
        
        PID:15472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47057.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57619.exe
        6⤵
        
        PID:4368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41312.exe
        7⤵
        
        PID:6064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36915.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:7764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55066.exe
        8⤵
        
        PID:9220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47326.exe
        8⤵
        
        PID:14364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7648.exe
        8⤵
        
        PID:7388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16175.exe
        8⤵
        
        PID:8724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10246.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3264.exe
        7⤵
        
        PID:11124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44734.exe
        7⤵
        
        PID:13888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13334.exe
        7⤵
        
        PID:1712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47207.exe
        6⤵
        
        PID:5340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15327.exe
        7⤵
        
        PID:8640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18086.exe
        7⤵
        
        PID:12048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10829.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:15656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58871.exe
        7⤵
        
        PID:8584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52046.exe
        6⤵
        
        PID:8344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31719.exe
        6⤵
        
        PID:11836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48849.exe
        6⤵
        
        PID:15068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51864.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15753.exe
        5⤵
        
        PID:2928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56963.exe
        6⤵
        
        PID:5476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22019.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62935.exe
        7⤵
        
        PID:9352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22621.exe
        7⤵
        
        PID:14576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58327.exe
        7⤵
        
        PID:16364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55040.exe
        7⤵
        
        PID:14584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52038.exe
        7⤵
        
        PID:7276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32342.exe
        6⤵
        
        PID:8060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53422.exe
        6⤵
        
        PID:10008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57681.exe
        6⤵
        
        PID:14556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35953.exe
        6⤵
        
        PID:2416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46020.exe
        6⤵
        
        PID:15712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17135.exe
        6⤵
        
        PID:7460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9408.exe
        5⤵
        
        PID:5448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47808.exe
        6⤵
        
        PID:8620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18086.exe
        6⤵
        
        PID:12096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52801.exe
        6⤵
        
        PID:15356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53175.exe
        6⤵
        
        PID:6316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48750.exe
        6⤵
        
        PID:16228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19121.exe
        6⤵
        
        PID:10648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25222.exe
        5⤵
        
        PID:9084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63459.exe
        5⤵
        
        PID:11604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52565.exe
        5⤵
        
        PID:15720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39106.exe
        5⤵
        
        PID:4032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42625.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42625.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61059.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64339.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46195.exe
        7⤵
        
        PID:5312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38752.exe
        8⤵
        
        PID:5240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39110.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:10400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17821.exe
        8⤵
        
        PID:13820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37181.exe
        8⤵
        
        PID:1952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17350.exe
        7⤵
        
        PID:7828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51310.exe
        7⤵
        
        PID:9740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57681.exe
        7⤵
        
        PID:14540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10969.exe
        6⤵
        
        PID:5556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54307.exe
        7⤵
        
        PID:6640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63943.exe
        8⤵
        
        PID:5416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39346.exe
        8⤵
        
        PID:10728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44686.exe
        7⤵
        
        PID:9808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40215.exe
        7⤵
        
        PID:11544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48414.exe
        7⤵
        
        PID:16160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62414.exe
        6⤵
        
        PID:8052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10086.exe
        6⤵
        
        PID:9296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8285.exe
        6⤵
        
        PID:13516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58391.exe
        6⤵
        
        PID:15612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40400.exe
        6⤵
        
        PID:2904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60367.exe
        6⤵
        
        PID:2396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60618.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60995.exe
        6⤵
        
        PID:5228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3199.exe
        7⤵
        
        PID:8164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39110.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:10384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10701.exe
        7⤵
        
        PID:13632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13126.exe
        6⤵
        
        PID:7484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57584.exe
        7⤵
        
        PID:13964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16909.exe
        6⤵
        
        PID:1368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15222.exe
        6⤵
        
        PID:12888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4886.exe
        6⤵
        
        PID:448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59752.exe
        6⤵
        
        PID:5512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10919.exe
        6⤵
        
        PID:7880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63329.exe
        5⤵
        
        PID:5832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47424.exe
        6⤵
        
        PID:8664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18086.exe
        6⤵
        
        PID:12088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56641.exe
        6⤵
        
        PID:4056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37143.exe
        6⤵
        
        PID:7868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63479.exe
        5⤵
        
        PID:7600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-464.exe
        5⤵
        
        PID:6572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33958.exe
        5⤵
        
        PID:15252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32978.exe
        5⤵
        
        PID:13244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52263.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52263.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41776.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27113.exe
        6⤵
        
        PID:5628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59904.exe
        7⤵
        
        PID:7368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55066.exe
        7⤵
        
        PID:11068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47326.exe
        7⤵
        
        PID:14344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42282.exe
        7⤵
        
        PID:15460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14046.exe
        7⤵
        
        PID:7244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8989.exe
        6⤵
        
        PID:7800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45175.exe
        6⤵
        
        PID:11280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16854.exe
        6⤵
        
        PID:14396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41119.exe
        6⤵
        
        PID:5676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35753.exe
        5⤵
        
        PID:6128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37299.exe
        6⤵
        
        PID:6612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56791.exe
        6⤵
        
        PID:10896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17821.exe
        6⤵
        
        PID:13788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40062.exe
        6⤵
        
        PID:4240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51288.exe
        6⤵
        
        PID:7876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23981.exe
        5⤵
        
        PID:8080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9129.exe
        5⤵
        
        PID:5964
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5964 -s 464
        6⤵
        Program crash
        
        PID:12604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28198.exe
        5⤵
        
        PID:13672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28271.exe
        5⤵
        
        PID:9132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16016.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16016.exe
      4⤵
      PID:1212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39283.exe
        5⤵
        
        PID:6100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5106.exe
        6⤵
        
        PID:6308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62935.exe
        6⤵
        
        PID:8780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41153.exe
        6⤵
        
        PID:13364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23533.exe
        6⤵
        
        PID:3428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52088.exe
        6⤵
        
        PID:16088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64207.exe
        6⤵
        
        PID:8592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-246.exe
        5⤵
        
        PID:8004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31568.exe
        6⤵
        
        PID:15464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65368.exe
        6⤵
        
        PID:5776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61244.exe
        6⤵
        
        PID:7320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4221.exe
        5⤵
        
        PID:9052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57681.exe
        5⤵
        
        PID:13940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41119.exe
        5⤵
        
        PID:1568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32511.exe
        5⤵
        
        PID:7592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26121.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26121.exe
      4⤵
      PID:4576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14751.exe
        5⤵
        
        PID:8688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18086.exe
        5⤵
        
        PID:12072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52526.exe
        5⤵
        
        PID:14704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50920.exe
        5⤵
        
        PID:7228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8546.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8546.exe
      4⤵
      PID:9072
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10901.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10901.exe
      4⤵
      PID:11524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19550.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19550.exe
      4⤵
      PID:4492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26598.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26598.exe
      4⤵
      PID:15968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7518.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7518.exe
      4⤵
      PID:6932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17487.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17487.exe
      4⤵
      PID:7492
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45786.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45786.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31443.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31443.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16467.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38771.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1327.exe
        7⤵
        
        PID:3512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30083.exe
        8⤵
        
        PID:6888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23152.exe
        9⤵
        
        PID:12256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26678.exe
        9⤵
        
        PID:13340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52942.exe
        9⤵
        
        PID:15992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3581.exe
        9⤵
        
        PID:5320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11975.exe
        9⤵
        
        PID:2856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60631.exe
        8⤵
        
        PID:9896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43374.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:13000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9718.exe
        8⤵
        
        PID:5944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63480.exe
        8⤵
        
        PID:10600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45578.exe
        7⤵
        
        PID:7144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47904.exe
        8⤵
        
        PID:15752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16880.exe
        8⤵
        
        PID:13984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9422.exe
        8⤵
        
        PID:7752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57646.exe
        7⤵
        
        PID:9976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58449.exe
        7⤵
        
        PID:13912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13334.exe
        7⤵
        
        PID:12180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64343.exe
        7⤵
        
        PID:7876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38079.exe
        7⤵
        
        PID:16256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24496.exe
        6⤵
        
        PID:5596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38560.exe
        7⤵
        
        PID:5204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56030.exe
        7⤵
        
        PID:9584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44734.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:13708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9301.exe
        7⤵
        
        PID:7108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61656.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10246.exe
        6⤵
        
        PID:7016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-464.exe
        6⤵
        
        PID:11020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40678.exe
        6⤵
        
        PID:13492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56303.exe
        6⤵
        
        PID:6244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51386.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-258.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58515.exe
        7⤵
        
        PID:6224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52224.exe
        8⤵
        
        PID:8316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21734.exe
        8⤵
        
        PID:12268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48686.exe
        8⤵
        
        PID:15188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24535.exe
        8⤵
        
        PID:4760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8903.exe
        8⤵
        
        PID:10552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4694.exe
        7⤵
        
        PID:8636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25485.exe
        7⤵
        
        PID:11336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54551.exe
        7⤵
        
        PID:15080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55079.exe
        7⤵
        
        PID:5168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64343.exe
        7⤵
        
        PID:7564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35577.exe
        6⤵
        
        PID:6584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58192.exe
        7⤵
        
        PID:8380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14822.exe
        7⤵
        
        PID:11672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9293.exe
        7⤵
        
        PID:15172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24554.exe
        7⤵
        
        PID:5756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56286.exe
        6⤵
        
        PID:9092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26157.exe
        6⤵
        
        PID:13272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18101.exe
        6⤵
        
        PID:16128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5367.exe
        6⤵
        
        PID:5244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15706.exe
        6⤵
        
        PID:7312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63422.exe
        5⤵
        
        PID:4884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28355.exe
        6⤵
        
        PID:6704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53392.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:9328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58071.exe
        7⤵
        
        PID:12576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27933.exe
        7⤵
        
        PID:16100
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 16100 -s 80
        8⤵
        Program crash
        
        PID:4972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57921.exe
        6⤵
        
        PID:10140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47018.exe
        6⤵
        
        PID:12484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25725.exe
        6⤵
        
        PID:16024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23334.exe
        6⤵
        
        PID:15484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49040.exe
        6⤵
        
        PID:16020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41354.exe
        5⤵
        
        PID:6848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8333.exe
        5⤵
        
        PID:8652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55559.exe
        5⤵
        
        PID:13444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39312.exe
        5⤵
        
        PID:7312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60752.exe
        5⤵
        
        PID:1020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48106.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48106.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60883.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-642.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28355.exe
        7⤵
        
        PID:6692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20320.exe
        8⤵
        
        PID:9168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5097.exe
        8⤵
        
        PID:11896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48686.exe
        8⤵
        
        PID:4292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54702.exe
        8⤵
        
        PID:5560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50920.exe
        8⤵
        
        PID:5892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65351.exe
        7⤵
        
        PID:10204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14253.exe
        7⤵
        
        PID:13880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58391.exe
        7⤵
        
        PID:2448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14463.exe
        7⤵
        
        PID:15628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48488.exe
        7⤵
        
        PID:7564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3497.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11133.exe
        6⤵
        
        PID:9228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31751.exe
        6⤵
        
        PID:12952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42473.exe
        5⤵
        
        PID:5372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56803.exe
        6⤵
        
        PID:5200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54256.exe
        7⤵
        
        PID:3916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64207.exe
        7⤵
        
        PID:1956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62935.exe
        6⤵
        
        PID:9844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27421.exe
        6⤵
        
        PID:13664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40062.exe
        6⤵
        
        PID:15608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53683.exe
        6⤵
        
        PID:6832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32045.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9129.exe
        5⤵
        
        PID:6548
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6548 -s 436
        6⤵
        Program crash
        
        PID:11844
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6548 -s 420
        6⤵
        Program crash
        
        PID:14376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44526.exe
        5⤵
        
        PID:14604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37750.exe
        5⤵
        
        PID:2604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48239.exe
        5⤵
        
        PID:2876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43716.exe
        5⤵
        
        PID:8408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5744.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5744.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61379.exe
        5⤵
        
        PID:5516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31427.exe
        6⤵
        
        PID:6860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20336.exe
        7⤵
        
        PID:9308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58071.exe
        7⤵
        
        PID:12556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3149.exe
        7⤵
        
        PID:3452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57848.exe
        7⤵
        
        PID:2372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52359.exe
        6⤵
        
        PID:9744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53457.exe
        6⤵
        
        PID:13212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60992.exe
        6⤵
        
        PID:11468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43823.exe
        6⤵
        
        PID:5688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51947.exe
        6⤵
        
        PID:10592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6185.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59344.exe
        6⤵
        
        PID:8884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27318.exe
        6⤵
        
        PID:11512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9293.exe
        6⤵
        
        PID:15408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32845.exe
        5⤵
        
        PID:9444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53655.exe
        5⤵
        
        PID:3384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62282.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62282.exe
      4⤵
      PID:5912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48384.exe
        5⤵
        
        PID:8516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18086.exe
        5⤵
        
        PID:12080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38878.exe
        5⤵
        
        PID:4348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8182.exe
        5⤵
        
        PID:4988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53247.exe
        5⤵
        
        PID:5236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1835.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:15776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49246.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49246.exe
      4⤵
      PID:8364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6518.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6518.exe
      4⤵
      PID:11808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7023.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7023.exe
      4⤵
      PID:15384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28366.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28366.exe
      4⤵
      PID:5524
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25312.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25312.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33763.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33763.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44931.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26211.exe
        6⤵
        
        PID:5152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23088.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45271.exe
        8⤵
        
        PID:15380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62935.exe
        7⤵
        
        PID:9208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35127.exe
        7⤵
        
        PID:13720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44094.exe
        7⤵
        
        PID:14584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19702.exe
        7⤵
        
        PID:4140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31408.exe
        7⤵
        
        PID:7056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45841.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45991.exe
        6⤵
        
        PID:7508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19222.exe
        6⤵
        
        PID:10768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16749.exe
        6⤵
        
        PID:14300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52247.exe
        6⤵
        
        PID:15600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3343.exe
        6⤵
        
        PID:4436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21743.exe
        6⤵
        
        PID:13976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49594.exe
        5⤵
        
        PID:5808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36915.exe
        6⤵
        
        PID:7996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55066.exe
        6⤵
        
        PID:11156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47326.exe
        6⤵
        
        PID:14648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42282.exe
        6⤵
        
        PID:1516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57614.exe
        5⤵
        
        PID:7612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9129.exe
        5⤵
        
        PID:10120
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10120 -s 464
        6⤵
        Program crash
        
        PID:1660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28198.exe
        5⤵
        
        PID:13756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39461.exe
        5⤵
        
        PID:3968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42014.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:11408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40633.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40633.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62531.exe
        5⤵
        
        PID:5432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38560.exe
        6⤵
        
        PID:6700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56791.exe
        6⤵
        
        PID:10772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17821.exe
        6⤵
        
        PID:13812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40062.exe
        6⤵
        
        PID:228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60728.exe
        6⤵
        
        PID:15512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50407.exe
        5⤵
        
        PID:6504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54766.exe
        5⤵
        
        PID:10812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31545.exe
        5⤵
        
        PID:15632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32210.exe
        5⤵
        
        PID:7404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23936.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23936.exe
      4⤵
      PID:5652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38176.exe
        5⤵
        
        PID:6408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39110.exe
        5⤵
        
        PID:10408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17821.exe
        5⤵
        
        PID:13772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14854.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14854.exe
      4⤵
      PID:7792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36509.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36509.exe
      4⤵
      PID:11048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27990.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27990.exe
      4⤵
      PID:452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54816.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54816.exe
      4⤵
      PID:3192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55551.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55551.exe
      4⤵
      PID:15236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14914.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14914.exe
      4⤵
      PID:2060
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32922.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32922.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44931.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44931.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59075.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12786.exe
        6⤵
        
        PID:6816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58784.exe
        7⤵
        
        PID:10492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53287.exe
        7⤵
        
        PID:12524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19392.exe
        7⤵
        
        PID:3068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3581.exe
        7⤵
        
        PID:16376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53590.exe
        7⤵
        
        PID:3068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14471.exe
        7⤵
        
        PID:11312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18534.exe
        6⤵
        
        PID:9592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12534.exe
        6⤵
        
        PID:12364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29309.exe
        6⤵
        
        PID:4032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55551.exe
        6⤵
        
        PID:6916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56227.exe
        6⤵
        
        PID:14720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54618.exe
        5⤵
        
        PID:6896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45824.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33590.exe
        6⤵
        
        PID:14616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37294.exe
        6⤵
        
        PID:15580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27159.exe
        6⤵
        
        PID:10596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11133.exe
        5⤵
        
        PID:8428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59326.exe
        5⤵
        
        PID:13560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48117.exe
        5⤵
        
        PID:15692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49040.exe
        5⤵
        
        PID:6428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42089.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42089.exe
      4⤵
      PID:5504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38560.exe
        5⤵
        
        PID:6868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5862.exe
        5⤵
        
        PID:10476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33975.exe
        5⤵
        
        PID:14112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1629.exe
        5⤵
        
        PID:1424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9671.exe
        5⤵
        
        PID:376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64142.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64142.exe
      4⤵
      PID:7292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60631.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60631.exe
      4⤵
      PID:10820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15021.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15021.exe
      4⤵
      PID:13764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41286.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41286.exe
      4⤵
      PID:16156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30800.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30800.exe
      4⤵
      PID:5424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39461.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39461.exe
      4⤵
      PID:1604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64307.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64307.exe
      4⤵
      PID:8292
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51953.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51953.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59075.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59075.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31427.exe
        5⤵
        
        PID:6852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4191.exe
        6⤵
        
        PID:9324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58071.exe
        6⤵
        
        PID:12584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27933.exe
        6⤵
        
        PID:16092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62750.exe
        6⤵
        
        PID:16164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50411.exe
        6⤵
        
        PID:6124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52359.exe
        5⤵
        
        PID:9764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27037.exe
        5⤵
        
        PID:13268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16637.exe
        5⤵
        
        PID:5268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30591.exe
        5⤵
        
        PID:3156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6685.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6685.exe
      4⤵
      PID:7308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9129.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9129.exe
      4⤵
      PID:10512
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10512 -s 444
        5⤵
        Program crash
        
        PID:4524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28198.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28198.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50960.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50960.exe
      4⤵
      PID:7732
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43993.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43993.exe
    3⤵
    PID:5820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5106.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5106.exe
      4⤵
      PID:6396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26688.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6774.exe
        5⤵
        
        PID:13332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52942.exe
        5⤵
        
        PID:14268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14238.exe
        5⤵
        
        PID:10540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62935.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62935.exe
      4⤵
      PID:9812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17821.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17821.exe
      4⤵
      PID:13828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61406.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61406.exe
      4⤵
      PID:15588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35175.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35175.exe
      4⤵
      PID:16040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48254.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48254.exe
      4⤵
      PID:15640
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11711.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11711.exe
    3⤵
    PID:8016
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29237.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29237.exe
    3⤵
    PID:10312
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54222.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54222.exe
    3⤵
    PID:13740
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35686.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35686.exe
    3⤵
    PID:15588
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29599.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29599.exe
    3⤵
    PID:15616
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23154.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23154.exe
    3⤵
    PID:15020
- C:\Users\Admin\AppData\Local\Temp\Unicorn-42985.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-42985.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2676
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26339.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26339.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45091.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45091.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16275.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52528.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5922.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60746.exe
        8⤵
        
        PID:4288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42048.exe
        9⤵
        
        PID:8568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11750.exe
        9⤵
        
        PID:11496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52910.exe
        9⤵
        
        PID:13920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54702.exe
        9⤵
        
        PID:6108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13786.exe
        9⤵
        
        PID:10636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3037.exe
        8⤵
        
        PID:8384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31719.exe
        8⤵
        
        PID:11816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50110.exe
        8⤵
        
        PID:14596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4111.exe
        8⤵
        
        PID:1264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43047.exe
        8⤵
        
        PID:6844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37201.exe
        7⤵
        
        PID:6292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18099.exe
        8⤵
        
        PID:8260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21734.exe
        8⤵
        
        PID:12024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48686.exe
        8⤵
        
        PID:2820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41063.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25175.exe
        8⤵
        
        PID:16376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24295.exe
        7⤵
        
        PID:8672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22685.exe
        7⤵
        
        PID:11044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63943.exe
        7⤵
        
        PID:13984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4607.exe
        7⤵
        
        PID:2604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32703.exe
        7⤵
        
        PID:16360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50826.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23715.exe
        7⤵
        
        PID:6040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37792.exe
        8⤵
        
        PID:6152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56791.exe
        8⤵
        
        PID:10780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11085.exe
        8⤵
        
        PID:13552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1142.exe
        8⤵
        
        PID:15736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30269.exe
        8⤵
        
        PID:6244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55551.exe
        8⤵
        
        PID:9200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10246.exe
        7⤵
        
        PID:7928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4786.exe
        8⤵
        
        PID:11436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37446.exe
        8⤵
        
        PID:15208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18669.exe
        8⤵
        
        PID:1156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6542.exe
        8⤵
        
        PID:7372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3264.exe
        7⤵
        
        PID:10200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53191.exe
        7⤵
        
        PID:14796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10278.exe
        7⤵
        
        PID:12348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60942.exe
        6⤵
        
        PID:5592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56803.exe
        7⤵
        
        PID:6592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44686.exe
        7⤵
        
        PID:9540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40215.exe
        7⤵
        
        PID:14136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17149.exe
        6⤵
        
        PID:8328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6518.exe
        6⤵
        
        PID:11828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51024.exe
        6⤵
        
        PID:15284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13815.exe
        6⤵
        
        PID:3464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16583.exe
        6⤵
        
        PID:4764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63690.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8034.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30435.exe
        7⤵
        
        PID:5660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32195.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10662.exe
        8⤵
        
        PID:10024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25885.exe
        8⤵
        
        PID:12396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23533.exe
        8⤵
        
        PID:4968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39433.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57011.exe
        8⤵
        
        PID:14584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6349.exe
        8⤵
        
        PID:3208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35192.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:2252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-765.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:9568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26077.exe
        7⤵
        
        PID:13612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62151.exe
        7⤵
        
        PID:4948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33201.exe
        7⤵
        
        PID:1260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2697.exe
        6⤵
        
        PID:5128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14258.exe
        7⤵
        
        PID:8612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18086.exe
        7⤵
        
        PID:12056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10829.exe
        7⤵
        
        PID:15664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5584.exe
        7⤵
        
        PID:5688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10759.exe
        7⤵
        
        PID:6884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14678.exe
        6⤵
        
        PID:8700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27408.exe
        7⤵
        
        PID:12592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8877.exe
        7⤵
        
        PID:11864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59208.exe
        7⤵
        
        PID:16356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11358.exe
        7⤵
        
        PID:3616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8578.exe
        7⤵
        
        PID:9696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45550.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:12112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1094.exe
        6⤵
        
        PID:15276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61568.exe
        6⤵
        
        PID:3616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43716.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20152.exe
        6⤵
        
        PID:1124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3833.exe
        5⤵
        
        PID:3524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28355.exe
        6⤵
        
        PID:6684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42048.exe
        7⤵
        
        PID:8440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21734.exe
        7⤵
        
        PID:11980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48686.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:15000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40506.exe
        7⤵
        
        PID:4916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57921.exe
        6⤵
        
        PID:9640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50775.exe
        6⤵
        
        PID:13324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4310.exe
        6⤵
        
        PID:4256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48348.exe
        6⤵
        
        PID:11380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1936.exe
        5⤵
        
        PID:7004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64624.exe
        6⤵
        
        PID:4108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24150.exe
        6⤵
        
        PID:6016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1835.exe
        6⤵
        
        PID:5748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57335.exe
        5⤵
        
        PID:9240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38883.exe
        5⤵
        
        PID:9000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60986.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60986.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18019.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40515.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61955.exe
        7⤵
        
        PID:5484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36915.exe
        8⤵
        
        PID:7932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55066.exe
        8⤵
        
        PID:11140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47326.exe
        8⤵
        
        PID:14348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47809.exe
        8⤵
        
        PID:3456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63072.exe
        8⤵
        
        PID:5336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50407.exe
        7⤵
        
        PID:704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54766.exe
        7⤵
        
        PID:10880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23687.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:13724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26537.exe
        6⤵
        
        PID:4464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38560.exe
        7⤵
        
        PID:3132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39110.exe
        7⤵
        
        PID:10392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45502.exe
        7⤵
        
        PID:13980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47366.exe
        7⤵
        
        PID:5752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14485.exe
        7⤵
        
        PID:15568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8989.exe
        6⤵
        
        PID:7808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45175.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28198.exe
        6⤵
        
        PID:14148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60944.exe
        6⤵
        
        PID:7448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3545.exe
        5⤵
        
        PID:3856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25075.exe
        6⤵
        
        PID:6204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17824.exe
        7⤵
        
        PID:8036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21734.exe
        7⤵
        
        PID:12104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48686.exe
        7⤵
        
        PID:15092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9287.exe
        7⤵
        
        PID:5608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32358.exe
        6⤵
        
        PID:8216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35470.exe
        6⤵
        
        PID:2504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15158.exe
        6⤵
        
        PID:15392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47809.exe
        6⤵
        
        PID:4068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44706.exe
        6⤵
        
        PID:5640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15872.exe
        5⤵
        
        PID:6616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2354.exe
        6⤵
        
        PID:9268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25398.exe
        6⤵
        
        PID:12596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27933.exe
        6⤵
        
        PID:16108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27415.exe
        6⤵
        
        PID:15704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12073.exe
        5⤵
        
        PID:9124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43424.exe
        6⤵
        
        PID:14376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-407.exe
        6⤵
        
        PID:7100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24989.exe
        5⤵
        
        PID:12144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21561.exe
        5⤵
        
        PID:15556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31.exe
        5⤵
        
        PID:8832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11312.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11312.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40323.exe
        5⤵
        Executes dropped EXE
        
        PID:3864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61763.exe
        6⤵
        
        PID:5536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49299.exe
        7⤵
        
        PID:5668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10662.exe
        7⤵
        
        PID:10016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9357.exe
        7⤵
        
        PID:13452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26246.exe
        7⤵
        
        PID:5408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6953.exe
        6⤵
        
        PID:7064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21872.exe
        7⤵
        
        PID:9628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8678.exe
        7⤵
        
        PID:12612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3341.exe
        7⤵
        
        PID:16120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16971.exe
        7⤵
        
        PID:15812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34013.exe
        6⤵
        
        PID:9512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15030.exe
        6⤵
        
        PID:4504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50062.exe
        6⤵
        
        PID:5880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29505.exe
        6⤵
        
        PID:7396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37201.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45504.exe
        6⤵
        
        PID:8968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15398.exe
        6⤵
        
        PID:12304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40897.exe
        6⤵
        
        PID:15572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27799.exe
        6⤵
        
        PID:5328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40506.exe
        6⤵
        
        PID:8604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8150.exe
        5⤵
        
        PID:8868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2502.exe
        5⤵
        
        PID:12636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25664.exe
        5⤵
        
        PID:16032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43047.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43047.exe
      4⤵
      PID:2024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53891.exe
        5⤵
        
        PID:6032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38560.exe
        6⤵
        
        PID:7420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4247.exe
        7⤵
        
        PID:16248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56047.exe
        7⤵
        
        PID:7124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62471.exe
        6⤵
        
        PID:9372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32704.exe
        6⤵
        
        PID:13840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10246.exe
        5⤵
        
        PID:7992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53534.exe
        5⤵
        
        PID:6520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48081.exe
        5⤵
        
        PID:11732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64871.exe
        5⤵
        
        PID:5160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55551.exe
        5⤵
        
        PID:5900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14255.exe
        5⤵
        
        PID:6788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58142.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58142.exe
      4⤵
      PID:5480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64336.exe
        5⤵
        
        PID:8596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18086.exe
        5⤵
        
        PID:12040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39454.exe
        5⤵
        
        PID:15324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40062.exe
        5⤵
        
        PID:3456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44886.exe
        5⤵
        
        PID:1956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6010.exe
        5⤵
        
        PID:10624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49430.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49430.exe
      4⤵
      PID:8400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44624.exe
        5⤵
        
        PID:12900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16630.exe
        5⤵
        
        PID:15596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16827.exe
        5⤵
        
        PID:7244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17310.exe
        5⤵
        
        PID:8744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40112.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40112.exe
      4⤵
      PID:11868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30261.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30261.exe
      4⤵
      PID:14864
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25417.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25417.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49274.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49274.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23257.exe
        5⤵
        
        PID:4932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62947.exe
        6⤵
        
        PID:7020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43911.exe
        6⤵
        
        PID:9992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59134.exe
        6⤵
        
        PID:12676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16096.exe
        6⤵
        
        PID:5404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31826.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37409.exe
        5⤵
        
        PID:5252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57011.exe
        6⤵
        
        PID:15296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1835.exe
        6⤵
        
        PID:16008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7014.exe
        5⤵
        
        PID:9356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40190.exe
        5⤵
        
        PID:11548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5039.exe
        5⤵
        
        PID:4584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14170.exe
        5⤵
        
        PID:2416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36305.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36305.exe
      4⤵
      PID:4964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46595.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56227.exe
        6⤵
        
        PID:6568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58784.exe
        7⤵
        
        PID:10420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54254.exe
        7⤵
        
        PID:14980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27955.exe
        7⤵
        
        PID:5424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62935.exe
        6⤵
        
        PID:8908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41153.exe
        6⤵
        
        PID:13380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47054.exe
        5⤵
        
        PID:7336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10665.exe
        5⤵
        
        PID:11588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52798.exe
        5⤵
        
        PID:15316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37712.exe
        5⤵
        
        PID:15020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35953.exe
        5⤵
        
        PID:16240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44224.exe
        5⤵
        
        PID:7540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43450.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43450.exe
      4⤵
      PID:6252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50688.exe
        5⤵
        
        PID:9100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51994.exe
        5⤵
        
        PID:11724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48686.exe
        5⤵
        
        PID:3932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9946.exe
        5⤵
        
        PID:1152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15629.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15629.exe
      4⤵
      PID:8660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6150.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6150.exe
      4⤵
      PID:4000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7023.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7023.exe
      4⤵
      PID:15272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48488.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48488.exe
      4⤵
      PID:5012
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62910.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62910.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1340
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28787.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28787.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3138.exe
        5⤵
        
        PID:1496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29315.exe
        6⤵
        
        PID:6808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18342.exe
        6⤵
        
        PID:9544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12534.exe
        6⤵
        
        PID:11676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29869.exe
        6⤵
        
        PID:1156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4111.exe
        6⤵
        
        PID:15748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35720.exe
        6⤵
        
        PID:2876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3497.exe
        5⤵
        
        PID:6512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11133.exe
        5⤵
        
        PID:9236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16854.exe
        5⤵
        
        PID:13360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19061.exe
        5⤵
        
        PID:5244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23936.exe
        5⤵
        
        PID:5168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43672.exe
        5⤵
        
        PID:9056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42089.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42089.exe
      4⤵
      PID:5496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48915.exe
        5⤵
        
        PID:5800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2354.exe
        6⤵
        
        PID:8924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21750.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:12400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27357.exe
        6⤵
        
        PID:15696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40506.exe
        6⤵
        
        PID:9224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43142.exe
        5⤵
        
        PID:10052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48081.exe
        5⤵
        
        PID:15452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29248.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29248.exe
      4⤵
      PID:8084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42759.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42759.exe
      4⤵
      PID:10344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15021.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15021.exe
      4⤵
      PID:13748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37712.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37712.exe
      4⤵
      PID:11612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32016.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32016.exe
      4⤵
      PID:8136
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44666.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44666.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52339.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52339.exe
      4⤵
      PID:780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5858.exe
        5⤵
        
        PID:6632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3506.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58071.exe
        6⤵
        
        PID:12568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35536.exe
        7⤵
        
        PID:3364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19670.exe
        7⤵
        
        PID:6336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27933.exe
        6⤵
        
        PID:15996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44135.exe
        6⤵
        
        PID:3156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40506.exe
        6⤵
        
        PID:8680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26214.exe
        5⤵
        
        PID:8296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27789.exe
        5⤵
        
        PID:11892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46762.exe
        5⤵
        
        PID:15536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63072.exe
        5⤵
        
        PID:4256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4073.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4073.exe
      4⤵
      PID:6412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11133.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11133.exe
      4⤵
      PID:8360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40494.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40494.exe
      4⤵
      PID:13644
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60529.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60529.exe
    3⤵
    PID:5792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54691.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54691.exe
      4⤵
      PID:6264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62935.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62935.exe
      4⤵
      PID:9860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17821.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17821.exe
      4⤵
      PID:13796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42774.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42774.exe
      4⤵
      PID:1952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55551.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55551.exe
      4⤵
      PID:5692
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60183.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60183.exe
    3⤵
    PID:8028
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1951.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1951.exe
    3⤵
    PID:9560
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59557.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59557.exe
    3⤵
    PID:13732
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62623.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62623.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:9040
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39270.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39270.exe
    3⤵
    PID:5296
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56443.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56443.exe
    3⤵
    PID:9096
- C:\Users\Admin\AppData\Local\Temp\Unicorn-20208.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-20208.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1936
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64115.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64115.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1090.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1090.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52227.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25715.exe
        6⤵
        
        PID:4548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53891.exe
        7⤵
        
        PID:6052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36915.exe
        8⤵
        
        PID:7976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55066.exe
        8⤵
        
        PID:9488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47326.exe
        8⤵
        
        PID:2848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48727.exe
        8⤵
        
        PID:2800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7270.exe
        8⤵
        
        PID:10956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10246.exe
        7⤵
        
        PID:7956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3264.exe
        7⤵
        
        PID:5960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48081.exe
        7⤵
        
        PID:15444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50904.exe
        7⤵
        
        PID:8128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62474.exe
        6⤵
        
        PID:4876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48384.exe
        7⤵
        
        PID:8528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18086.exe
        7⤵
        
        PID:12064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4093.exe
        7⤵
        
        PID:15340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21078.exe
        7⤵
        
        PID:4256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3229.exe
        6⤵
        
        PID:8432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48247.exe
        6⤵
        
        PID:11856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48849.exe
        6⤵
        
        PID:1712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40016.exe
        6⤵
        
        PID:5264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57872.exe
        6⤵
        
        PID:7908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56778.exe
        5⤵
        
        PID:4320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44883.exe
        6⤵
        
        PID:6712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2655.exe
        7⤵
        
        PID:8984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4646.exe
        7⤵
        
        PID:12416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61566.exe
        7⤵
        
        PID:15868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47258.exe
        6⤵
        
        PID:8864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50753.exe
        6⤵
        
        PID:12376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33223.exe
        6⤵
        
        PID:15684
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 15684 -s 472
        7⤵
        Program crash
        
        PID:16012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15142.exe
        6⤵
        
        PID:7556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24720.exe
        5⤵
        
        PID:6980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21248.exe
        6⤵
        
        PID:12132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45847.exe
        6⤵
        
        PID:15564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63511.exe
        5⤵
        
        PID:9964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23085.exe
        5⤵
        
        PID:12628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3623.exe
        5⤵
        
        PID:13500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42963.exe
        5⤵
        
        PID:7524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17753.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17753.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23257.exe
        5⤵
        
        PID:812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61795.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41280.exe
        7⤵
        
        PID:6240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11750.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:11344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19853.exe
        7⤵
        
        PID:13904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62750.exe
        7⤵
        
        PID:1020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16971.exe
        7⤵
        
        PID:5752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57921.exe
        6⤵
        
        PID:10152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26077.exe
        6⤵
        
        PID:13992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13334.exe
        6⤵
        
        PID:14720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37203.exe
        6⤵
        
        PID:10652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27019.exe
        5⤵
        
        PID:6732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50439.exe
        5⤵
        
        PID:10212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26454.exe
        5⤵
        
        PID:13544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30400.exe
        5⤵
        
        PID:15968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44785.exe
        5⤵
        
        PID:4564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26640.exe
        5⤵
        
        PID:11404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52603.exe
        5⤵
        
        PID:10576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53601.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53601.exe
      4⤵
      PID:2428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30067.exe
        5⤵
        
        PID:5672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21827.exe
        6⤵
        
        PID:6200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62935.exe
        6⤵
        
        PID:9864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17821.exe
        6⤵
        
        PID:13696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16390.exe
        5⤵
        
        PID:7964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4221.exe
        5⤵
        
        PID:9972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16950.exe
        5⤵
        
        PID:13564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56906.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56906.exe
      4⤵
      PID:5196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16947.exe
        5⤵
        
        PID:9116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51994.exe
        5⤵
        
        PID:11716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48686.exe
        5⤵
        
        PID:628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17990.exe
        5⤵
        
        PID:5524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11888.exe
        5⤵
        
        PID:8756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4113.exe
        5⤵
        
        PID:2796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43294.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43294.exe
      4⤵
      PID:8236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16134.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16134.exe
      4⤵
      PID:12020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46416.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46416.exe
      4⤵
      PID:12608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3400.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3400.exe
      4⤵
      PID:760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20288.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20288.exe
      4⤵
      PID:4552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64139.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64139.exe
      4⤵
      PID:15380
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47639.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47639.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44355.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44355.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44659.exe
        5⤵
        
        PID:5212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32963.exe
        6⤵
        
        PID:7084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51856.exe
        7⤵
        
        PID:8928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50862.exe
        7⤵
        
        PID:12296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36887.exe
        7⤵
        
        PID:15492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60462.exe
        7⤵
        
        PID:16020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26391.exe
        7⤵
        
        PID:5356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54766.exe
        6⤵
        
        PID:10760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27705.exe
        6⤵
        
        PID:14588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19042.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14485.exe
        6⤵
        
        PID:6300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28055.exe
        6⤵
        
        PID:7664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23673.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1149.exe
        5⤵
        
        PID:9320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40494.exe
        5⤵
        
        PID:13608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36311.exe
        5⤵
        
        PID:7052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40328.exe
        5⤵
        
        PID:10556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11056.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11056.exe
      4⤵
      PID:4632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47232.exe
        5⤵
        
        PID:8792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3286.exe
        5⤵
        
        PID:12236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10829.exe
        5⤵
        
        PID:15672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54702.exe
        5⤵
        
        PID:1600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30607.exe
        5⤵
        
        PID:16148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24855.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24855.exe
      4⤵
      PID:8448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39582.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39582.exe
      4⤵
      PID:11876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50295.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50295.exe
      4⤵
      PID:15180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7231.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7231.exe
      4⤵
      PID:2320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51733.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51733.exe
      4⤵
      PID:3588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10959.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10959.exe
      4⤵
      PID:10672
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54369.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54369.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9298.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9298.exe
      4⤵
      PID:5188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21443.exe
        5⤵
        
        PID:4224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30838.exe
        5⤵
        
        PID:10224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33866.exe
        5⤵
        
        PID:13688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40913.exe
        5⤵
        
        PID:16264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11975.exe
        5⤵
        
        PID:9924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45991.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45991.exe
      4⤵
      PID:7348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19222.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19222.exe
      4⤵
      PID:4044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33661.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33661.exe
      4⤵
      PID:2192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4111.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4111.exe
      4⤵
      PID:4524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39790.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39790.exe
      4⤵
      PID:16064
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22298.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22298.exe
    3⤵
    PID:5220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38560.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38560.exe
      4⤵
      PID:6748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56791.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56791.exe
      4⤵
      PID:10788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-809.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-809.exe
      4⤵
      PID:13924
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21181.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21181.exe
    3⤵
    PID:8040
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49465.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49465.exe
    3⤵
    PID:11088
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45056.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45056.exe
    3⤵
    PID:14600
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7010.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7010.exe
    3⤵
    PID:7604
- C:\Users\Admin\AppData\Local\Temp\Unicorn-15910.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-15910.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:464
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2434.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2434.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44547.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44547.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60995.exe
        5⤵
        
        PID:5256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37299.exe
        6⤵
        
        PID:2940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56791.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17821.exe
        6⤵
        
        PID:13780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34391.exe
        6⤵
        
        PID:16020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7197.exe
        6⤵
        
        PID:15528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16971.exe
        6⤵
        
        PID:8836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65015.exe
        5⤵
        
        PID:7548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19222.exe
        5⤵
        
        PID:10828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16749.exe
        5⤵
        
        PID:14284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47366.exe
        5⤵
        
        PID:5740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46384.exe
        5⤵
        
        PID:5604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4113.exe
        5⤵
        
        PID:5208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35561.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35561.exe
      4⤵
      PID:5304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37792.exe
        5⤵
        
        PID:6140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63514.exe
        5⤵
        
        PID:7048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35694.exe
        5⤵
        
        PID:13928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32938.exe
        5⤵
        
        PID:1604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65054.exe
        5⤵
        
        PID:5548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53647.exe
        5⤵
        
        PID:7060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14678.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14678.exe
      4⤵
      PID:8708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45550.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45550.exe
      4⤵
      PID:12120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20118.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20118.exe
      4⤵
      PID:15332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18111.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18111.exe
      4⤵
      PID:6088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32933.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32933.exe
      4⤵
      PID:5620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19546.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19546.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6492
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7769.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7769.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58691.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58691.exe
      4⤵
      PID:3488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56803.exe
        5⤵
        
        PID:6608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44686.exe
        5⤵
        
        PID:10004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40407.exe
        5⤵
        
        PID:14152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9389.exe
        5⤵
        
        PID:15628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55623.exe
        5⤵
        
        PID:3496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33793.exe
        5⤵
        
        PID:6080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29654.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29654.exe
      4⤵
      PID:7328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19222.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19222.exe
      4⤵
      PID:9404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33661.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33661.exe
      4⤵
      PID:13336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2855.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2855.exe
      4⤵
      PID:4584
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49489.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49489.exe
    3⤵
    PID:6112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16627.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16627.exe
      4⤵
      PID:7072
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54766.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54766.exe
      4⤵
      PID:10888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27613.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27613.exe
      4⤵
      PID:14620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5462.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5462.exe
      4⤵
      PID:11428
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26746.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26746.exe
    3⤵
    PID:5708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9583.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9583.exe
      4⤵
      PID:10432
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62503.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62503.exe
      4⤵
      PID:13624
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63886.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63886.exe
    3⤵
    PID:9304
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21817.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21817.exe
    3⤵
    PID:5080
- C:\Users\Admin\AppData\Local\Temp\Unicorn-60110.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-60110.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:208
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44931.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44931.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60995.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60995.exe
      4⤵
      PID:5272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38560.exe
        5⤵
        
        PID:6720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56791.exe
        5⤵
        
        PID:10796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17821.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:13804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31574.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31574.exe
      4⤵
      PID:7568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19222.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19222.exe
      4⤵
      PID:10944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16749.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16749.exe
      4⤵
      PID:14292
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52090.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52090.exe
    3⤵
    PID:5544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47955.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47955.exe
      4⤵
      PID:6872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26496.exe
        5⤵
        
        PID:10324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39750.exe
        5⤵
        
        PID:15212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48254.exe
        5⤵
        
        PID:2252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52359.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52359.exe
      4⤵
      PID:9756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1110.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1110.exe
      4⤵
      PID:12540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57182.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57182.exe
      4⤵
      PID:5456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12203.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12203.exe
      4⤵
      PID:7536
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20880.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20880.exe
    3⤵
    PID:7164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40448.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40448.exe
      4⤵
      PID:11752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34950.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34950.exe
      4⤵
      PID:15220
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39879.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39879.exe
    3⤵
    PID:9456
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6365.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6365.exe
    3⤵
    PID:11656
- C:\Users\Admin\AppData\Local\Temp\Unicorn-18889.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-18889.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:556
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10258.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10258.exe
    3⤵
    PID:3188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36915.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36915.exe
      4⤵
      PID:8176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55066.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55066.exe
      4⤵
      PID:11080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47326.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47326.exe
      4⤵
      PID:14640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62951.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62951.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1628
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45991.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45991.exe
    3⤵
    PID:7356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18800.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18800.exe
      4⤵
      PID:8892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22518.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22518.exe
      4⤵
      PID:12328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25053.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25053.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:15500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28759.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28759.exe
      4⤵
      PID:5772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8189.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8189.exe
      4⤵
      PID:5724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35890.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35890.exe
      4⤵
      PID:10688
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11133.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11133.exe
    3⤵
    PID:7708
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22998.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22998.exe
    3⤵
    PID:12536
- C:\Users\Admin\AppData\Local\Temp\Unicorn-53555.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-53555.exe
  2⤵
  PID:5468
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22595.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22595.exe
    3⤵
    PID:6248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57011.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57011.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:15644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7319.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7319.exe
      4⤵
      PID:4916
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44954.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44954.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:10088
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35127.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35127.exe
    3⤵
    PID:13684
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4317.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4317.exe
    3⤵
    PID:756
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33839.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33839.exe
    3⤵
    PID:7384
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2978.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2978.exe
    3⤵
    PID:9140
- C:\Users\Admin\AppData\Local\Temp\Unicorn-55909.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-55909.exe
  2⤵
  PID:7888
- C:\Users\Admin\AppData\Local\Temp\Unicorn-37934.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-37934.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:9728
- C:\Users\Admin\AppData\Local\Temp\Unicorn-41510.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-41510.exe
  2⤵
  PID:13896

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 10120 -ip 10120
1⤵
PID:12360

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 6548 -ip 6548
1⤵
PID:12656

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 10512 -ip 10512
1⤵
PID:12984

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 5964 -ip 5964
1⤵
PID:13212

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 6548 -ip 6548
1⤵
PID:15436

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:12292

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 5172 -ip 5172
1⤵
PID:16132

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 332 -s 13648
1⤵
PID:5320

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4312

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-1090.exe

Filesize
468KB

MD5
0d3cb01051c264c973f26cc7f05cdd17

SHA1
622cd53e9ea13f27df0f04a94637e3f995b70f4c

SHA256
a2e673d7baa23131ca4d6ccde3edf309144be8007d96605a02eaaf90f4e8004b

SHA512
ad7953409f12c5a79d2890fcd5e746c9725fa3de38a37f3e382d19832f701dfc086bfaf539c2925ddda4ea055d6eb0ba1eccca8b9ac37ac526e7e896e151acbc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-12418.exe

Filesize
468KB

MD5
0e3ef0d5ce47c11d333d372c0a9e53fd

SHA1
1275e564b62a4ba38a2947ee2199ce820827370f

SHA256
13c7e9ef307684b4506ad7626974b33ec01da698e5352388bbe5733415ed1e35

SHA512
cef6293127fd3deb5615f82d55c60bfde189e9bc9c7824d816a99dbe9bbcafa64af3493a1a70e5399ce826c58649c69bed10349a2bc0eb3d3fabfd521b1fd199

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-13650.exe

Filesize
468KB

MD5
dde6f334612f6a0717ef13102f5f7058

SHA1
1eabc716a3b88a7b23cd4983128376b252e12ab1

SHA256
70f412bbab2e5ba83edfde02f1e3fe013fb850e0717e2984c46363963de08127

SHA512
927bcfcc367f275cdaa9bca5343d3e1027e80f42acea71c5a3bfa8aa0346a1c367e866de6cc46f2044908cdfc34cd4119adaf9f497fe8322259e5642d085ec64

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-15910.exe

Filesize
468KB

MD5
2369997e48fcdc596c8ef82d4311f791

SHA1
d58dbb87f6617a054b98af5a7924eed9100a640e

SHA256
93285a7ea65b681eeb25323bb75644c6b10895d48a5f7b14ceb0c43e7dc007de

SHA512
d63c0fc4c71ed72f30a19bdc3a580886eb55f6903bf429d5785d6a510831bc17abde599a27c9cd39047d82dd1eeeafd089e1a6ca34aa0eb2fcae0d192572aff6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-16275.exe

Filesize
468KB

MD5
1181cd4755d9330386ecd8f00b7a5a9d

SHA1
84f2f37a611ce16d9e44adaa8a751cbc1ddd13d2

SHA256
0749407783df99b0301a6b7b04e351cdc34731ba2654ccbe8e4743d6cf82b65e

SHA512
853f27dce2629e84d85db7dd4303f372ad4584fae70a7d3c598892c1cb8a984c6b1146bcb3ca7374b6bcfe3d0af01150dfa616871e9252def8f65e832de47ab7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-16467.exe

Filesize
468KB

MD5
da557ef90b4169c9b56d56919ec7a1fc

SHA1
83f9a10db264f1fd87b54ea62624ef6043f30d9e

SHA256
eef45df686fe4042a878ba6df204086096106638482ec72e27c2f69e164fcc25

SHA512
44e8fc5f3b63339ed147205889f421f627d6246483557fab32b1746c506068808e314d18fb337bf7e62560a30606b76af9aefec3084103af851c2f545ecb5b2a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-18019.exe

Filesize
468KB

MD5
ddbaf04ed71bc2f9c74821b0e7ec0eac

SHA1
73df7b9d19e2409465fd27063963e0a24d0e96b6

SHA256
7b54462c0585e5cffc026d6d84b4889ce9dc1576367730072172f0e3e8b3e072

SHA512
8e080711a29fb111d0e43afde723a7f0bd86d3121b54531832384b809ecdb4a25eb435a65241047ab5cb7872e61385e19b2ee2c5814000762a684aaee9d76ac1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-20208.exe

Filesize
468KB

MD5
a87b9548afd13bfae30d97bd16426ca9

SHA1
150feec01f5ae001048a1def0c11adcd5c05b018

SHA256
92003eedce9a1c3b5d569dad0fbe720fe7edcc82ee38e8455da7b3db990542eb

SHA512
ab6a95d4d5ff643f1f2773950414be9f7caf99a2fbfcd5dbe35614ad5277533c02651a393c4bbeb11e96cea0b5fbe90b8da71650dca9ca8fc1c5e1ff0b24a100

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-2434.exe

Filesize
468KB

MD5
47701ae8fd3630705ef1eddd2c718eea

SHA1
a90017b235bd8ada1411598650a28febff31fb9a

SHA256
a041c0618b4362d4b2096d44f711eb434549564494efa818788881ae5d4d4390

SHA512
6e4258f60d4044ddf077da3299d2167f18781d3bd642e4220d2be6ca6ac962a13cef85fb5a6284899414693f4218fa91bd6986519b44f5727c07b5f61f56faf8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-25312.exe

Filesize
468KB

MD5
df51cc89f2fa7c7d166d0b9aeafe5b84

SHA1
dc9ba93e7297278a5cc1336af9539b861af259ea

SHA256
91f5f2150348fc09a40c966354cc8f5053b4c24fd4357693d83453ce7f7f3ceb

SHA512
bfa703627d3b3b259b8244ffa35ad004edd3dfc68a20af74db64fb0e441a554118aee23f53722ac496169f5d0d06022f5a6f602ae518a361717833fab3ac8d75

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-25417.exe

Filesize
468KB

MD5
db16b118c5d59fccdfcbe6ece46a96fa

SHA1
150d3d186e16493f9641f6f48be9b8971ed1cc3d

SHA256
a0d47c7af8ffc3df41a4720f7f007b3f753d2075fb4adab653c7392fe707e84f

SHA512
208075a8ba835892fbbbda78f1d285ecee345ed79dedf14807513f09e368b85053c7e1aabf72f9e713f91842a2d2d703c2060faf3a2ddfcd485a2487ea1950a3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-26339.exe

Filesize
468KB

MD5
5824f18fc2c7bae1f4cde6d2a57f861b

SHA1
20a0246aa6d79721bb0c1461eac305315df39e05

SHA256
03244a48d6207e490b6aae7b775eec84ca067979cb663001b5eb2f3ca044f20e

SHA512
eb596002d2035252e4cf97d9ab8f40e38d04bf9ae3948887f16335e6be91a4a3997091e49a0a49053fa6059c25585f3b9a73b19b82804fcc7e10dfe9db0267eb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-27933.exe

Filesize
468KB

MD5
6abb999b271cd3b7361c136892ac2c4b

SHA1
95e77148b28ead2a54a75c348d31c655680189b5

SHA256
68045a20a5fd6d324bb9de86c22feb136f20f8a9da85992579b342edc7ec6091

SHA512
dbb44af24effd2105775af0cdffb0a32bca9723269b9bc759ca179cb3262f72b391c8a9f21eddb2e1b25027ce6220e425f713c8b476f4678bccd942e6a85af87

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-31443.exe

Filesize
468KB

MD5
449a0f228356162b9d103bb4953fc947

SHA1
644a15749ea89a6d176fd9fdbeab4def3e550206

SHA256
4ab9af57bdeb460dc530188d3efe07e0af505d0d0e989a7cdf504daff6ab23e7

SHA512
67e0bdcbba8b51b547bc9c643cffded3a3b9573845d79f4600ce3b29f2afb7d51d410525acd2d9ba92427d0f1453a1594588b7eed16d80cc8fda977c08a1ef9b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-32922.exe

Filesize
468KB

MD5
c53ddc2d3b1f55264479339907e57f9b

SHA1
0cec5e70cc4ecec21b104292f1081b0a1a493983

SHA256
1ae89d6d68a5a2ec63cb0c075e26ff16a8b12f701b1879c5721adbd09963eefc

SHA512
97ea2cef83604f3e5a7fc9687c76959bbc15b5f784ab65edeb18eb5798fe7a9d2afbc0e28e860f98d9416e53111b5738cd00c013a94fb59f7812662340c2dfeb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-33763.exe

Filesize
468KB

MD5
9f3f837cc040540e4b9f5b46ca7fc669

SHA1
388efc4a936c3142c2ccb947042b39edbd6ee960

SHA256
fc2e6f61561c32625238de7188e2f5fd251c4c108d2316636fea11dc3d42bcca

SHA512
095874754543f446d6866e792ecbbca85f1ebcd50e5c3689affe88b1352660a30f32f40c7157c1800041c643f08539d8e6aa2290f743349cb5723214f6ca43a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-42625.exe

Filesize
468KB

MD5
208d632bc689f51d7e6571533667559c

SHA1
414452de021171b2be99aa00d5471d6e7030c6a6

SHA256
fc6324518fa65dd6f70628e2ec719eeb6107bf3b3cb2295779622a63f6083122

SHA512
d629cc5295e7c607aaaeea1a4eab35c34e16796afc333bbf17bf19c3151fafa096f1d805bef9452963ee36085afb8d20f0c5266d7ddb5b1b12a70fa89a0c262b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-42985.exe

Filesize
468KB

MD5
5a27600ef983ea2b5092746efbf1d4d8

SHA1
787dc3928147ab9829b908dddd4d6c3b1b41d2e3

SHA256
a8082eeedbf62c12b46a6bc8c27f185712b91acbe0710e597417732fea11eaf1

SHA512
c6c4fdf0f1ab0a7a29af42aca70a4e933086ac4e7814f6ed622c8b607c77243f150ce195eb00da04c2ab454daf30bf8d7307249c6391ab97f23609d4b5622268

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-43235.exe

Filesize
468KB

MD5
6d3981cee9cf7f170d4c05e79dcb9b74

SHA1
9f344ad2e700c39a4d96e3f5aafe1b673d1dfa1a

SHA256
ec63245fe4005537b5faac3697139315e7ca5c22c7a7f6b3f229a8962f9bc4c3

SHA512
4886142472a3ca64ebe5d32707a820456fd2cdd17cbef965fddaec566f236c47196c0cd36f134b08e09486d1fd05176729c3c6b4a52e6dc655e64c62b0ae9ec7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-45091.exe

Filesize
468KB

MD5
a4743cf2b61ce1058f1cc25466a60b8c

SHA1
ba7b722305a670059cb563680abf1e85c1528190

SHA256
f9f6202498bf44b2e4f2c80edf31294768b764e61d90bb7d9668baf9d0d266c0

SHA512
fc44fbbf8f42d88747a60af2e5d7405950b68be64f366b66b7258c3690028a5b95a0cf601aec8811884122a7b45781b5c4afe290ca8945d3f44f568a4b575a8b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-45786.exe

Filesize
468KB

MD5
a10364647ed0bd2afb7c48f98984ff34

SHA1
b602ac18a9662c45df91ab25748346852c856be2

SHA256
1da177f03bb4d5fd88eeff863c7c873645bd6e3c5f2dce0a41f04bb31b4ab739

SHA512
848ec952195bd3e764404bf5f5f6612f607a7c6f14b8f5074cf890c7ce1ac6a36b7950af319bbf4fa078a323fbc958ebfe72d5e0716f8a1ffa1be27d8dee61a6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-47639.exe

Filesize
468KB

MD5
cf95dfc8259c604dd23bd79225a32a2a

SHA1
1d760a2eea4db4d02aa6afb33037e4195432d70f

SHA256
d31edae2df6180ac3cee01915b37a7dda2a7c7ee6b2b1f09bd2842efe9570fb3

SHA512
1a5826b4866b4646a139d70fbf50f1483dce6c5eca7c34364486101c7d6847400395aec0f16385032d760caa80c877a96359a7b472373cdaf147e6bf709a1d91

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-47930.exe

Filesize
468KB

MD5
97afe2d525ae229321f47677e39ade81

SHA1
0935fcbac3de2a13fcea639e05484cdf456546b6

SHA256
b2b33566861d68903a827ff6b9a49f60f4c435d11ef5c733b5cf0f2a479df3e2

SHA512
705aea467d561df379cdd1f8e17eb46cb0c523acb6622cb77bcaa33aecf945884e442d86c9c76250827aa1d052e51f99f505cac6a6dd72950bdfc6dee29425e3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-48106.exe

Filesize
468KB

MD5
5adf668f0c83071b954c5c4de32ea5ad

SHA1
309fc72d0d000d4a70219a3a1a4a8e2a6700ff97

SHA256
e507f240e9ca631db3b2778309825ae3219041be2102f2d369e44fc2baaf83fe

SHA512
a5f0a93dcd2e09b6976035b78b38234636a5061f5425ce97aa262c52d16ee1cc37576f3f616202b4550523a6b5812b826f56115062dab465fa3852b4d1447923

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-48686.exe

Filesize
468KB

MD5
ca499b51d3232eddb5c013fbf02c4f5a

SHA1
84caf0a40fb9277c804a91ddc7ed379bbf08d1a9

SHA256
15de37981951b93fec38d18e1512f6026db3c6415bde4fb86f2744c2a33e90cd

SHA512
bc5ae8346dc82d577176e42a68f16d02873d9ba78b2c2b22ef6973c5df5bc17ab9208e4ca7139b83c7a3c7626e040cc95cab4e2e80f36518e8d0548c3fc9c971

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-52263.exe

Filesize
468KB

MD5
243b4b680b1814bfef2ad538f9529524

SHA1
7047f2fe92c6f8c7eceb94ed61b95808b2b643bf

SHA256
b627ace2d6843afbe35d23342144774d5ef4437d7158e8e24712b8cf5630e4d9

SHA512
ef852c72b245942b0814506c9f3206eb1c5193229907fa721a8ba6f52cfdb1b9e8b5efdd16c270ed1240e0da60ed97387108d41d405e297ba163417428777662

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-52528.exe

Filesize
468KB

MD5
c7d493e39b6ecce0f0a37a9020fcf840

SHA1
2df1f1d20b5b7411890020f753e83f124983adbd

SHA256
05fc5fe3293424f7d35fdfd07bc4bf6febd27ad74e4353ae0c25ebb0800607ff

SHA512
c1b8cb888095569435136df433e7def56fc90fe503f81e59f8b83ebc7f198918b2b30cd1e25c463ca61d3eb3690c60a0f6adb22a08798192d0b28da8dacdb605

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-59011.exe

Filesize
468KB

MD5
9b3a005b0b99b7855ee17ba4192e1b37

SHA1
04f7f893ccc93a8292526acc83f30d4585f95fba

SHA256
f759db7f03a949297b98ce0c83c9e9e47cd3e616f81f1da5a1a18c91b8c9cf68

SHA512
b6bed327020779d6ce62de70ff2bd893adadf89cfad2892c227cf5d8fcb4811767ded5fc87449e5ef5673f39a0b4a662ca956b18a3e52527f66f4e0b4d9a5bf2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-60110.exe

Filesize
468KB

MD5
6882458ec285426ce3b3fde471cb2241

SHA1
f88a403942c8aa5ceea154cc35dcb274abfed85b

SHA256
0320dad50cc251ce5848cffe0be5cbe360d05b9c3c56f1ca1558ec38237568ea

SHA512
b6331575cc52a55d8e276fcc949b0baf95aa622a5f6347b738235465a6dc8b592e64ea9227789b79d3d0f07dfda5b206d04a65204de1803a66de18bd5429ac14

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-60746.exe

Filesize
468KB

MD5
27ec13978c0b08ecd7c52864e0bf3d87

SHA1
21e74216f324c9c20bc921fa4d0d3c76c222b1f8

SHA256
ee67312be44b3a6ccbc3dca9ea65c87c3b6b8ad8a73d920c4ebe8e396d4ad513

SHA512
062940fc421248d5575c31844e33afc254a734b48354fb3d02b8dd70792c028fe1478fd0a9f8921eed7419e69a1e4124514d910cfc356d1d922871ffd36e3e3b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-60986.exe

Filesize
468KB

MD5
65066a93548177e007aefcfd688237fe

SHA1
d29ab75f054c9b17d75b6998cf29279b0cacbd3b

SHA256
ca8c949ccf99b5fc2f6416cf3601af4b8c7cb8d3993968b70fbd0e7de3742e3a

SHA512
e81e919f5fb75d2af7c7062f264696ef468fb363beeaa72e22ab397d9b83939173d768a41aee3d0d219438cae2273f8394b8e54acb24e24251079ff7b34ab5a3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-61059.exe

Filesize
468KB

MD5
59353e9b96b7c8562cd29f562b779e76

SHA1
b4cdaf112a2c8179561fbac0425407b48ce35ad2

SHA256
96ae4cc9d7cfc89feaa5ca8492b4d355117659a25996f839eecdb077b6a7ad19

SHA512
00bdebd2ac74b783dc215fb000a5353e796de57abdbd1dd11de0327107ca4def3484123eca61a1b64d98f57b7da906da71edf0f512d03aa20f6a211e5e5812a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-62910.exe

Filesize
468KB

MD5
ddd488d8cd6cc58b9391cd6ac2ddb7e0

SHA1
5784b7b6826ee8a2eaaee0607b2aaae46b3cfebc

SHA256
960c7c06fc75604d56ac77140bde7b56913b798696e1210f14a0e74a89217692

SHA512
b2671624abb2619769e9929c399efc2c753bb2c047556edbc70ca354cfc981f3879bc4882a2233d63c06b7216cc4204d826710b8243fb17eb262dfb788f2396d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-64115.exe

Filesize
468KB

MD5
67970c7bc4378eb5381a9af479250107

SHA1
5e84ad0cdd2b812cb758a3e284db401aa4c72ac4

SHA256
925eda6e8550e2a7494eeca5fe23d7bea4ec8b3cb888a5fc236268d4b5620f0d

SHA512
393405cae91632c930ca5adaf16ea69f5e7d1ddf6516af8d37d15f133d1bc0a0e78d4b67f6d83033ddd3484d70f4305adc21cc0a11cbbff8015b9a1d967a5312

Download Submit
memory/208-180-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/432-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/448-2824-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/464-93-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/556-303-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/652-300-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/780-463-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/812-482-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/892-69-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1212-411-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1332-347-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1340-186-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1364-91-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1464-318-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1496-464-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1596-182-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1616-330-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1632-268-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1640-122-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1688-211-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1732-94-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1740-373-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1836-13-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1892-301-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1920-367-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1928-179-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1936-40-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1944-348-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2020-129-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2024-404-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2092-114-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2168-408-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2244-257-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2328-372-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2332-231-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2344-500-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2384-250-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2428-420-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2604-3298-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2676-19-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2724-232-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2836-144-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2868-38-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2928-448-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3004-195-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3084-322-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3092-107-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3108-378-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3188-484-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3288-386-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3304-213-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3404-306-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3416-304-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3428-3852-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3488-513-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3512-431-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3524-487-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3528-143-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3620-434-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3652-55-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3792-269-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3812-239-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3856-397-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3864-385-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3868-6-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3912-467-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3944-308-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4064-75-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4088-387-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4124-212-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4140-3072-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4320-419-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4324-181-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4360-170-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4368-421-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4476-227-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4516-329-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4548-412-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4552-3642-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4588-92-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4644-41-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4644-3101-0x00000000752B0000-0x0000000075325000-memory.dmp

Filesize
468KB

Download
memory/4660-27-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4704-253-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4712-462-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4740-302-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4884-475-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4924-263-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4932-483-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5108-243-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5152-501-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5168-3462-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5188-503-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5212-504-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5228-514-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5244-3775-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5312-547-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5320-3166-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5372-524-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5388-515-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5424-2857-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5432-548-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5468-549-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5484-550-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5512-3691-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5516-551-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5536-552-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5548-2853-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/6548-2633-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/7228-3434-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/7388-3414-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/10512-2727-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/11468-3112-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/11732-3641-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/11864-3167-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/13500-3454-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/13984-3690-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/15236-3692-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/15628-2856-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/15644-3541-0x00000000767A0000-0x00000000767C5000-memory.dmp

Filesize
148KB

Download
memory/15868-2575-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/16020-3111-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/16120-2573-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/16356-3344-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads