6865ea762c0e3a4f11dbfcb9d7d99c65839ed2d2a82c9e7964398e3871333d99

Analysis

max time kernel
142s
max time network
121s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
09/09/2024, 22:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6865ea762c0e3a4f11dbfcb9d7d99c65839ed2d2a82c9e7964398e3871333d99.exe
Size

468KB
MD5

a4078fe669922ce084a033221f89f982
SHA1

2dff45d4931bd75f66d6af0998a55227a230f7e7
SHA256

6865ea762c0e3a4f11dbfcb9d7d99c65839ed2d2a82c9e7964398e3871333d99
SHA512

34c4d994a9b0a6e5274d26ca3cbccea17e071bd93c67051d21de9e4a59eb8c33e499f5c8623c4af4b86694713fd80481323dba59bd8d6058ceea3dcc0b89dabe
SSDEEP

3072:mU0/ogiEIQ5JtbY9zfcT/f8w0ChCvp9hEEHCxVWOB8eUWEWuAYls:mUkojAJtSz0T/fETmBB83rWuA

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
396	Unicorn-57111.exe
224	Unicorn-9617.exe
116	Unicorn-29483.exe
4540	Unicorn-64075.exe
3064	Unicorn-59991.exe
100	Unicorn-53861.exe
2148	Unicorn-22720.exe
4048	Unicorn-48699.exe
3284	Unicorn-7344.exe
4000	Unicorn-53852.exe
4088	Unicorn-53852.exe
2504	Unicorn-33986.exe
1000	Unicorn-31906.exe
4444	Unicorn-53852.exe
856	Unicorn-21956.exe
5036	Unicorn-38139.exe
3520	Unicorn-23426.exe
3628	Unicorn-33863.exe
1224	Unicorn-19564.exe
3596	Unicorn-25695.exe
4656	Unicorn-25695.exe
4712	Unicorn-21419.exe
1400	Unicorn-38824.exe
2684	Unicorn-38824.exe
800	Unicorn-28195.exe
1528	Unicorn-28195.exe
4180	Unicorn-56536.exe
3916	Unicorn-8901.exe
4324	Unicorn-3036.exe
2036	Unicorn-54838.exe
4080	Unicorn-1273.exe
2548	Unicorn-56182.exe
4584	Unicorn-33069.exe
1864	Unicorn-53581.exe
4752	Unicorn-2705.exe
2564	Unicorn-6618.exe
1048	Unicorn-59638.exe
2892	Unicorn-27807.exe
4512	Unicorn-26223.exe
3316	Unicorn-51242.exe
2428	Unicorn-29753.exe
2808	Unicorn-56203.exe
4572	Unicorn-52119.exe
4968	Unicorn-13224.exe
2980	Unicorn-12959.exe
4152	Unicorn-20001.exe
4784	Unicorn-35783.exe
4828	Unicorn-15917.exe
3144	Unicorn-53495.exe
3528	Unicorn-21484.exe
5004	Unicorn-17208.exe
528	Unicorn-23339.exe
1108	Unicorn-23339.exe
2804	Unicorn-23339.exe
1160	Unicorn-39767.exe
1620	Unicorn-26031.exe
2296	Unicorn-20431.exe
652	Unicorn-34029.exe
4832	Unicorn-40805.exe
3788	Unicorn-14184.exe
60	Unicorn-14184.exe
4888	Unicorn-51688.exe
1484	Unicorn-1932.exe
4320	Unicorn-61339.exe

Program crash 63 IoCs

pid	pid_target	Process	procid_target
6332	3396	WerFault.exe	169
1992	15152	WerFault.exe	782
17244	16148	WerFault.exe	794
2468	15536	WerFault.exe	791
1148	15988	WerFault.exe	796
2528	16352	WerFault.exe	799
15620	16024	WerFault.exe	797
5332	16364	WerFault.exe	798
3192	1648	WerFault.exe	810
2776	3076	WerFault.exe	804
6088	16616	WerFault.exe	830
6020	15884	WerFault.exe	809
5908	16416	WerFault.exe	821
6140	16792	WerFault.exe	843
6112	16724	WerFault.exe	836
3164	16108	WerFault.exe	814
5800	16464	WerFault.exe	826
1996	16996	WerFault.exe	847
6400	17040	WerFault.exe	849
3172	16952	WerFault.exe	844
6140	6812	WerFault.exe	296
5928	5332	WerFault.exe	913
8484	17364	Process not Found	862
16556	16392	Process not Found	869
17304	15472	Process not Found	868
9036	17268	Process not Found	855
8552	16392	Process not Found	869
8480	2368	Process not Found	880
7400	15472	Process not Found	868
8020	17376	Process not Found	863
1996	17256	WerFault.exe	854
17244	1272	Process not Found	1069
14180	8140	Process not Found	1135
13380	14580	Process not Found	1089
3816	9564	Process not Found	1160
19408	10832	Process not Found	1056
9720	3556	Process not Found	1081
9724	16840	Process not Found	1170
7816	6096	Process not Found	1040
16844	10208	Process not Found	1166
15580	8688	Process not Found	1118
14644	5716	Process not Found	1042
14636	5372	Process not Found	1129
15060	7104	Process not Found	1190
19416	15432	Process not Found	1078
13652	2432	Process not Found	1011
5572	7528	Process not Found	1154
16140	5548	Process not Found	1033
2556	7164	Process not Found	1145
19232	16912	Process not Found	1110
6376	9928	Process not Found	1161
15044	3380	Process not Found	1060
12476	16760	Process not Found	1117
14932	9796	Process not Found	1180
18744	9832	Process not Found	1197
13024	16200	Process not Found	1169
8816	2204	Process not Found	1036
9512	8120	Process not Found	1136
13900	4212	Process not Found	1113
14684	2260	Process not Found	1085
18708	5652	Process not Found	1084
18676	5884	Process not Found	1034
12452	3912	Process not Found	1038

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16788.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19825.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9218.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41201.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14931.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54007.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10347.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49275.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12869.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20001.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59654.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27743.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43840.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44055.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33785.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60247.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37551.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42936.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27933.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29483.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2705.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32535.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51672.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18508.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34024.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56464.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12180.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11351.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17444.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32628.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58667.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26129.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32218.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56970.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52721.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51688.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3239.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15801.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12466.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20639.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61293.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3145.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5513.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37174.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33069.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1334.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20138.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30053.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1932.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49841.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7101.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33986.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23426.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61283.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58729.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7059.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40582.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
7912	svchost.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	3252	dwm.exe
Token: SeChangeNotifyPrivilege	3252	dwm.exe
Token: 33	3252	dwm.exe
Token: SeIncBasePriorityPrivilege	3252	dwm.exe
Token: SeCreateGlobalPrivilege	11384	Process not Found
Token: SeChangeNotifyPrivilege	11384	Process not Found
Token: 33	11384	Process not Found
Token: SeIncBasePriorityPrivilege	11384	Process not Found

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
3920	6865ea762c0e3a4f11dbfcb9d7d99c65839ed2d2a82c9e7964398e3871333d99.exe
396	Unicorn-57111.exe
224	Unicorn-9617.exe
116	Unicorn-29483.exe
4540	Unicorn-64075.exe
3064	Unicorn-59991.exe
2148	Unicorn-22720.exe
100	Unicorn-53861.exe
4048	Unicorn-48699.exe
4444	Unicorn-53852.exe
3284	Unicorn-7344.exe
2504	Unicorn-33986.exe
1000	Unicorn-31906.exe
4000	Unicorn-53852.exe
4088	Unicorn-53852.exe
856	Unicorn-21956.exe
5036	Unicorn-38139.exe
3520	Unicorn-23426.exe
3628	Unicorn-33863.exe
1224	Unicorn-19564.exe
4656	Unicorn-25695.exe
4324	Unicorn-3036.exe
3596	Unicorn-25695.exe
1400	Unicorn-38824.exe
4712	Unicorn-21419.exe
2684	Unicorn-38824.exe
800	Unicorn-28195.exe
2036	Unicorn-54838.exe
1528	Unicorn-28195.exe
4180	Unicorn-56536.exe
4080	Unicorn-1273.exe
2548	Unicorn-56182.exe
4584	Unicorn-33069.exe
1864	Unicorn-53581.exe
4752	Unicorn-2705.exe
2564	Unicorn-6618.exe
1048	Unicorn-59638.exe
2892	Unicorn-27807.exe
4512	Unicorn-26223.exe
3316	Unicorn-51242.exe
2428	Unicorn-29753.exe
2808	Unicorn-56203.exe
4572	Unicorn-52119.exe
4968	Unicorn-13224.exe
4828	Unicorn-15917.exe
2980	Unicorn-12959.exe
4152	Unicorn-20001.exe
3528	Unicorn-21484.exe
3144	Unicorn-53495.exe
1160	Unicorn-39767.exe
4784	Unicorn-35783.exe
528	Unicorn-23339.exe
1620	Unicorn-26031.exe
5004	Unicorn-17208.exe
2804	Unicorn-23339.exe
2296	Unicorn-20431.exe
1108	Unicorn-23339.exe
4832	Unicorn-40805.exe
652	Unicorn-34029.exe
3788	Unicorn-14184.exe
4340	Unicorn-63120.exe
60	Unicorn-14184.exe
1484	Unicorn-1932.exe
4320	Unicorn-61339.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3920 wrote to memory of 396	3920	6865ea762c0e3a4f11dbfcb9d7d99c65839ed2d2a82c9e7964398e3871333d99.exe	87
PID 3920 wrote to memory of 396	3920	6865ea762c0e3a4f11dbfcb9d7d99c65839ed2d2a82c9e7964398e3871333d99.exe	87
PID 3920 wrote to memory of 396	3920	6865ea762c0e3a4f11dbfcb9d7d99c65839ed2d2a82c9e7964398e3871333d99.exe	87
PID 3920 wrote to memory of 224	3920	6865ea762c0e3a4f11dbfcb9d7d99c65839ed2d2a82c9e7964398e3871333d99.exe	88
PID 3920 wrote to memory of 224	3920	6865ea762c0e3a4f11dbfcb9d7d99c65839ed2d2a82c9e7964398e3871333d99.exe	88
PID 3920 wrote to memory of 224	3920	6865ea762c0e3a4f11dbfcb9d7d99c65839ed2d2a82c9e7964398e3871333d99.exe	88
PID 396 wrote to memory of 116	396	Unicorn-57111.exe	89
PID 396 wrote to memory of 116	396	Unicorn-57111.exe	89
PID 396 wrote to memory of 116	396	Unicorn-57111.exe	89
PID 224 wrote to memory of 4540	224	Unicorn-9617.exe	90
PID 224 wrote to memory of 4540	224	Unicorn-9617.exe	90
PID 224 wrote to memory of 4540	224	Unicorn-9617.exe	90
PID 3920 wrote to memory of 100	3920	6865ea762c0e3a4f11dbfcb9d7d99c65839ed2d2a82c9e7964398e3871333d99.exe	91
PID 3920 wrote to memory of 100	3920	6865ea762c0e3a4f11dbfcb9d7d99c65839ed2d2a82c9e7964398e3871333d99.exe	91
PID 3920 wrote to memory of 100	3920	6865ea762c0e3a4f11dbfcb9d7d99c65839ed2d2a82c9e7964398e3871333d99.exe	91
PID 116 wrote to memory of 3064	116	Unicorn-29483.exe	92
PID 116 wrote to memory of 3064	116	Unicorn-29483.exe	92
PID 116 wrote to memory of 3064	116	Unicorn-29483.exe	92
PID 396 wrote to memory of 2148	396	Unicorn-57111.exe	93
PID 396 wrote to memory of 2148	396	Unicorn-57111.exe	93
PID 396 wrote to memory of 2148	396	Unicorn-57111.exe	93
PID 4540 wrote to memory of 4048	4540	Unicorn-64075.exe	94
PID 4540 wrote to memory of 4048	4540	Unicorn-64075.exe	94
PID 4540 wrote to memory of 4048	4540	Unicorn-64075.exe	94
PID 224 wrote to memory of 3284	224	Unicorn-9617.exe	95
PID 224 wrote to memory of 3284	224	Unicorn-9617.exe	95
PID 224 wrote to memory of 3284	224	Unicorn-9617.exe	95
PID 2148 wrote to memory of 4000	2148	Unicorn-22720.exe	96
PID 2148 wrote to memory of 4000	2148	Unicorn-22720.exe	96
PID 2148 wrote to memory of 4000	2148	Unicorn-22720.exe	96
PID 100 wrote to memory of 4088	100	Unicorn-53861.exe	97
PID 100 wrote to memory of 4088	100	Unicorn-53861.exe	97
PID 100 wrote to memory of 4088	100	Unicorn-53861.exe	97
PID 3064 wrote to memory of 4444	3064	Unicorn-59991.exe	100
PID 3064 wrote to memory of 4444	3064	Unicorn-59991.exe	100
PID 3064 wrote to memory of 4444	3064	Unicorn-59991.exe	100
PID 116 wrote to memory of 2504	116	Unicorn-29483.exe	98
PID 116 wrote to memory of 2504	116	Unicorn-29483.exe	98
PID 116 wrote to memory of 2504	116	Unicorn-29483.exe	98
PID 3920 wrote to memory of 1000	3920	6865ea762c0e3a4f11dbfcb9d7d99c65839ed2d2a82c9e7964398e3871333d99.exe	99
PID 3920 wrote to memory of 1000	3920	6865ea762c0e3a4f11dbfcb9d7d99c65839ed2d2a82c9e7964398e3871333d99.exe	99
PID 3920 wrote to memory of 1000	3920	6865ea762c0e3a4f11dbfcb9d7d99c65839ed2d2a82c9e7964398e3871333d99.exe	99
PID 396 wrote to memory of 856	396	Unicorn-57111.exe	101
PID 396 wrote to memory of 856	396	Unicorn-57111.exe	101
PID 396 wrote to memory of 856	396	Unicorn-57111.exe	101
PID 4048 wrote to memory of 5036	4048	Unicorn-48699.exe	106
PID 4048 wrote to memory of 5036	4048	Unicorn-48699.exe	106
PID 4048 wrote to memory of 5036	4048	Unicorn-48699.exe	106
PID 4540 wrote to memory of 3520	4540	Unicorn-64075.exe	107
PID 4540 wrote to memory of 3520	4540	Unicorn-64075.exe	107
PID 4540 wrote to memory of 3520	4540	Unicorn-64075.exe	107
PID 3284 wrote to memory of 3628	3284	Unicorn-7344.exe	108
PID 3284 wrote to memory of 3628	3284	Unicorn-7344.exe	108
PID 3284 wrote to memory of 3628	3284	Unicorn-7344.exe	108
PID 224 wrote to memory of 1224	224	Unicorn-9617.exe	109
PID 224 wrote to memory of 1224	224	Unicorn-9617.exe	109
PID 224 wrote to memory of 1224	224	Unicorn-9617.exe	109
PID 4000 wrote to memory of 3596	4000	Unicorn-53852.exe	110
PID 4000 wrote to memory of 3596	4000	Unicorn-53852.exe	110
PID 4000 wrote to memory of 3596	4000	Unicorn-53852.exe	110
PID 4444 wrote to memory of 4656	4444	Unicorn-53852.exe	111
PID 4444 wrote to memory of 4656	4444	Unicorn-53852.exe	111
PID 4444 wrote to memory of 4656	4444	Unicorn-53852.exe	111
PID 4088 wrote to memory of 4712	4088	Unicorn-53852.exe	112

C:\Users\Admin\AppData\Local\Temp\6865ea762c0e3a4f11dbfcb9d7d99c65839ed2d2a82c9e7964398e3871333d99.exe
"C:\Users\Admin\AppData\Local\Temp\6865ea762c0e3a4f11dbfcb9d7d99c65839ed2d2a82c9e7964398e3871333d99.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3920
- C:\Users\Admin\AppData\Local\Temp\Unicorn-57111.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-57111.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:396
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29483.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29483.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59991.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59991.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53852.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25695.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56203.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59000.exe
        8⤵
        
        PID:2448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-261.exe
        9⤵
        
        PID:4124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55399.exe
        10⤵
        
        PID:10696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36789.exe
        10⤵
        
        PID:13804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56970.exe
        10⤵
        
        PID:16740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22600.exe
        10⤵
        
        PID:6996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37655.exe
        9⤵
        
        PID:8456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59785.exe
        9⤵
        
        PID:1104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43472.exe
        9⤵
        
        PID:1648
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1648 -s 436
        10⤵
        Program crash
        
        PID:3192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42936.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:6172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56514.exe
        8⤵
        
        PID:7008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8528.exe
        9⤵
        
        PID:9784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60609.exe
        9⤵
        
        PID:13404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35481.exe
        9⤵
        
        PID:16444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28246.exe
        9⤵
        
        PID:6556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3145.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:7888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33894.exe
        8⤵
        
        PID:11612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34652.exe
        8⤵
        
        PID:15636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49907.exe
        8⤵
        
        PID:5916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54537.exe
        8⤵
        
        PID:14812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49249.exe
        7⤵
        
        PID:5172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8512.exe
        8⤵
        
        PID:5924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54038.exe
        8⤵
        
        PID:9312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-553.exe
        8⤵
        
        PID:13676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4625.exe
        8⤵
        
        PID:17396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-266.exe
        8⤵
        
        PID:2260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58729.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5513.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58091.exe
        8⤵
        
        PID:14392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17957.exe
        8⤵
        
        PID:16924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8517.exe
        7⤵
        
        PID:9448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22637.exe
        7⤵
        
        PID:12472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33211.exe
        7⤵
        
        PID:16488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64501.exe
        7⤵
        
        PID:6592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20001.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63852.exe
        7⤵
        
        PID:5844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6696.exe
        8⤵
        
        PID:7184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10645.exe
        8⤵
        
        PID:9428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7354.exe
        8⤵
        
        PID:12904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3136.exe
        8⤵
        
        PID:2212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48929.exe
        8⤵
        
        PID:3900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9965.exe
        7⤵
        
        PID:7424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11361.exe
        7⤵
        
        PID:11072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34870.exe
        7⤵
        
        PID:14444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49056.exe
        7⤵
        
        PID:2368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15620.exe
        6⤵
        
        PID:5936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52799.exe
        7⤵
        
        PID:6700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35036.exe
        8⤵
        
        PID:12416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58336.exe
        8⤵
        
        PID:15812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15657.exe
        8⤵
        
        PID:5264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5029.exe
        7⤵
        
        PID:8212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-553.exe
        7⤵
        
        PID:13656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4625.exe
        7⤵
        
        PID:17364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32882.exe
        6⤵
        
        PID:6584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8528.exe
        7⤵
        
        PID:10080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37671.exe
        7⤵
        
        PID:14500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8720.exe
        7⤵
        
        PID:16824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61160.exe
        6⤵
        
        PID:10028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65460.exe
        6⤵
        
        PID:12696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4731.exe
        6⤵
        
        PID:1176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53135.exe
        6⤵
        
        PID:10832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28195.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60048.exe
        6⤵
        
        PID:2744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4044.exe
        7⤵
        
        PID:6308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11351.exe
        8⤵
        
        PID:10612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14231.exe
        8⤵
        
        PID:13704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56970.exe
        8⤵
        
        PID:16704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8593.exe
        8⤵
        
        PID:16500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32497.exe
        7⤵
        
        PID:8776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40582.exe
        7⤵
        
        PID:12176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18045.exe
        7⤵
        
        PID:14748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44570.exe
        7⤵
        
        PID:1148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15210.exe
        6⤵
        
        PID:6820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65082.exe
        7⤵
        
        PID:9500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16815.exe
        7⤵
        
        PID:13128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56887.exe
        7⤵
        
        PID:1988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51459.exe
        7⤵
        
        PID:6364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33785.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27743.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:13176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54617.exe
        6⤵
        
        PID:3060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17208.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-515.exe
        6⤵
        
        PID:6244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13961.exe
        7⤵
        
        PID:7708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52721.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:11308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16373.exe
        7⤵
        
        PID:14904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5943.exe
        7⤵
        
        PID:5156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46233.exe
        6⤵
        
        PID:8784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17444.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:12724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20639.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:16004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20946.exe
        6⤵
        
        PID:6724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52705.exe
        5⤵
        
        PID:5748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24185.exe
        6⤵
        
        PID:7704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52638.exe
        6⤵
        
        PID:10740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26788.exe
        6⤵
        
        PID:13964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1237.exe
        6⤵
        
        PID:17104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65415.exe
        5⤵
        
        PID:8184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3073.exe
        5⤵
        
        PID:11076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62235.exe
        5⤵
        
        PID:14840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44975.exe
        5⤵
        
        PID:17176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33986.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33986.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38824.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23339.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47817.exe
        7⤵
        
        PID:5656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25341.exe
        8⤵
        
        PID:6828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35114.exe
        9⤵
        
        PID:15152
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 15152 -s 476
        10⤵
        Program crash
        
        PID:1992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57729.exe
        9⤵
        
        PID:5532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2728.exe
        9⤵
        
        PID:15888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58314.exe
        8⤵
        
        PID:8856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-553.exe
        8⤵
        
        PID:13908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14931.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:17028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21370.exe
        7⤵
        
        PID:7712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65440.exe
        7⤵
        
        PID:10364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25358.exe
        7⤵
        
        PID:13536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49886.exe
        7⤵
        
        PID:16680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17344.exe
        6⤵
        
        PID:5820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16043.exe
        7⤵
        
        PID:5396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59945.exe
        8⤵
        
        PID:14672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7101.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59654.exe
        7⤵
        
        PID:9880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35595.exe
        7⤵
        
        PID:12544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51953.exe
        7⤵
        
        PID:16364
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 16364 -s 464
        8⤵
        Program crash
        
        PID:5332
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5332 -s 584
        9⤵
        Program crash
        
        PID:5928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25301.exe
        7⤵
        
        PID:3172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23700.exe
        6⤵
        
        PID:7408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14750.exe
        7⤵
        
        PID:9088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37671.exe
        7⤵
        
        PID:14472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55945.exe
        7⤵
        
        PID:3688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22654.exe
        6⤵
        
        PID:10212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43257.exe
        6⤵
        
        PID:12924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16145.exe
        6⤵
        
        PID:412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49275.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40919.exe
        5⤵
        
        PID:4588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39461.exe
        6⤵
        
        PID:6472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59903.exe
        6⤵
        
        PID:9320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59785.exe
        6⤵
        
        PID:13300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43472.exe
        6⤵
        
        PID:15740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6493.exe
        5⤵
        
        PID:7036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55643.exe
        6⤵
        
        PID:15928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18066.exe
        6⤵
        
        PID:5584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9936.exe
        6⤵
        
        PID:11424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22711.exe
        5⤵
        
        PID:4136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53618.exe
        5⤵
        
        PID:11764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14570.exe
        5⤵
        
        PID:15920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24529.exe
        5⤵
        
        PID:2312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22793.exe
        5⤵
        
        PID:6628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3036.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3036.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6618.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12923.exe
        6⤵
        
        PID:3416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65113.exe
        7⤵
        
        PID:5892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63271.exe
        8⤵
        
        PID:7236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30463.exe
        8⤵
        
        PID:11204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9575.exe
        8⤵
        
        PID:11580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41201.exe
        8⤵
        
        PID:17320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43488.exe
        7⤵
        
        PID:8272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4318.exe
        7⤵
        
        PID:11632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41590.exe
        7⤵
        
        PID:15184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22312.exe
        7⤵
        
        PID:4928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35517.exe
        6⤵
        
        PID:5520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11351.exe
        7⤵
        
        PID:10576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14231.exe
        7⤵
        
        PID:13692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56970.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:16732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13560.exe
        6⤵
        
        PID:8592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2399.exe
        6⤵
        
        PID:12112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44191.exe
        6⤵
        
        PID:14484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62780.exe
        6⤵
        
        PID:15808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33597.exe
        5⤵
        
        PID:4812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24718.exe
        6⤵
        
        PID:6956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25311.exe
        7⤵
        
        PID:9408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33343.exe
        7⤵
        
        PID:13092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18184.exe
        7⤵
        
        PID:4372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24624.exe
        7⤵
        
        PID:3172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25394.exe
        6⤵
        
        PID:9712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32218.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11485.exe
        6⤵
        
        PID:16148
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 16148 -s 464
        7⤵
        Program crash
        
        PID:17244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9111.exe
        6⤵
        
        PID:6140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27744.exe
        6⤵
        
        PID:7076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26118.exe
        5⤵
        
        PID:5384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28186.exe
        6⤵
        
        PID:6860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40302.exe
        6⤵
        
        PID:9172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9218.exe
        6⤵
        
        PID:13932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58109.exe
        6⤵
        
        PID:17060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18958.exe
        5⤵
        
        PID:8172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57735.exe
        5⤵
        
        PID:11140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38371.exe
        5⤵
        
        PID:14248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3408.exe
        5⤵
        
        PID:17292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59638.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59638.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62700.exe
        5⤵
        
        PID:4772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56753.exe
        6⤵
        
        PID:5956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63271.exe
        7⤵
        
        PID:7292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34547.exe
        7⤵
        
        PID:11128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57707.exe
        7⤵
        
        PID:14224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41201.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:15472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28718.exe
        6⤵
        
        PID:8360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24657.exe
        6⤵
        
        PID:11492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34652.exe
        6⤵
        
        PID:15700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54537.exe
        6⤵
        
        PID:6160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35517.exe
        5⤵
        
        PID:5600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13961.exe
        6⤵
        
        PID:7544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52721.exe
        6⤵
        
        PID:9836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16373.exe
        6⤵
        
        PID:14864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9104.exe
        6⤵
        
        PID:17220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13560.exe
        5⤵
        
        PID:8600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2399.exe
        5⤵
        
        PID:12092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9380.exe
        5⤵
        
        PID:14612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44178.exe
        5⤵
        
        PID:5160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51454.exe
        5⤵
        
        PID:16760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28196.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28196.exe
      4⤵
      PID:2000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21943.exe
        5⤵
        
        PID:6024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55103.exe
        6⤵
        
        PID:7448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25310.exe
        6⤵
        
        PID:11088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20182.exe
        6⤵
        
        PID:14204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41201.exe
        6⤵
        
        PID:17268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65273.exe
        6⤵
        
        PID:17056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48642.exe
        5⤵
        
        PID:8336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61687.exe
        5⤵
        
        PID:11672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41590.exe
        5⤵
        
        PID:15192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22312.exe
        5⤵
        
        PID:4408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54537.exe
        5⤵
        
        PID:6176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48391.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48391.exe
      4⤵
      PID:5676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47402.exe
        5⤵
        
        PID:8712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26846.exe
        5⤵
        
        PID:12196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46991.exe
        5⤵
        
        PID:14628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47890.exe
        5⤵
        
        PID:17264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33849.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33849.exe
      4⤵
      PID:8648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16781.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16781.exe
      4⤵
      PID:12152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48581.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48581.exe
      4⤵
      PID:14668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22434.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22434.exe
      4⤵
      PID:5344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12769.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12769.exe
      4⤵
      PID:6904
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22720.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22720.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53852.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53852.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25695.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23339.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52970.exe
        7⤵
        
        PID:5736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53567.exe
        8⤵
        
        PID:6844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44579.exe
        8⤵
        
        PID:9056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9218.exe
        8⤵
        
        PID:1500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58109.exe
        8⤵
        
        PID:2304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40499.exe
        7⤵
        
        PID:7560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14650.exe
        7⤵
        
        PID:10292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19825.exe
        7⤵
        
        PID:13468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32680.exe
        7⤵
        
        PID:16472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64690.exe
        7⤵
        
        PID:4212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17344.exe
        6⤵
        
        PID:5812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16043.exe
        7⤵
        
        PID:6152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49530.exe
        8⤵
        
        PID:13680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28289.exe
        8⤵
        
        PID:2776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59654.exe
        7⤵
        
        PID:9804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46970.exe
        7⤵
        
        PID:12372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36686.exe
        7⤵
        
        PID:15888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34923.exe
        7⤵
        
        PID:7648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23700.exe
        6⤵
        
        PID:7416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39563.exe
        7⤵
        
        PID:11440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22654.exe
        6⤵
        
        PID:8312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43257.exe
        6⤵
        
        PID:13120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16145.exe
        6⤵
        
        PID:16480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3364.exe
        6⤵
        
        PID:8688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26031.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47162.exe
        6⤵
        
        PID:6200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55399.exe
        7⤵
        
        PID:10684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36789.exe
        7⤵
        
        PID:13796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56970.exe
        7⤵
        
        PID:16696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22408.exe
        7⤵
        
        PID:5376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21646.exe
        6⤵
        
        PID:9044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60423.exe
        6⤵
        
        PID:12656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20639.exe
        6⤵
        
        PID:16120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12126.exe
        6⤵
        
        PID:952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46840.exe
        5⤵
        
        PID:5704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22823.exe
        6⤵
        
        PID:7940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53572.exe
        6⤵
        
        PID:10936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40133.exe
        6⤵
        
        PID:14024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43327.exe
        6⤵
        
        PID:16996
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 16996 -s 436
        7⤵
        Program crash
        
        PID:1996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63089.exe
        6⤵
        
        PID:3676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26084.exe
        5⤵
        
        PID:704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28487.exe
        5⤵
        
        PID:9852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27634.exe
        5⤵
        
        PID:11616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28551.exe
        5⤵
        
        PID:15836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24163.exe
        5⤵
        
        PID:6320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28195.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28195.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35783.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47817.exe
        6⤵
        
        PID:5664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12508.exe
        7⤵
        
        PID:7788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45539.exe
        7⤵
        
        PID:10960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2284.exe
        7⤵
        
        PID:14312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62498.exe
        7⤵
        
        PID:512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63903.exe
        7⤵
        
        PID:6180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49327.exe
        6⤵
        
        PID:8124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22408.exe
        6⤵
        
        PID:11068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17277.exe
        6⤵
        
        PID:14768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-439.exe
        6⤵
        
        PID:1740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42341.exe
        5⤵
        
        PID:5780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7635.exe
        6⤵
        
        PID:7720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59575.exe
        6⤵
        
        PID:10356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34024.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:13528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-885.exe
        6⤵
        
        PID:16660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56138.exe
        6⤵
        
        PID:7112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22439.exe
        5⤵
        
        PID:7536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10209.exe
        5⤵
        
        PID:8860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31004.exe
        5⤵
        
        PID:13328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16145.exe
        5⤵
        
        PID:16400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35269.exe
        5⤵
        
        PID:17396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21484.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21484.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36634.exe
        5⤵
        
        PID:5488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21004.exe
        6⤵
        
        PID:6576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11351.exe
        7⤵
        
        PID:10584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14231.exe
        7⤵
        
        PID:13732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56970.exe
        7⤵
        
        PID:16792
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 16792 -s 436
        8⤵
        Program crash
        
        PID:6140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6514.exe
        6⤵
        
        PID:956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51355.exe
        6⤵
        
        PID:12940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52254.exe
        6⤵
        
        PID:16356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33963.exe
        6⤵
        
        PID:15948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30686.exe
        5⤵
        
        PID:6616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46555.exe
        5⤵
        
        PID:10040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25124.exe
        5⤵
        
        PID:12720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4201.exe
        5⤵
        
        PID:2508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23702.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23702.exe
      4⤵
      PID:6388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53759.exe
        5⤵
        
        PID:7364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60723.exe
        5⤵
        
        PID:9868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35943.exe
        5⤵
        
        PID:2152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41346.exe
        5⤵
        
        PID:16436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15304.exe
        5⤵
        
        PID:8740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35667.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35667.exe
      4⤵
      PID:7340
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25401.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25401.exe
      4⤵
      PID:11260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56464.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56464.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:13276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6200.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6200.exe
      4⤵
      PID:17328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15727.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15727.exe
      4⤵
      PID:14384
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21956.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21956.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2705.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2705.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:4752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24299.exe
        5⤵
        
        PID:1532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53930.exe
        6⤵
        
        PID:6008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28186.exe
        7⤵
        
        PID:5380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14584.exe
        8⤵
        
        PID:14548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21857.exe
        8⤵
        
        PID:1064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40302.exe
        7⤵
        
        PID:9228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62585.exe
        7⤵
        
        PID:4284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3136.exe
        7⤵
        
        PID:15800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41947.exe
        7⤵
        
        PID:5636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64895.exe
        6⤵
        
        PID:5112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1028.exe
        6⤵
        
        PID:9800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20593.exe
        6⤵
        
        PID:12668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32535.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60515.exe
        5⤵
        
        PID:5400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47402.exe
        6⤵
        
        PID:8720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26846.exe
        6⤵
        
        PID:12184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12180.exe
        6⤵
        
        PID:14304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53235.exe
        6⤵
        
        PID:2312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40953.exe
        6⤵
        
        PID:5356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13560.exe
        5⤵
        
        PID:8620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2399.exe
        5⤵
        
        PID:12100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44191.exe
        5⤵
        
        PID:14420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55681.exe
        5⤵
        
        PID:5912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48164.exe
        5⤵
        
        PID:5548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14084.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14084.exe
      4⤵
      PID:688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20189.exe
        5⤵
        
        PID:5448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16043.exe
        6⤵
        
        PID:5744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48772.exe
        6⤵
        
        PID:9684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35018.exe
        6⤵
        
        PID:852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36686.exe
        6⤵
        
        PID:15988
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 15988 -s 436
        7⤵
        Program crash
        
        PID:1148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33963.exe
        6⤵
        
        PID:17308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7059.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51367.exe
        6⤵
        
        PID:14604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43753.exe
        6⤵
        
        PID:5480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31671.exe
        5⤵
        
        PID:3588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-553.exe
        5⤵
        
        PID:13552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8901.exe
        5⤵
        
        PID:17404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4272.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4272.exe
      4⤵
      PID:6108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35451.exe
        5⤵
        
        PID:7344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8673.exe
        5⤵
        
        PID:11036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64505.exe
        5⤵
        
        PID:14780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25155.exe
        5⤵
        
        PID:1316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26712.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26712.exe
      4⤵
      PID:8448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62772.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62772.exe
      4⤵
      PID:11796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23724.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23724.exe
      4⤵
      PID:15280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23895.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23895.exe
      4⤵
      PID:6568
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8901.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8901.exe
    3⤵
    - Executes dropped EXE
    PID:3916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13224.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13224.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19229.exe
        5⤵
        
        PID:5460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6696.exe
        6⤵
        
        PID:7172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40302.exe
        6⤵
        
        PID:6300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9218.exe
        6⤵
        
        PID:4976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60247.exe
        6⤵
        
        PID:17388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20847.exe
        5⤵
        
        PID:8092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60535.exe
        5⤵
        
        PID:11112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63572.exe
        5⤵
        
        PID:14264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32535.exe
        5⤵
        
        PID:17280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32035.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32035.exe
      4⤵
      PID:5588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1334.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48419.exe
        5⤵
        
        PID:10884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40133.exe
        5⤵
        
        PID:13988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43327.exe
        5⤵
        
        PID:16988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18740.exe
        5⤵
        
        PID:3556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58729.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58729.exe
      4⤵
      PID:7084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25923.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25923.exe
      4⤵
      PID:9488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27750.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27750.exe
      4⤵
      PID:13144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37551.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37551.exe
      4⤵
      PID:15492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30458.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30458.exe
      4⤵
      PID:16476
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53495.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53495.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45871.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45871.exe
      4⤵
      PID:5512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44055.exe
        5⤵
        
        PID:6260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8528.exe
        6⤵
        
        PID:10088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-526.exe
        6⤵
        
        PID:4404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35481.exe
        6⤵
        
        PID:16416
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 16416 -s 464
        7⤵
        Program crash
        
        PID:5908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50612.exe
        6⤵
        
        PID:6068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2046.exe
        5⤵
        
        PID:8872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63223.exe
        5⤵
        
        PID:12684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45840.exe
        5⤵
        
        PID:16072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31825.exe
        5⤵
        
        PID:5684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49078.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49078.exe
      4⤵
      PID:7004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-329.exe
        5⤵
        
        PID:13336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1647.exe
        5⤵
        
        PID:3228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8558.exe
        5⤵
        
        PID:5264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41458.exe
        5⤵
        
        PID:7696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2652.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2652.exe
      4⤵
      PID:9472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52944.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52944.exe
      4⤵
      PID:13084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15384.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15384.exe
      4⤵
      PID:2060
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43840.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43840.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62119.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62119.exe
      4⤵
      PID:6812
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6812 -s 464
        5⤵
        Program crash
        
        PID:6140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40302.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40302.exe
      4⤵
      PID:8296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9218.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9218.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:13612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26313.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26313.exe
      4⤵
      PID:5088
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10823.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10823.exe
    3⤵
    PID:8164
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36734.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36734.exe
    3⤵
    PID:11100
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28571.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28571.exe
    3⤵
    PID:14240
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10400.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10400.exe
    3⤵
    PID:17248
- C:\Users\Admin\AppData\Local\Temp\Unicorn-9617.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-9617.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:224
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64075.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64075.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48699.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48699.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38139.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1273.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34029.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23697.exe
        8⤵
        
        PID:6060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32030.exe
        9⤵
        
        PID:7452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35839.exe
        9⤵
        
        PID:11180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38580.exe
        9⤵
        
        PID:11928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13464.exe
        9⤵
        
        PID:14512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23468.exe
        9⤵
        
        PID:7096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19010.exe
        8⤵
        
        PID:7596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14650.exe
        8⤵
        
        PID:10280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19825.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:13456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32680.exe
        8⤵
        
        PID:16452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55920.exe
        8⤵
        
        PID:7244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48948.exe
        7⤵
        
        PID:6120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43754.exe
        8⤵
        
        PID:6696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35095.exe
        9⤵
        
        PID:748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17552.exe
        8⤵
        
        PID:9844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8952.exe
        8⤵
        
        PID:12460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2944.exe
        8⤵
        
        PID:16024
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 16024 -s 464
        9⤵
        Program crash
        
        PID:15620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62744.exe
        8⤵
        
        PID:6856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-566.exe
        7⤵
        
        PID:7192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30246.exe
        7⤵
        
        PID:8704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59785.exe
        7⤵
        
        PID:4368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43472.exe
        7⤵
        
        PID:15788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34309.exe
        7⤵
        
        PID:11400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40805.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21559.exe
        7⤵
        
        PID:5196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7635.exe
        8⤵
        
        PID:7732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59575.exe
        8⤵
        
        PID:10376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56582.exe
        8⤵
        
        PID:13604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54170.exe
        8⤵
        
        PID:16760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3045.exe
        8⤵
        
        PID:6428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63058.exe
        7⤵
        
        PID:7456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16788.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:10236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51922.exe
        7⤵
        
        PID:12432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32680.exe
        7⤵
        
        PID:4188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63259.exe
        6⤵
        
        PID:5832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28186.exe
        7⤵
        
        PID:6196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6136.exe
        8⤵
        
        PID:6092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4753.exe
        8⤵
        
        PID:2432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40302.exe
        7⤵
        
        PID:9104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9218.exe
        7⤵
        
        PID:13560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60247.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:16392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60977.exe
        6⤵
        
        PID:7620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30132.exe
        6⤵
        
        PID:10328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8823.exe
        6⤵
        
        PID:13544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49547.exe
        6⤵
        
        PID:16616
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 16616 -s 464
        7⤵
        Program crash
        
        PID:6088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56182.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14184.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61283.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34185.exe
        8⤵
        
        PID:11188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23935.exe
        8⤵
        
        PID:14428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61293.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:2160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12869.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18604.exe
        7⤵
        
        PID:8332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24657.exe
        7⤵
        
        PID:12272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34652.exe
        7⤵
        
        PID:15668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49907.exe
        7⤵
        
        PID:6052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54537.exe
        7⤵
        
        PID:5160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50209.exe
        6⤵
        
        PID:6128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23692.exe
        7⤵
        
        PID:7852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58367.exe
        7⤵
        
        PID:9920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64121.exe
        7⤵
        
        PID:14408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8720.exe
        7⤵
        
        PID:1564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51002.exe
        6⤵
        
        PID:8432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22436.exe
        6⤵
        
        PID:11784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23194.exe
        6⤵
        
        PID:15308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28128.exe
        6⤵
        
        PID:16640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61339.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9306.exe
        6⤵
        
        PID:5248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60557.exe
        7⤵
        
        PID:7440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3053.exe
        7⤵
        
        PID:10192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46057.exe
        7⤵
        
        PID:12692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41346.exe
        7⤵
        
        PID:3500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19964.exe
        7⤵
        
        PID:5716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40888.exe
        6⤵
        
        PID:8384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32742.exe
        6⤵
        
        PID:11716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30485.exe
        6⤵
        
        PID:15248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20946.exe
        6⤵
        
        PID:5608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48320.exe
        5⤵
        
        PID:5500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25337.exe
        6⤵
        
        PID:8516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45622.exe
        6⤵
        
        PID:11976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12180.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:14832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53235.exe
        6⤵
        
        PID:1992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48929.exe
        6⤵
        
        PID:7836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26712.exe
        5⤵
        
        PID:8460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42095.exe
        5⤵
        
        PID:12236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20559.exe
        5⤵
        
        PID:15956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23426.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23426.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:3520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33069.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14184.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:60
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61283.exe
        7⤵
        
        PID:6892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16505.exe
        8⤵
        
        PID:10596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14231.exe
        8⤵
        
        PID:13720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56970.exe
        8⤵
        
        PID:16768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10347.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:7060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18604.exe
        7⤵
        
        PID:8344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24657.exe
        7⤵
        
        PID:11596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34652.exe
        7⤵
        
        PID:15628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54537.exe
        7⤵
        
        PID:548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28719.exe
        6⤵
        
        PID:5992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26920.exe
        7⤵
        
        PID:10136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56478.exe
        7⤵
        
        PID:12984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45595.exe
        7⤵
        
        PID:3076
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3076 -s 452
        8⤵
        Program crash
        
        PID:2776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12180.exe
        7⤵
        
        PID:5916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13560.exe
        6⤵
        
        PID:8612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2399.exe
        6⤵
        
        PID:12120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9380.exe
        6⤵
        
        PID:1608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28034.exe
        6⤵
        
        PID:2468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8694.exe
        6⤵
        
        PID:6832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51688.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24273.exe
        6⤵
        
        PID:5456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44797.exe
        7⤵
        
        PID:8132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52830.exe
        7⤵
        
        PID:11248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14728.exe
        7⤵
        
        PID:14316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41201.exe
        7⤵
        
        PID:17312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4018.exe
        6⤵
        
        PID:7384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9964.exe
        6⤵
        
        PID:11520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37506.exe
        6⤵
        
        PID:14996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12778.exe
        6⤵
        
        PID:6944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16004.exe
        5⤵
        
        PID:5700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24185.exe
        6⤵
        
        PID:7520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52638.exe
        6⤵
        
        PID:10604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26788.exe
        6⤵
        
        PID:14088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62498.exe
        6⤵
        
        PID:3548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28772.exe
        5⤵
        
        PID:8196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41975.exe
        5⤵
        
        PID:11456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16581.exe
        5⤵
        
        PID:14952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-969.exe
        5⤵
        
        PID:16776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53581.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53581.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1932.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14459.exe
        6⤵
        
        PID:1220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16043.exe
        7⤵
        
        PID:6292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59654.exe
        7⤵
        
        PID:9872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35595.exe
        7⤵
        
        PID:12500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51953.exe
        7⤵
        
        PID:16352
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 16352 -s 424
        8⤵
        Program crash
        
        PID:2528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8389.exe
        7⤵
        
        PID:5792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24464.exe
        6⤵
        
        PID:3604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62031.exe
        7⤵
        
        PID:16780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50446.exe
        7⤵
        
        PID:15432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31671.exe
        6⤵
        
        PID:9080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2913.exe
        6⤵
        
        PID:11680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60008.exe
        6⤵
        
        PID:16064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13159.exe
        6⤵
        
        PID:3400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2269.exe
        5⤵
        
        PID:5692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14070.exe
        6⤵
        
        PID:8104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46800.exe
        6⤵
        
        PID:11156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57707.exe
        6⤵
        
        PID:14280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41201.exe
        6⤵
        
        PID:17256
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 17256 -s 436
        7⤵
        Program crash
        
        PID:1996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22906.exe
        5⤵
        
        PID:8204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11553.exe
        5⤵
        
        PID:11472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33116.exe
        5⤵
        
        PID:14964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49440.exe
        5⤵
        
        PID:16944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4734.exe
        5⤵
        
        PID:6728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63120.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63120.exe
      4⤵
      Suspicious use of SetWindowsHookEx
      PID:4340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54423.exe
        5⤵
        
        PID:6076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26349.exe
        6⤵
        
        PID:6396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61600.exe
        6⤵
        
        PID:9892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48798.exe
        6⤵
        
        PID:14008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59863.exe
        6⤵
        
        PID:17020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27933.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19503.exe
        5⤵
        
        PID:7308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3768.exe
        5⤵
        
        PID:9772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9135.exe
        5⤵
        
        PID:10396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60008.exe
        5⤵
        
        PID:15884
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 15884 -s 424
        6⤵
        Program crash
        
        PID:6020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43885.exe
        5⤵
        
        PID:5116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33240.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33240.exe
      4⤵
      PID:6100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12508.exe
        5⤵
        
        PID:7556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35232.exe
        5⤵
        
        PID:10636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26788.exe
        5⤵
        
        PID:14056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62498.exe
        5⤵
        
        PID:17384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26129.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26129.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52811.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52811.exe
      4⤵
      PID:11292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58109.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58109.exe
      4⤵
      PID:14920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17045.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17045.exe
      4⤵
      PID:16972
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7344.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7344.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33863.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33863.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27807.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47241.exe
        6⤵
        
        PID:1732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5113.exe
        7⤵
        
        PID:6012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30013.exe
        8⤵
        
        PID:13824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43234.exe
        8⤵
        
        PID:16724
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 16724 -s 464
        9⤵
        Program crash
        
        PID:6112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56013.exe
        8⤵
        
        PID:14580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12574.exe
        7⤵
        
        PID:9072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26110.exe
        7⤵
        
        PID:12708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37174.exe
        7⤵
        
        PID:16128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16410.exe
        7⤵
        
        PID:4396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39409.exe
        6⤵
        
        PID:6212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13961.exe
        7⤵
        
        PID:7932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52721.exe
        7⤵
        
        PID:9864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16373.exe
        7⤵
        
        PID:14872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13350.exe
        7⤵
        
        PID:2780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44999.exe
        7⤵
        
        PID:5884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19206.exe
        6⤵
        
        PID:8508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65222.exe
        6⤵
        
        PID:12004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9380.exe
        6⤵
        
        PID:14588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28034.exe
        6⤵
        
        PID:5376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41483.exe
        6⤵
        
        PID:6164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44272.exe
        6⤵
        
        PID:5652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54018.exe
        5⤵
        
        PID:2636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38579.exe
        6⤵
        
        PID:6340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-614.exe
        7⤵
        
        PID:9544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16815.exe
        7⤵
        
        PID:13156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56887.exe
        7⤵
        
        PID:15536
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 15536 -s 440
        8⤵
        Program crash
        
        PID:2468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54963.exe
        7⤵
        
        PID:5584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53607.exe
        6⤵
        
        PID:9108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17749.exe
        6⤵
        
        PID:12880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9655.exe
        6⤵
        
        PID:14436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28693.exe
        6⤵
        
        PID:5316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4158.exe
        6⤵
        
        PID:5312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2958.exe
        5⤵
        
        PID:6864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49919.exe
        6⤵
        
        PID:12212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23717.exe
        6⤵
        
        PID:15660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58704.exe
        5⤵
        
        PID:9164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15415.exe
        5⤵
        
        PID:7848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1205.exe
        5⤵
        
        PID:14948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36439.exe
        5⤵
        
        PID:4804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63826.exe
        5⤵
        
        PID:1700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26223.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26223.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28767.exe
        5⤵
        
        PID:3396
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3396 -s 488
        6⤵
        Program crash
        
        PID:6332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1221.exe
        5⤵
        
        PID:7228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52218.exe
        6⤵
        
        PID:876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48831.exe
        6⤵
        
        PID:6096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20296.exe
        5⤵
        
        PID:9444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13219.exe
        5⤵
        
        PID:12784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60008.exe
        5⤵
        
        PID:924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37471.exe
        5⤵
        
        PID:5644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31380.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31380.exe
      4⤵
      PID:5132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37293.exe
        5⤵
        
        PID:6528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39836.exe
        6⤵
        
        PID:8036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2752.exe
        6⤵
        
        PID:11060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20182.exe
        6⤵
        
        PID:14188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41201.exe
        6⤵
        
        PID:17236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60894.exe
        5⤵
        
        PID:8252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4318.exe
        5⤵
        
        PID:11624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41590.exe
        5⤵
        
        PID:15200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22312.exe
        5⤵
        
        PID:1984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57391.exe
        5⤵
        
        PID:4804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20494.exe
        5⤵
        
        PID:6652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27646.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27646.exe
      4⤵
      PID:5544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59265.exe
        5⤵
        
        PID:10980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63214.exe
        5⤵
        
        PID:14756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3239.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1340
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1798.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1798.exe
      4⤵
      PID:8608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58579.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58579.exe
      4⤵
      PID:12520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4264.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4264.exe
      4⤵
      PID:15908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46119.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46119.exe
      4⤵
      PID:6416
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19564.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19564.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51242.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51242.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22929.exe
        5⤵
        
        PID:5280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57521.exe
        6⤵
        
        PID:6688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14070.exe
        7⤵
        
        PID:8068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46800.exe
        7⤵
        
        PID:11216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14728.exe
        7⤵
        
        PID:14328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41201.exe
        7⤵
        
        PID:17228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8787.exe
        6⤵
        
        PID:7284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65387.exe
        6⤵
        
        PID:10896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17277.exe
        6⤵
        
        PID:14816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-439.exe
        6⤵
        
        PID:4868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49955.exe
        5⤵
        
        PID:5180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3868.exe
        6⤵
        
        PID:9364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48850.exe
        6⤵
        
        PID:4876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62808.exe
        6⤵
        
        PID:16108
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 16108 -s 452
        7⤵
        Program crash
        
        PID:3164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23970.exe
        6⤵
        
        PID:11408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15781.exe
        5⤵
        
        PID:8928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34278.exe
        5⤵
        
        PID:12748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37174.exe
        5⤵
        
        PID:16056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38393.exe
        5⤵
        
        PID:14376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43026.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43026.exe
      4⤵
      PID:5304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37101.exe
        5⤵
        
        PID:6776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11351.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14231.exe
        6⤵
        
        PID:13712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56970.exe
        6⤵
        
        PID:16712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28797.exe
        5⤵
        
        PID:9116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7032.exe
        5⤵
        
        PID:11768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32628.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20110.exe
        5⤵
        
        PID:5856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4712.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4712.exe
      4⤵
      PID:7016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35119.exe
        5⤵
        
        PID:12296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43727.exe
        5⤵
        
        PID:15952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38901.exe
        5⤵
        
        PID:5476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9010.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9010.exe
      4⤵
      PID:4716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25228.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25228.exe
      4⤵
      PID:11584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18117.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18117.exe
      4⤵
      PID:15648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9111.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9111.exe
      4⤵
      PID:4944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51672.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51672.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3380
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12959.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12959.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27157.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27157.exe
      4⤵
      PID:6284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31367.exe
        5⤵
        
        PID:7516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8673.exe
        5⤵
        
        PID:11048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11412.exe
        5⤵
        
        PID:14792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26333.exe
        5⤵
        
        PID:5200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50509.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50509.exe
      4⤵
      PID:8744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46447.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46447.exe
      4⤵
      PID:12168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9380.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9380.exe
      4⤵
      PID:7980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39537.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39537.exe
      4⤵
      PID:5576
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44040.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44040.exe
    3⤵
    PID:5720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62887.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62887.exe
      4⤵
      PID:7896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18508.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58336.exe
        5⤵
        
        PID:15828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51071.exe
        5⤵
        
        PID:16404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56530.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56530.exe
      4⤵
      PID:10796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40987.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40987.exe
      4⤵
      PID:13952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1922.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1922.exe
      4⤵
      PID:16952
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 16952 -s 464
        5⤵
        Program crash
        
        PID:3172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44469.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44469.exe
      4⤵
      PID:2204
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48879.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48879.exe
    3⤵
    PID:8160
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20138.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20138.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:11164
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53148.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53148.exe
    3⤵
    PID:14856
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39640.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39640.exe
    3⤵
    PID:3640
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47605.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47605.exe
    3⤵
    PID:6316
- C:\Users\Admin\AppData\Local\Temp\Unicorn-53861.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-53861.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:100
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53852.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53852.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21419.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21419.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29753.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47625.exe
        6⤵
        
        PID:5188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31263.exe
        7⤵
        
        PID:6444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24185.exe
        8⤵
        
        PID:7468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52638.exe
        8⤵
        
        PID:10648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26788.exe
        8⤵
        
        PID:14000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1237.exe
        8⤵
        
        PID:17132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65362.exe
        7⤵
        
        PID:8628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62071.exe
        7⤵
        
        PID:12128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52856.exe
        7⤵
        
        PID:14400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39225.exe
        7⤵
        
        PID:2780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8626.exe
        7⤵
        
        PID:7672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49955.exe
        6⤵
        
        PID:5728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17242.exe
        7⤵
        
        PID:14524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28630.exe
        7⤵
        
        PID:7336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63913.exe
        6⤵
        
        PID:8832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11719.exe
        6⤵
        
        PID:12644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37174.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:16044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11589.exe
        6⤵
        
        PID:1840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38393.exe
        6⤵
        
        PID:11436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32912.exe
        5⤵
        
        PID:5236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26650.exe
        6⤵
        
        PID:6280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5513.exe
        7⤵
        
        PID:9396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37671.exe
        7⤵
        
        PID:14492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8720.exe
        7⤵
        
        PID:1156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2046.exe
        6⤵
        
        PID:8968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5854.exe
        6⤵
        
        PID:12632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45840.exe
        6⤵
        
        PID:16084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15873.exe
        6⤵
        
        PID:7796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58729.exe
        5⤵
        
        PID:6952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32893.exe
        6⤵
        
        PID:14568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24973.exe
        6⤵
        
        PID:5792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15801.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8517.exe
        5⤵
        
        PID:9464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44279.exe
        5⤵
        
        PID:13168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37551.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:15404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25448.exe
        5⤵
        
        PID:1164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58854.exe
        5⤵
        
        PID:1272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15917.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15917.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3084.exe
        5⤵
        
        PID:5412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54506.exe
        6⤵
        
        PID:6764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37226.exe
        7⤵
        
        PID:10196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31973.exe
        7⤵
        
        PID:13152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36166.exe
        7⤵
        
        PID:15436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60593.exe
        6⤵
        
        PID:9144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39705.exe
        6⤵
        
        PID:6648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26406.exe
        6⤵
        
        PID:14836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12466.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49561.exe
        6⤵
        
        PID:1708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54880.exe
        6⤵
        
        PID:1476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35481.exe
        6⤵
        
        PID:16428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53134.exe
        6⤵
        
        PID:3912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57307.exe
        5⤵
        
        PID:1568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62482.exe
        5⤵
        
        PID:2800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41560.exe
        5⤵
        
        PID:15792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54537.exe
        5⤵
        
        PID:5860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62299.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62299.exe
      4⤵
      PID:5536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16043.exe
        5⤵
        
        PID:5368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59654.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7957.exe
        5⤵
        
        PID:13924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10662.exe
        5⤵
        
        PID:16972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61182.exe
        5⤵
        
        PID:384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64376.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64376.exe
      4⤵
      PID:7388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61051.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61051.exe
      4⤵
      PID:10128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30805.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30805.exe
      4⤵
      PID:12136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33211.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33211.exe
      4⤵
      PID:3112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51454.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51454.exe
      4⤵
      PID:6624
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54838.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54838.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23339.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23339.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-515.exe
        5⤵
        
        PID:6252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8808.exe
        6⤵
        
        PID:7832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8673.exe
        6⤵
        
        PID:10932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11412.exe
        6⤵
        
        PID:14824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36669.exe
        6⤵
        
        PID:3960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18439.exe
        5⤵
        
        PID:9064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17444.exe
        5⤵
        
        PID:12700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20639.exe
        5⤵
        
        PID:16028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51454.exe
        5⤵
        
        PID:1044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33104.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33104.exe
      4⤵
      PID:5756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28186.exe
        5⤵
        
        PID:6608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10645.exe
        5⤵
        
        PID:9432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32654.exe
        5⤵
        
        PID:14016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58109.exe
        5⤵
        
        PID:17124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13093.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13093.exe
      4⤵
      PID:8188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6893.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6893.exe
      4⤵
      PID:9948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11928.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11928.exe
      4⤵
      PID:13020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16000.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16000.exe
      4⤵
      PID:17304
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39767.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39767.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20298.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20298.exe
      4⤵
      PID:5552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64733.exe
        5⤵
        
        PID:7964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53572.exe
        5⤵
        
        PID:10944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40133.exe
        5⤵
        
        PID:14036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4241.exe
        5⤵
        
        PID:17040
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 17040 -s 460
        6⤵
        Program crash
        
        PID:6400
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39840.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39840.exe
      4⤵
      PID:6964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2652.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2652.exe
      4⤵
      PID:9456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36416.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36416.exe
      4⤵
      PID:13108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15384.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15384.exe
      4⤵
      PID:2540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51989.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51989.exe
      4⤵
      PID:17012
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3504.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3504.exe
    3⤵
    PID:5628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28186.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28186.exe
      4⤵
      PID:2552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40302.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40302.exe
      4⤵
      PID:9332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9218.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9218.exe
      4⤵
      PID:13664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21160.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21160.exe
      4⤵
      PID:17376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48737.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48737.exe
      4⤵
      PID:17008
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3303.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3303.exe
    3⤵
    PID:7576
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60852.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60852.exe
    3⤵
    PID:10272
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11690.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11690.exe
    3⤵
    PID:13448
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11680.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11680.exe
    3⤵
    PID:16464
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 16464 -s 460
      4⤵
      Program crash
      PID:5800
- C:\Users\Admin\AppData\Local\Temp\Unicorn-31906.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-31906.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1000
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38824.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38824.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52119.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52119.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62015.exe
        5⤵
        
        PID:5252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8896.exe
        6⤵
        
        PID:6916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32218.exe
        7⤵
        
        PID:8708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64179.exe
        7⤵
        
        PID:12580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39975.exe
        7⤵
        
        PID:16016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6831.exe
        7⤵
        
        PID:14812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58667.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:16052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4869.exe
        6⤵
        
        PID:8064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43789.exe
        6⤵
        
        PID:12032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49841.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:15464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51060.exe
        6⤵
        
        PID:4576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6784.exe
        5⤵
        
        PID:5808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1216.exe
        6⤵
        
        PID:8836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58450.exe
        6⤵
        
        PID:12224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46991.exe
        6⤵
        
        PID:14468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43885.exe
        6⤵
        
        PID:15428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36887.exe
        5⤵
        
        PID:8316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1522.exe
        5⤵
        
        PID:12192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41176.exe
        5⤵
        
        PID:15480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44464.exe
        5⤵
        
        PID:16468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21537.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21537.exe
      4⤵
      PID:5320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37293.exe
        5⤵
        
        PID:6536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19307.exe
        6⤵
        
        PID:8372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13141.exe
        6⤵
        
        PID:11708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60805.exe
        6⤵
        
        PID:15260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25411.exe
        6⤵
        
        PID:6436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63800.exe
        5⤵
        
        PID:8924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59144.exe
        5⤵
        
        PID:8260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57220.exe
        5⤵
        
        PID:12948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8778.exe
        5⤵
        
        PID:16344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19840.exe
        5⤵
        
        PID:6620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25864.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25864.exe
      4⤵
      PID:7156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25337.exe
        5⤵
        
        PID:8524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45622.exe
        5⤵
        
        PID:11996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12180.exe
        5⤵
        
        PID:2612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53235.exe
        5⤵
        
        PID:4212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64306.exe
        5⤵
        
        PID:5732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31569.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31569.exe
      4⤵
      PID:8000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40989.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40989.exe
      4⤵
      PID:11992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24640.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24640.exe
      4⤵
      PID:15508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42829.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42829.exe
      4⤵
      PID:3428
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30804.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30804.exe
    3⤵
    PID:2056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31263.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31263.exe
      4⤵
      PID:6452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35451.exe
        5⤵
        
        PID:7432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7032.exe
        5⤵
        
        PID:11780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32628.exe
        5⤵
        
        PID:14576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35908.exe
        5⤵
        
        PID:15348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20110.exe
        5⤵
        
        PID:6876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63416.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63416.exe
      4⤵
      PID:8540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59357.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59357.exe
      4⤵
      PID:11952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22129.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22129.exe
      4⤵
      PID:14556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38615.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38615.exe
      4⤵
      PID:1548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51029.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51029.exe
      4⤵
      PID:16912
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32067.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32067.exe
    3⤵
    PID:6984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24735.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24735.exe
      4⤵
      PID:8280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30053.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30053.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:12048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43976.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43976.exe
      4⤵
      PID:15524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19463.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19463.exe
      4⤵
      PID:6168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55536.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55536.exe
      4⤵
      PID:412
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-345.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-345.exe
    3⤵
    PID:8488
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8693.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8693.exe
    3⤵
    PID:11516
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35183.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35183.exe
    3⤵
    PID:15680
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27671.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27671.exe
    3⤵
    PID:16492
- C:\Users\Admin\AppData\Local\Temp\Unicorn-56536.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-56536.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4180
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4625.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4625.exe
    3⤵
    PID:3896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5113.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5113.exe
      4⤵
      PID:5828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13961.exe
        5⤵
        
        PID:7856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52721.exe
        5⤵
        
        PID:9028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16373.exe
        5⤵
        
        PID:14880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34839.exe
        5⤵
        
        PID:5160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3582.exe
        5⤵
        
        PID:2724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36773.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36773.exe
      4⤵
      PID:8732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40582.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40582.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:12204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52856.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52856.exe
      4⤵
      PID:14460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60714.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60714.exe
      4⤵
      PID:748
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11126.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11126.exe
    3⤵
    PID:6836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36977.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36977.exe
      4⤵
      PID:14660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46463.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46463.exe
      4⤵
      PID:5596
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41299.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41299.exe
    3⤵
    PID:9180
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15415.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15415.exe
    3⤵
    PID:6660
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1205.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1205.exe
    3⤵
    PID:15028
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36439.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36439.exe
    3⤵
    PID:5680
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46337.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46337.exe
    3⤵
    PID:2280
- C:\Users\Admin\AppData\Local\Temp\Unicorn-20431.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-20431.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2296
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19229.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19229.exe
    3⤵
    PID:5468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44055.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44055.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43723.exe
        5⤵
        
        PID:10676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27552.exe
        5⤵
        
        PID:13760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56970.exe
        5⤵
        
        PID:16748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2046.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2046.exe
      4⤵
      PID:8932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5854.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5854.exe
      4⤵
      PID:12612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45840.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45840.exe
      4⤵
      PID:16092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41254.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41254.exe
      4⤵
      PID:14812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37855.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37855.exe
      4⤵
      PID:3580
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6483.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6483.exe
    3⤵
    PID:6304
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31287.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31287.exe
    3⤵
    PID:9904
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64018.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64018.exe
    3⤵
    PID:12620
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43288.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43288.exe
    3⤵
    PID:15244
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8382.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8382.exe
    3⤵
    PID:5976
- C:\Users\Admin\AppData\Local\Temp\Unicorn-60906.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-60906.exe
  2⤵
  PID:5620
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27226.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27226.exe
    3⤵
    PID:6488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16375.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16375.exe
      4⤵
      PID:8300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5056.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5056.exe
      4⤵
      PID:10664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37453.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37453.exe
      4⤵
      PID:15692
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54007.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54007.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:14436
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56400.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56400.exe
    3⤵
    PID:8644
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12377.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12377.exe
    3⤵
    PID:12512
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12399.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12399.exe
    3⤵
    PID:15976
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11596.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11596.exe
    3⤵
    PID:5352
- C:\Users\Admin\AppData\Local\Temp\Unicorn-42110.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-42110.exe
  2⤵
  PID:6332
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29655.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29655.exe
    3⤵
    PID:15868
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59984.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59984.exe
    3⤵
    PID:1164
- C:\Users\Admin\AppData\Local\Temp\Unicorn-2152.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-2152.exe
  2⤵
  PID:9824
- C:\Users\Admin\AppData\Local\Temp\Unicorn-10327.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-10327.exe
  2⤵
  PID:10988
- C:\Users\Admin\AppData\Local\Temp\Unicorn-65035.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-65035.exe
  2⤵
  PID:14076
- C:\Users\Admin\AppData\Local\Temp\Unicorn-18241.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-18241.exe
  2⤵
  PID:17136

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3396 -ip 3396
1⤵
PID:5504

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 16148 -ip 16148
1⤵
PID:3600

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 15988 -ip 15988
1⤵
PID:4576

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 16024 -ip 16024
1⤵
PID:3600

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 1176 -ip 1176
1⤵
PID:5860

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 3076 -ip 3076
1⤵
PID:3408

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 16616 -ip 16616
1⤵
PID:6036

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 16416 -ip 16416
1⤵
PID:3580

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 16704 -ip 16704
1⤵
PID:5884

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 16472 -ip 16472
1⤵
PID:5968

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 16400 -ip 16400
1⤵
PID:2776

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 16680 -ip 16680
1⤵
PID:5680

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 16760 -ip 16760
1⤵
PID:4580

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 16428 -ip 16428
1⤵
PID:5352

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 16952 -ip 16952
1⤵
PID:6036

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 660 -p 412 -ip 412
1⤵
PID:5856

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 6812 -ip 6812
1⤵
PID:4212

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 2528 -ip 2528
1⤵
PID:1148

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 688 -p 16972 -ip 16972
1⤵
PID:4672

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3252

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 17376 -ip 17376
1⤵
PID:5800

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 17256 -ip 17256
1⤵
PID:2432

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 15472 -ip 15472
1⤵
PID:5920

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 17364 -ip 17364
1⤵
PID:6408

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 16392 -ip 16392
1⤵
PID:5796

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 2368 -ip 2368
1⤵
PID:6516

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
- Suspicious behavior: AddClipboardFormatListener
PID:7912

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 17268 -ip 17268
1⤵
PID:16432

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-1237.exe

Filesize
468KB

MD5
2b70302fe5a27e405a62c738e15263f7

SHA1
861b254d9404efba16769ee1974c0c11d2b2bdbe

SHA256
229fec6296c1b73cdea98d89617d774e9cb4474497bca29ec3fb4a739423a5d1

SHA512
748e027981e5a021e7ad99fd82c327399879b3627649bc11cd99efa5d352f7618374a70309c1f5c4f01918efca197b44ce1bb0355ee14dba396be636e4f12b28

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-1273.exe

Filesize
468KB

MD5
66848a43fea139b07f489a52796acd84

SHA1
be037f617713e163c5e59f263b49ef0959c264ec

SHA256
2d37545afc257b7f627419a65137f1f31e0e86514852f0afd6973cabd8853b18

SHA512
6ccd1140f0e5b685df7d709ea6dfa7d4538213c1bad2f4d2a4a1f7ff082083e34e690c79f0c6d3ad811c0fe73a6bed9214edcdda5f4f8286f7b48b2f609206e7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-19564.exe

Filesize
468KB

MD5
3f7806544a7e72454c14ca4537ddb1dd

SHA1
22669788b005bf6eaa4ea2d5954ed456da5961f1

SHA256
e08fa80542119464d92702af5d4cc081dd9f1c5ea27994664aa31d3925e4db00

SHA512
3f538c422a000fcd5624ea385c247c5d427686e65d61030b91603906456e98d857203cbb4b50b43a15f6aa96a21e2b9e69776bae5117895f5607053fb94a360c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-2064.exe

Filesize
468KB

MD5
8b8bc7f8b0afbfaca94be76a4f456e68

SHA1
f85bf6aa1e3334dd263f41957f582abeb7a34a25

SHA256
5eb25418ccd01735c9a26b895d349a9e5ee4895263abdf12410bde7623c1c95a

SHA512
5142cc82614c412040c0cc7827297d609d55f5324339b6cd49f8dc5344c426319f6262e141e850995dc59dc962d534f9183287f8ccd671490a4d5f9815399e1a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-21419.exe

Filesize
468KB

MD5
c90b037a056c508cfe6a83c16352c32b

SHA1
e804b57de9532b029b81f7bbf4f300717c1a272a

SHA256
7dcfb1de8ed0f2c39ce31aa0953452afccca7d2447497f0e10ecab3737e8eb54

SHA512
ba77a9babb9fc736daf747218018dc6409ee33bf3b507ea98720a8a0dc998c0338c5e1ce70d95410e873939d7a8acc900400834c845a58f114ecbfce1d265399

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-21956.exe

Filesize
468KB

MD5
b90a6242a945e841be7003ae07c3ff21

SHA1
2a09127941e27e1a7832bedb353263c64b3dc218

SHA256
5699eaaccb1005b124d44eb9e44b243e31ff163daaaddf6e4825a4ff97507a0c

SHA512
5192d42cddfed0101528ab05cbbb1e02d34e38881bdefce801b521475f164c78a4bc8b8886ad170018fe60cd6804ed24b3f15883c15c99433b9bb31504450be5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-22720.exe

Filesize
468KB

MD5
85ae44d84ed31f7c69db33e7731ae060

SHA1
f16d1a1981b947018888c6b5d1366f99d97d70a2

SHA256
e825f31d7a717a866848bdb8e6623f1f08a4cc2d228c8341d11c5f1ef3baf638

SHA512
a448ba51baf88d016b8fb83eb72e0c9f4d13f49e741178275af9c2b0ea8fd0cd8df289ad39778b67ce4524ddc96fc079dff6c4a5807c35981e2d73da6e7ac74f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-23426.exe

Filesize
468KB

MD5
93eca2b517c8a2c12d50f5d348c47505

SHA1
3e06bf4cd01aa03d8cbb73aeddcbfe40bfd8e2c2

SHA256
d18bdb316c2dc2aa7d811a221c36149a1e92675f167d97b129d378f84a4cda76

SHA512
6df51a3936072d4b23923c3550bb1f80dc988062dc9795cbfe97d7ec72ac23f34fe0657bfc485aabda7fe59c933365f2f03bdfbb3129244fd402c33a2c01e68a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-25695.exe

Filesize
468KB

MD5
d0ddf2e533cd9c7ccce94e0fb689a7ec

SHA1
171b87e958081c5e88cb77acc832bed32efdbf69

SHA256
ed00d2729e9bd993f53d6ce3e29a05a90589e9aa7eafa8cc812c8c1c89b8659c

SHA512
9aa4aeff211790b8682ac0744c339465210f1221e79792a943195d7e0c75d95be2ac921f0e0a0d0e65b524f018565ebeb3975ca648d0854e6aea8cab5e1da0a8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-28195.exe

Filesize
468KB

MD5
93754d36a4ea36828ddebf3a911d883a

SHA1
51eaff48a2bf97c4d61335cd3919b67a4b1e6b1b

SHA256
2fd855fb97f0ba2e35cf10e4395419e680588d24b40c0f62e3afd7177c28a541

SHA512
bb3840cc453ec24951733e77e8e4c0a6c9fd395d51d05749a9cf7d23a73cd949c1def2cb2fa89e6322707573e91c4a462e6c894afe3c587770115320a0766a22

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-29483.exe

Filesize
468KB

MD5
402cb0f61868b9e52f5b2c314fdc324e

SHA1
0ac911d8312e47f8d6c8c09a39e90dfb250f23b5

SHA256
44ef44d64c2870b74b1abaaea61e872e339b4f0756febf8ab4b7cfd667745b26

SHA512
f636d72803cc751c3f25d3f1c7d3f9d6d8d924758d44e174ed35fb2d4816471549ec628f2bdb49faf0674b9506112a04fbcd54658954909296fa2f0c26171662

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-3036.exe

Filesize
468KB

MD5
7f8dcf9dc36fb0dde54de0167951de22

SHA1
173133998331807c9a16f1d217ddd309903f350c

SHA256
114353ee78ab851ce82be23492c74208203039083a1558c6235a4a6285f45cd4

SHA512
d1a7eb14303e20351882c84b46e2af95346c68861dacc9b0cfe6aabe868305f30fccdc197bfb4d01887d4698da7db9854283ac97daf1512934a53acd2acf1235

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-31906.exe

Filesize
468KB

MD5
7bfe5ec1b9e1ccbbe7320a86cee14f7d

SHA1
0073baf0471c5779c5d544efd09baf91ee2f479d

SHA256
9a83c0304e890261bbd8d7c2943b05c6a50852d22082d8591039ae5e61eaf704

SHA512
03b756503b4d8ad495ce8feeb2a5a1c275bba522fa6a29653304809422e86d20551aa78c7edac24bb89fd2e0bfea08b530b022f6363a03ed727f2d1096879291

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-33069.exe

Filesize
468KB

MD5
2c4d2146d93fab7c08862e81b741c81c

SHA1
2af1376046a4fb426a96c2f766e3178ff180e349

SHA256
d4eb2a75b875d9d626d98abd6c2a9b5bf6c4246bf620553a30ad4c68d6b2b836

SHA512
5372a15a4786fa6741e9830492613ca7d3db0aea87e69b5fb6d793a8a7dbcd649f7cf1f4e04cf9df76f317790f6c960355a3ce5046c0af8e4331a40b6b02c6aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-33863.exe

Filesize
468KB

MD5
7b3cf3e53b7a58250e671a82c349ed6a

SHA1
8485a6e65446754e779d7d0fd36e9b0b180969a1

SHA256
f7bc3a5010a434ec6484c68e87ca4b695f18c2f059fcd8aef1e38d4834ec048a

SHA512
4e5fe1b07c104eeb735a98e3558dcfb037651e14c94ab3bd3486cb4029b46c892e0f9cc915ace44bc5f397f53746d5ae8d349934a5f885904d593ee840e19448

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-33986.exe

Filesize
468KB

MD5
83a00883853995e52b33988640e6c755

SHA1
d006a87733326adefb3d84e8d77ba8ab49a8ff04

SHA256
da41810bc7d978b9490e1199cc09eaa99bba46c75fc9e472657aababdafcc1c2

SHA512
28b262266ea8c0f6478e1ffe1ed8147d75f5bbb9dd644abc2a18154c5ef3f6dbb0e3e9fd55f72cc6a33593afe6d00cadace0714689b2d756add79d9f1fcd8c54

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-38139.exe

Filesize
468KB

MD5
7271d78b598ae6910d9688f7515d835c

SHA1
09c236ac3cafdb44682318ebcbdf8afbbfcb16ea

SHA256
c4d5c4bc7a25a0a0cd79149e13c9384b47c8d58331092e8311e493782887eec8

SHA512
4e1d9fe643e615ee7a15787f3ca1ccd6d222d3c141b77a0619b9d192f123021c65ba7679cd768b1ad3782b15d389e98ef5994916fcdc24090e9fef84c0011cc5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-38824.exe

Filesize
468KB

MD5
76a03ca34c8015145235ada4f16a7533

SHA1
c60bf52bd0d73c3179e9a7abdec35b188a37423b

SHA256
0a48477046f55e04e0835ddfb364788f706c1dff9e72cd504a57df17ad20afe1

SHA512
2b7422662dde40574fd43ea8a7fbae5a7c3b1bd02280cbf8ccbec6c6bfb123ea08cfd9ac75bcbe14c519c897391252c02a5422eff6ea0c978c67bd59da2d47e1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-439.exe

Filesize
468KB

MD5
964c22b4b0722cec43fd27bf93f7fc3b

SHA1
c42bd2e506c5488211fe0d309b1022d3e57845d4

SHA256
b3af4ef8b0aeca6be7fe42f44361d16ca6bc62cfdad8f95082e655610469a367

SHA512
9ce513221c82dfcfa864b2c91cbaaf86e7020e76a5f50db03e8c8d59c3a4818691fe996aff4ff6c03cc1cd3df0ad247615808581c5eabd9f628a1f57c5ffe2ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-48699.exe

Filesize
468KB

MD5
e8688e9d3df32a053ae6df73756735e2

SHA1
2182a53fb942cd2ef04995882cb9f5161fc63512

SHA256
689cfe719752501692a6a6ea652b2e1fa8e3951fa13cec9c460376502afe59e1

SHA512
a7dacd89823472b188b641cbb60823524ea9839a049939ea19581776e097cb003c56fb8288fd003036d65f14747bef2f23231f3b13486cb994b83ce6b704d613

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-53581.exe

Filesize
468KB

MD5
67267a295de60f7fa1f6f8801cdc87e3

SHA1
50bb74d2fa70602d1658a7bd47f904e4d8a2121d

SHA256
f3cfc18c8fe52b77ba80f7a0e386114db36d47398abf85852265342e02053026

SHA512
4b1cc9630c9803aebba069f72c929061f182d34353d2cd55eafe884a0aa406f6be30df3868de3c348a91de10e8407638ba2e8fab01351f9fc322d693326d6b4d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-53852.exe

Filesize
468KB

MD5
0742aea853f3103729378b1f142727a2

SHA1
83862078ebd5bd2987b91d171040db1fd7539856

SHA256
158e89e67c6ea7a4fa355bcf6cf5fd405fdd718f9bf83c11974eb4b9bb2b2db5

SHA512
8001173c9d71da133087f84fc444439ee1e904d142f65809fd821e3eef3bbcbbfbc587b5641c6f7694e071962b1efa438af15a1e36ef024f5078b2b040b7b5c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-53861.exe

Filesize
468KB

MD5
cc3d5dbd46f0caf3de510e054c3d878d

SHA1
fc8a1e129332ce8bb7f9b32c26e1db21542e0891

SHA256
cb98dbdc40bf2a06bc874c07ece2b6b17e580499b764ab9f9b988b1111ca41e1

SHA512
799bfead51efc9ec2078e9b190ae5f25e0a175c1eace13ee724bf7faf297fa06da2bf6189425bdc8260ec176ab5b73ae0fff8f214f2e120b92fe80d1b13f5a20

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-54838.exe

Filesize
468KB

MD5
70b6b0b4cc9537edfce4a01baacbe787

SHA1
4bcb7d74cc0007c6b6c1938d579062288a650068

SHA256
7306005c4d64aa91919fc220e9564c33c3d185ad651033e96966e8d720e5d842

SHA512
30e0283d16ffb20ce51f7312b7b8c92a03eb76cf41d8b675a7feea066c97e2b3b21cbd0373030e37d9dd05904424955b794a0b98d10f27b5ab416ee8df1b3784

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-56182.exe

Filesize
468KB

MD5
0d4c0e230dffae52a29cc7a7e85a42c3

SHA1
a3b7552e188bb9cf0b5cd9ac17fee58ccd00f41e

SHA256
ddbea4e6677cb6870013d74e00a2d1cca9aa2d20f514c922d1d1b34ef1da2044

SHA512
8ec88109089a79ed75e1a4294b509ecb43f5a21bab9f3c8c17d9cd7ccf8b49b61f1bc6b1cedcaf15670060c55248b3ac0a4e2a76018e30742a1a1371f37ebf73

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-56536.exe

Filesize
468KB

MD5
b6958d4a2c63978374015fbd61ca6c17

SHA1
13401619e80eed6a32652411d04dca1b342ae6ed

SHA256
407a995829c1d0b2e2955aead9ec72e7860230223f394460141effa25d67d0b6

SHA512
10bbbb6eebfd9fca94a8e1dd17ccb606a9dca0148f193e52c1df937f3c73a558d90ddf2f9bc25c593db627742dc155aabeb048d81b3c2545d87a2666caf82850

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-57111.exe

Filesize
468KB

MD5
1a43b61f8e47d33b452ddc6ae5bffa33

SHA1
f163224949619fdd75eb68bb08b193f340c44a59

SHA256
7d796d8b0edd156180f4f06f8e813dd292b05d9a7dbabfa904e734136dee9799

SHA512
c94e0b0f067dbb26b36460e592204b8acc353118982525bdc0bef17f58d6c9c0cb27ce89e962734f7fcd2264e5a91a6156964e23b84a9658212196d3d2ba1c0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-59991.exe

Filesize
468KB

MD5
95bb4a75192581861bd0ae1af31c5de5

SHA1
c03a4c95832be3b22a424de3d04296954990d0e0

SHA256
70367627d6979f98006cba12aab7e3da94fd2b5c1673d300421d83fdb76f2f0a

SHA512
6bd7653cae37189a9b53685675c1e1973dee6aa460d2cba0cb46242fc71185cdc1dba9fe3b6428a30a859b79e62d7f78b30c757d9f7a6f0fe847eeb2bae2d22e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-64075.exe

Filesize
468KB

MD5
9fa9ea952bc97234fc45eb338eafa48a

SHA1
fe3095cccc3f7d005fc97fe900a87d981df4bae1

SHA256
09af2712be1eeda6d8cc88b0226664fc983093982ccb30a5e73aa875846f9198

SHA512
7dc38dee68b7d946e7f76fe0aa58f422b41866c60b29c62ad7a0763945880d3ddb7a30fda82d644e2efd34090e6c34ccb31f547c57a060dcd2decc793d12d1f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-7344.exe

Filesize
468KB

MD5
011c5282e26bc855208cab6bb356062a

SHA1
c0e7d08a9fa1e5263d3cb74163bc4cd4f9c462df

SHA256
4c885b3ebde4b404704e27bb7a626d3f27d24f7126581a884d22517d086f3779

SHA512
ae0015c14e65e3a1df7791438537c846804e6d7509e83f82500014091041e781f14f2a3b602cb788868388f89b7e6f1d59d6498b5030e737fcd20e7028e7e7f3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-8901.exe

Filesize
468KB

MD5
2c9882abb572dadd07738234a40ac259

SHA1
35b0e8fb36dd0ba85f61f60bd8c522f457ea673e

SHA256
b91f18ac50097ed20e20f0d4c711d3aa2966383a83064a00a75ac0878e4d6ded

SHA512
82ab9bc8a18c9a92a0832c4de3b9e0b54db429215d12e73a9e8d35c57f4dde0f02f907e40825d898735a35335291ee0cd237f9e2ded00533047e348b61a6383d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-9617.exe

Filesize
468KB

MD5
13189807e58d69d7cb6db60620237a43

SHA1
9b4ee064b10793aaab91ace01aa0c6bc765a7f5c

SHA256
8fc5e7bd03be5016a95bb95ff5b5635f2021cd319ab83e16ea2a6f84288f70d4

SHA512
fe3a0d8f7bd7c51bc594d2b34f83df80759bab2561f02c631d00154ff1136c058d5ecfe3a1294ccddfe5f3d3f116972cf50872fec4beef16f228daa91bfeb601

Download Submit
memory/2148-4357-0x0000000075FC0000-0x000000007607F000-memory.dmp

Filesize
764KB

Download
memory/3916-474-0x0000000003080000-0x000000000311B000-memory.dmp

Filesize
620KB

Download
memory/17012-4240-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads