f6764f80b1b6c2e557267e1f6002a94c3972aabe81f6bf07de53015896f0e77d

Analysis

max time kernel
119s
max time network
109s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
11/09/2024, 08:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bbb1d2bc8b7fca94e951fdc438209730N.exe
Size

468KB
MD5

bbb1d2bc8b7fca94e951fdc438209730
SHA1

fd9175cca406e07993468de12bdd006c15565e23
SHA256

f6764f80b1b6c2e557267e1f6002a94c3972aabe81f6bf07de53015896f0e77d
SHA512

00d5d97ea652c130bece6554fc23f1217e6beb2c15c99450b0e8459a5ed29cd8577b3231a284dd2da779c54584a71fd42b077bdb3799ae3dff06b865e1747ff5
SSDEEP

3072:tqD/owLNpq8o6bxOPfzzt5f5/lgAoIpOnmHeAVsSWpNXX2RZTLlQ:tqTo+To6kf/t5fu08cWppGRZT

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
3976	Unicorn-18314.exe
1108	Unicorn-58490.exe
1368	Unicorn-30456.exe
2616	Unicorn-52922.exe
860	Unicorn-384.exe
4896	Unicorn-14119.exe
1884	Unicorn-25376.exe
3412	Unicorn-36306.exe
3656	Unicorn-49305.exe
4172	Unicorn-3633.exe
2676	Unicorn-44401.exe
5088	Unicorn-30367.exe
4704	Unicorn-28330.exe
4532	Unicorn-45922.exe
3536	Unicorn-23455.exe
1016	Unicorn-29010.exe
3196	Unicorn-60265.exe
2056	Unicorn-31506.exe
4208	Unicorn-55440.exe
4672	Unicorn-30162.exe
2396	Unicorn-7695.exe
3964	Unicorn-54858.exe
1676	Unicorn-38522.exe
1496	Unicorn-38522.exe
4772	Unicorn-10488.exe
1828	Unicorn-30089.exe
1132	Unicorn-10073.exe
1152	Unicorn-41402.exe
4564	Unicorn-21536.exe
4652	Unicorn-32969.exe
3884	Unicorn-46809.exe
1568	Unicorn-56306.exe
1296	Unicorn-33839.exe
1192	Unicorn-16543.exe
452	Unicorn-25362.exe
228	Unicorn-61521.exe
5012	Unicorn-65050.exe
3008	Unicorn-34415.exe
900	Unicorn-40546.exe
4912	Unicorn-65242.exe
4984	Unicorn-7104.exe
3632	Unicorn-32305.exe
3784	Unicorn-16234.exe
2152	Unicorn-32762.exe
1104	Unicorn-12896.exe
1940	Unicorn-16426.exe
2452	Unicorn-53929.exe
4276	Unicorn-57458.exe
1584	Unicorn-57458.exe
2712	Unicorn-14624.exe
544	Unicorn-17391.exe
4348	Unicorn-55657.exe
3580	Unicorn-52746.exe
4280	Unicorn-60914.exe
1964	Unicorn-3737.exe
3484	Unicorn-57577.exe
684	Unicorn-5775.exe
2308	Unicorn-5967.exe
3664	Unicorn-15392.exe
4512	Unicorn-42856.exe
3792	Unicorn-35450.exe
432	Unicorn-27282.exe
3548	Unicorn-10680.exe
3596	Unicorn-23944.exe

Program crash 6 IoCs

pid	pid_target	Process	procid_target
6816	3548	WerFault.exe	156
10368	10868	WerFault.exe	503
11052	10892	WerFault.exe	506
11504	10884	WerFault.exe	505
10744	10876	WerFault.exe	504
5560	6508	WerFault.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35296.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3777.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16008.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9584.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17994.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50009.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55562.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63977.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4137.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23319.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21536.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32762.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12359.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45713.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45010.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37745.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23858.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47202.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19138.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64721.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60290.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18210.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59211.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25971.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35450.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27401.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12017.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11976.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14087.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32040.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1266.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41305.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32969.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51769.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9200.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45713.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51619.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1881.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20183.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21569.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34130.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19344.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29723.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27529.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26857.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-744.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19138.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48722.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45402.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30162.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-793.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9672.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8799.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15321.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16338.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13944.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25809.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36306.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26745.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42018.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62504.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1289.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25809.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14119.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	5324	dwm.exe
Token: SeChangeNotifyPrivilege	5324	dwm.exe
Token: 33	5324	dwm.exe
Token: SeIncBasePriorityPrivilege	5324	dwm.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2736	bbb1d2bc8b7fca94e951fdc438209730N.exe
3976	Unicorn-18314.exe
1368	Unicorn-30456.exe
1108	Unicorn-58490.exe
2616	Unicorn-52922.exe
860	Unicorn-384.exe
4896	Unicorn-14119.exe
1884	Unicorn-25376.exe
3412	Unicorn-36306.exe
2676	Unicorn-44401.exe
3656	Unicorn-49305.exe
4172	Unicorn-3633.exe
4704	Unicorn-28330.exe
5088	Unicorn-30367.exe
4532	Unicorn-45922.exe
3536	Unicorn-23455.exe
1016	Unicorn-29010.exe
3196	Unicorn-60265.exe
2056	Unicorn-31506.exe
4208	Unicorn-55440.exe
4672	Unicorn-30162.exe
4772	Unicorn-10488.exe
1496	Unicorn-38522.exe
1676	Unicorn-38522.exe
3964	Unicorn-54858.exe
1828	Unicorn-30089.exe
2396	Unicorn-7695.exe
1132	Unicorn-10073.exe
1152	Unicorn-41402.exe
4564	Unicorn-21536.exe
4652	Unicorn-32969.exe
3884	Unicorn-46809.exe
1296	Unicorn-33839.exe
1568	Unicorn-56306.exe
1192	Unicorn-16543.exe
452	Unicorn-25362.exe
228	Unicorn-61521.exe
5012	Unicorn-65050.exe
3008	Unicorn-34415.exe
900	Unicorn-40546.exe
4912	Unicorn-65242.exe
4984	Unicorn-7104.exe
3632	Unicorn-32305.exe
1104	Unicorn-12896.exe
1940	Unicorn-16426.exe
2152	Unicorn-32762.exe
2452	Unicorn-53929.exe
3784	Unicorn-16234.exe
2712	Unicorn-14624.exe
4348	Unicorn-55657.exe
544	Unicorn-17391.exe
4276	Unicorn-57458.exe
1584	Unicorn-57458.exe
3580	Unicorn-52746.exe
3664	Unicorn-15392.exe
684	Unicorn-5775.exe
4280	Unicorn-60914.exe
2308	Unicorn-5967.exe
1964	Unicorn-3737.exe
4512	Unicorn-42856.exe
3484	Unicorn-57577.exe
3792	Unicorn-35450.exe
3548	Unicorn-10680.exe
3596	Unicorn-23944.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2736 wrote to memory of 3976	2736	bbb1d2bc8b7fca94e951fdc438209730N.exe	89
PID 2736 wrote to memory of 3976	2736	bbb1d2bc8b7fca94e951fdc438209730N.exe	89
PID 2736 wrote to memory of 3976	2736	bbb1d2bc8b7fca94e951fdc438209730N.exe	89
PID 3976 wrote to memory of 1108	3976	Unicorn-18314.exe	92
PID 3976 wrote to memory of 1108	3976	Unicorn-18314.exe	92
PID 3976 wrote to memory of 1108	3976	Unicorn-18314.exe	92
PID 2736 wrote to memory of 1368	2736	bbb1d2bc8b7fca94e951fdc438209730N.exe	93
PID 2736 wrote to memory of 1368	2736	bbb1d2bc8b7fca94e951fdc438209730N.exe	93
PID 2736 wrote to memory of 1368	2736	bbb1d2bc8b7fca94e951fdc438209730N.exe	93
PID 1368 wrote to memory of 2616	1368	Unicorn-30456.exe	97
PID 1368 wrote to memory of 2616	1368	Unicorn-30456.exe	97
PID 1368 wrote to memory of 2616	1368	Unicorn-30456.exe	97
PID 3976 wrote to memory of 860	3976	Unicorn-18314.exe	98
PID 3976 wrote to memory of 860	3976	Unicorn-18314.exe	98
PID 3976 wrote to memory of 860	3976	Unicorn-18314.exe	98
PID 2736 wrote to memory of 4896	2736	bbb1d2bc8b7fca94e951fdc438209730N.exe	99
PID 2736 wrote to memory of 4896	2736	bbb1d2bc8b7fca94e951fdc438209730N.exe	99
PID 2736 wrote to memory of 4896	2736	bbb1d2bc8b7fca94e951fdc438209730N.exe	99
PID 1108 wrote to memory of 1884	1108	Unicorn-58490.exe	100
PID 1108 wrote to memory of 1884	1108	Unicorn-58490.exe	100
PID 1108 wrote to memory of 1884	1108	Unicorn-58490.exe	100
PID 2616 wrote to memory of 3412	2616	Unicorn-52922.exe	101
PID 2616 wrote to memory of 3412	2616	Unicorn-52922.exe	101
PID 2616 wrote to memory of 3412	2616	Unicorn-52922.exe	101
PID 1368 wrote to memory of 3656	1368	Unicorn-30456.exe	102
PID 1368 wrote to memory of 3656	1368	Unicorn-30456.exe	102
PID 1368 wrote to memory of 3656	1368	Unicorn-30456.exe	102
PID 4896 wrote to memory of 4172	4896	Unicorn-14119.exe	103
PID 4896 wrote to memory of 4172	4896	Unicorn-14119.exe	103
PID 4896 wrote to memory of 4172	4896	Unicorn-14119.exe	103
PID 2736 wrote to memory of 2676	2736	bbb1d2bc8b7fca94e951fdc438209730N.exe	104
PID 2736 wrote to memory of 2676	2736	bbb1d2bc8b7fca94e951fdc438209730N.exe	104
PID 2736 wrote to memory of 2676	2736	bbb1d2bc8b7fca94e951fdc438209730N.exe	104
PID 860 wrote to memory of 4704	860	Unicorn-384.exe	105
PID 860 wrote to memory of 4704	860	Unicorn-384.exe	105
PID 860 wrote to memory of 4704	860	Unicorn-384.exe	105
PID 3976 wrote to memory of 5088	3976	Unicorn-18314.exe	106
PID 3976 wrote to memory of 5088	3976	Unicorn-18314.exe	106
PID 3976 wrote to memory of 5088	3976	Unicorn-18314.exe	106
PID 1884 wrote to memory of 4532	1884	Unicorn-25376.exe	107
PID 1884 wrote to memory of 4532	1884	Unicorn-25376.exe	107
PID 1884 wrote to memory of 4532	1884	Unicorn-25376.exe	107
PID 1108 wrote to memory of 3536	1108	Unicorn-58490.exe	108
PID 1108 wrote to memory of 3536	1108	Unicorn-58490.exe	108
PID 1108 wrote to memory of 3536	1108	Unicorn-58490.exe	108
PID 3412 wrote to memory of 1016	3412	Unicorn-36306.exe	109
PID 3412 wrote to memory of 1016	3412	Unicorn-36306.exe	109
PID 3412 wrote to memory of 1016	3412	Unicorn-36306.exe	109
PID 2616 wrote to memory of 3196	2616	Unicorn-52922.exe	110
PID 2616 wrote to memory of 3196	2616	Unicorn-52922.exe	110
PID 2616 wrote to memory of 3196	2616	Unicorn-52922.exe	110
PID 2676 wrote to memory of 2056	2676	Unicorn-44401.exe	111
PID 2676 wrote to memory of 2056	2676	Unicorn-44401.exe	111
PID 2676 wrote to memory of 2056	2676	Unicorn-44401.exe	111
PID 2736 wrote to memory of 4208	2736	bbb1d2bc8b7fca94e951fdc438209730N.exe	112
PID 2736 wrote to memory of 4208	2736	bbb1d2bc8b7fca94e951fdc438209730N.exe	112
PID 2736 wrote to memory of 4208	2736	bbb1d2bc8b7fca94e951fdc438209730N.exe	112
PID 3656 wrote to memory of 4672	3656	Unicorn-49305.exe	113
PID 3656 wrote to memory of 4672	3656	Unicorn-49305.exe	113
PID 3656 wrote to memory of 4672	3656	Unicorn-49305.exe	113
PID 1368 wrote to memory of 2396	1368	Unicorn-30456.exe	114
PID 1368 wrote to memory of 2396	1368	Unicorn-30456.exe	114
PID 1368 wrote to memory of 2396	1368	Unicorn-30456.exe	114
PID 5088 wrote to memory of 3964	5088	Unicorn-30367.exe	115

C:\Users\Admin\AppData\Local\Temp\bbb1d2bc8b7fca94e951fdc438209730N.exe
"C:\Users\Admin\AppData\Local\Temp\bbb1d2bc8b7fca94e951fdc438209730N.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2736
- C:\Users\Admin\AppData\Local\Temp\Unicorn-18314.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-18314.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3976
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58490.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58490.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25376.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25376.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45922.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10073.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25200.exe
        7⤵
        
        PID:5140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64290.exe
        8⤵
        
        PID:6712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48858.exe
        9⤵
        
        PID:10700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34833.exe
        9⤵
        
        PID:14844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43418.exe
        9⤵
        
        PID:8
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33304.exe
        8⤵
        
        PID:7504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23319.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:12604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49737.exe
        8⤵
        
        PID:15944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58648.exe
        7⤵
        
        PID:6628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7809.exe
        8⤵
        
        PID:9068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47226.exe
        8⤵
        
        PID:1932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1240.exe
        8⤵
        
        PID:5808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16279.exe
        7⤵
        
        PID:5700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35865.exe
        7⤵
        
        PID:14008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59211.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15392.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2048.exe
        7⤵
        
        PID:6292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19138.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:7984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38747.exe
        9⤵
        
        PID:15044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53874.exe
        9⤵
        
        PID:16356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37745.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:2928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45713.exe
        8⤵
        
        PID:12732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51619.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:15644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62504.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-840.exe
        7⤵
        
        PID:11328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46616.exe
        7⤵
        
        PID:4136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20687.exe
        6⤵
        
        PID:6116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55562.exe
        7⤵
        
        PID:7440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52867.exe
        8⤵
        
        PID:11300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53889.exe
        8⤵
        
        PID:15656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29952.exe
        7⤵
        
        PID:10492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58273.exe
        7⤵
        
        PID:14772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33826.exe
        7⤵
        
        PID:15556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35593.exe
        6⤵
        
        PID:8148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50235.exe
        7⤵
        
        PID:17524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32143.exe
        6⤵
        
        PID:10848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21257.exe
        6⤵
        
        PID:14900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57363.exe
        6⤵
        
        PID:14600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13944.exe
        6⤵
        
        PID:5680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21536.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52746.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13161.exe
        7⤵
        
        PID:5648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55562.exe
        8⤵
        
        PID:7376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29864.exe
        9⤵
        
        PID:11840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16960.exe
        9⤵
        
        PID:15564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5256.exe
        9⤵
        
        PID:16260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2952.exe
        8⤵
        
        PID:10348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15704.exe
        8⤵
        
        PID:14416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7105.exe
        8⤵
        
        PID:5888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40304.exe
        7⤵
        
        PID:8020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37047.exe
        7⤵
        
        PID:12780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20304.exe
        7⤵
        
        PID:17288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7144.exe
        6⤵
        
        PID:5284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53642.exe
        7⤵
        
        PID:8252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4784.exe
        7⤵
        
        PID:11536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37553.exe
        8⤵
        
        PID:4388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58569.exe
        7⤵
        
        PID:15396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49737.exe
        7⤵
        
        PID:16024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36377.exe
        6⤵
        
        PID:3936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20519.exe
        6⤵
        
        PID:12596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20304.exe
        6⤵
        
        PID:6360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5775.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37666.exe
        6⤵
        
        PID:5660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-497.exe
        7⤵
        
        PID:7292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15209.exe
        8⤵
        
        PID:9372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13977.exe
        8⤵
        
        PID:13612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35442.exe
        8⤵
        
        PID:16200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22832.exe
        7⤵
        
        PID:9712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38289.exe
        7⤵
        
        PID:11796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1809.exe
        7⤵
        
        PID:4572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38488.exe
        6⤵
        
        PID:6688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45402.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:11900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17001.exe
        7⤵
        
        PID:5912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12359.exe
        6⤵
        
        PID:10968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62049.exe
        6⤵
        
        PID:12652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41073.exe
        6⤵
        
        PID:16128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34361.exe
        6⤵
        
        PID:15600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26745.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34597.exe
        6⤵
        
        PID:8072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41.exe
        7⤵
        
        PID:10800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26857.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:14884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11432.exe
        7⤵
        
        PID:16408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53689.exe
        6⤵
        
        PID:10684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56929.exe
        6⤵
        
        PID:14948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9321.exe
        6⤵
        
        PID:17452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27223.exe
        5⤵
        
        PID:8212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15712.exe
        5⤵
        
        PID:11596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56491.exe
        5⤵
        
        PID:14152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20880.exe
        5⤵
        
        PID:17852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23455.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23455.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41402.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25200.exe
        6⤵
        
        PID:5132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36714.exe
        7⤵
        
        PID:6008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4441.exe
        8⤵
        
        PID:7784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30248.exe
        8⤵
        
        PID:11288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1200.exe
        8⤵
        
        PID:15212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33601.exe
        8⤵
        
        PID:15628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49065.exe
        7⤵
        
        PID:8808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6407.exe
        7⤵
        
        PID:11480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49938.exe
        7⤵
        
        PID:6348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47408.exe
        6⤵
        
        PID:6976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1089.exe
        7⤵
        
        PID:10144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7641.exe
        7⤵
        
        PID:12276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12664.exe
        7⤵
        
        PID:15592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64721.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17128.exe
        6⤵
        
        PID:12420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2610.exe
        6⤵
        
        PID:2988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57577.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59417.exe
        6⤵
        
        PID:6308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44042.exe
        7⤵
        
        PID:8756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9008.exe
        7⤵
        
        PID:11656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16504.exe
        7⤵
        
        PID:7012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55592.exe
        6⤵
        
        PID:9112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46097.exe
        6⤵
        
        PID:11516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-698.exe
        6⤵
        
        PID:7008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20879.exe
        5⤵
        
        PID:5260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-793.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63009.exe
        6⤵
        
        PID:11068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47521.exe
        6⤵
        
        PID:15268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35938.exe
        6⤵
        
        PID:18116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52225.exe
        5⤵
        
        PID:7288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7359.exe
        5⤵
        
        PID:11496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47401.exe
        5⤵
        
        PID:2596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16777.exe
        5⤵
        
        PID:16136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32969.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32969.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:4652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60914.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65472.exe
        6⤵
        
        PID:6168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37218.exe
        7⤵
        
        PID:9180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34664.exe
        7⤵
        
        PID:10436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26776.exe
        7⤵
        
        PID:16116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6767.exe
        6⤵
        
        PID:9692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41729.exe
        6⤵
        
        PID:11452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59211.exe
        6⤵
        
        PID:3624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39816.exe
        5⤵
        
        PID:4504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6361.exe
        6⤵
        
        PID:7200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53009.exe
        7⤵
        
        PID:9796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61065.exe
        7⤵
        
        PID:11744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58986.exe
        7⤵
        
        PID:3040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45417.exe
        6⤵
        
        PID:10164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45305.exe
        6⤵
        
        PID:6812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49482.exe
        6⤵
        
        PID:16772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62016.exe
        5⤵
        
        PID:7932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56761.exe
        5⤵
        
        PID:10584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45769.exe
        5⤵
        
        PID:14972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16601.exe
        5⤵
        
        PID:2612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42856.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42856.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54194.exe
        5⤵
        
        PID:5716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5489.exe
        6⤵
        
        PID:6784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55666.exe
        7⤵
        
        PID:8792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3697.exe
        7⤵
        
        PID:13160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34936.exe
        7⤵
        
        PID:2876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35442.exe
        7⤵
        
        PID:4292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43008.exe
        6⤵
        
        PID:9324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51170.exe
        6⤵
        
        PID:11748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56001.exe
        6⤵
        
        PID:5608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20024.exe
        5⤵
        
        PID:6468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30778.exe
        6⤵
        
        PID:9152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28393.exe
        6⤵
        
        PID:13212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51089.exe
        6⤵
        
        PID:1556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9760.exe
        5⤵
        
        PID:9964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19344.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25809.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1352.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1352.exe
      4⤵
      PID:6124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17514.exe
        5⤵
        
        PID:7040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36776.exe
        5⤵
        
        PID:12248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47441.exe
        5⤵
        
        PID:16360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27370.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27370.exe
      4⤵
      PID:7916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20183.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20183.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:10828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37601.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37601.exe
      4⤵
      PID:15228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24049.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24049.exe
      4⤵
      PID:3880
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-384.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-384.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28330.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28330.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38522.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57458.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61594.exe
        7⤵
        
        PID:5180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24218.exe
        8⤵
        
        PID:6460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36450.exe
        9⤵
        
        PID:8436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9584.exe
        9⤵
        
        PID:12568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41305.exe
        9⤵
        
        PID:3408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58385.exe
        8⤵
        
        PID:9200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40232.exe
        8⤵
        
        PID:4840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31105.exe
        8⤵
        
        PID:6208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36360.exe
        7⤵
        
        PID:5920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55858.exe
        8⤵
        
        PID:9264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29737.exe
        8⤵
        
        PID:13128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49970.exe
        8⤵
        
        PID:5172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9760.exe
        7⤵
        
        PID:9988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27320.exe
        7⤵
        
        PID:11424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25809.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17800.exe
        6⤵
        
        PID:5692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47202.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42499.exe
        8⤵
        
        PID:14228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14033.exe
        8⤵
        
        PID:17552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12936.exe
        7⤵
        
        PID:8428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45305.exe
        7⤵
        
        PID:13848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50442.exe
        7⤵
        
        PID:5360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27529.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8703.exe
        6⤵
        
        PID:11468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39233.exe
        6⤵
        
        PID:15156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14969.exe
        6⤵
        
        PID:6452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55657.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29882.exe
        6⤵
        
        PID:5472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4145.exe
        7⤵
        
        PID:6880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33954.exe
        8⤵
        
        PID:9220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47330.exe
        8⤵
        
        PID:13436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10176.exe
        8⤵
        
        PID:5532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45121.exe
        7⤵
        
        PID:8656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10137.exe
        7⤵
        
        PID:13632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14968.exe
        7⤵
        
        PID:6096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36552.exe
        6⤵
        
        PID:5980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12609.exe
        7⤵
        
        PID:2076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30248.exe
        7⤵
        
        PID:11280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34553.exe
        7⤵
        
        PID:15580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6967.exe
        6⤵
        
        PID:6916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30145.exe
        6⤵
        
        PID:12640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56339.exe
        6⤵
        
        PID:5520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23559.exe
        5⤵
        
        PID:5756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63538.exe
        6⤵
        
        PID:7300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18106.exe
        7⤵
        
        PID:10908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18689.exe
        7⤵
        
        PID:14936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11432.exe
        7⤵
        
        PID:16988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19096.exe
        6⤵
        
        PID:10256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31848.exe
        6⤵
        
        PID:14348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40546.exe
        6⤵
        
        PID:5924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2344.exe
        5⤵
        
        PID:7880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32240.exe
        5⤵
        
        PID:11660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12809.exe
        5⤵
        
        PID:16144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16543.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16543.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35834.exe
        5⤵
        
        PID:1748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52090.exe
        6⤵
        
        PID:5852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54425.exe
        7⤵
        
        PID:7152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29864.exe
        8⤵
        
        PID:11884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8905.exe
        8⤵
        
        PID:6112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41472.exe
        7⤵
        
        PID:9840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4553.exe
        7⤵
        
        PID:12840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-265.exe
        7⤵
        
        PID:16972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28768.exe
        6⤵
        
        PID:4020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11945.exe
        7⤵
        
        PID:8380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9584.exe
        7⤵
        
        PID:12692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16800.exe
        7⤵
        
        PID:16956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63672.exe
        6⤵
        
        PID:9684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19545.exe
        6⤵
        
        PID:14072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41001.exe
        6⤵
        
        PID:2296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48177.exe
        5⤵
        
        PID:5280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-793.exe
        6⤵
        
        PID:6484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14881.exe
        7⤵
        
        PID:1444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32618.exe
        6⤵
        
        PID:13060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24928.exe
        6⤵
        
        PID:16276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51619.exe
        6⤵
        
        PID:15660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30023.exe
        5⤵
        
        PID:8220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49081.exe
        5⤵
        
        PID:11608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55961.exe
        5⤵
        
        PID:15376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57634.exe
        5⤵
        
        PID:6720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27401.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27401.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51130.exe
        5⤵
        
        PID:6048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17794.exe
        6⤵
        
        PID:7668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45713.exe
        6⤵
        
        PID:12716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41073.exe
        6⤵
        
        PID:16108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54258.exe
        6⤵
        
        PID:14716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47617.exe
        5⤵
        
        PID:7804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14087.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:10636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29074.exe
        5⤵
        
        PID:14220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8632.exe
        5⤵
        
        PID:16940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35759.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35759.exe
      4⤵
      PID:6056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44426.exe
        5⤵
        
        PID:8860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9008.exe
        5⤵
        
        PID:11576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49937.exe
        5⤵
        
        PID:4848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35296.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35296.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:8776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4137.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4137.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:11768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12809.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12809.exe
      4⤵
      PID:16156
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30367.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30367.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:5088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54858.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54858.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16426.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19986.exe
        6⤵
        
        PID:5396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55562.exe
        7⤵
        
        PID:7432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5256.exe
        7⤵
        
        PID:10472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58273.exe
        7⤵
        
        PID:14780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1696.exe
        7⤵
        
        PID:15540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40304.exe
        6⤵
        
        PID:8004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12359.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37353.exe
        6⤵
        
        PID:12616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41073.exe
        6⤵
        
        PID:16100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46089.exe
        6⤵
        
        PID:16128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9824.exe
        5⤵
        
        PID:5744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4721.exe
        6⤵
        
        PID:7124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38946.exe
        7⤵
        
        PID:9208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22232.exe
        7⤵
        
        PID:13088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59257.exe
        7⤵
        
        PID:15156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4472.exe
        6⤵
        
        PID:2800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10137.exe
        6⤵
        
        PID:13720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41969.exe
        6⤵
        
        PID:6508
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6508 -s 412
        7⤵
        Program crash
        
        PID:5560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34055.exe
        5⤵
        
        PID:3440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59858.exe
        6⤵
        
        PID:16108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16008.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:10196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42505.exe
        5⤵
        
        PID:11080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57634.exe
        5⤵
        
        PID:16980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53929.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53929.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19986.exe
        5⤵
        
        PID:5436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55562.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17267.exe
        7⤵
        
        PID:7100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60321.exe
        6⤵
        
        PID:10328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32040.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:14384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1233.exe
        6⤵
        
        PID:3464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40304.exe
        5⤵
        
        PID:8012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57441.exe
        5⤵
        
        PID:11680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-225.exe
        5⤵
        
        PID:16256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18178.exe
        5⤵
        
        PID:400
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23559.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23559.exe
      4⤵
      PID:5764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54425.exe
        5⤵
        
        PID:4968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29864.exe
        6⤵
        
        PID:11824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24744.exe
        6⤵
        
        PID:15472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49738.exe
        6⤵
        
        PID:16120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62625.exe
        6⤵
        
        PID:16292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23321.exe
        5⤵
        
        PID:9716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28664.exe
        5⤵
        
        PID:11324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56378.exe
        5⤵
        
        PID:6240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41929.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41929.exe
      4⤵
      PID:6836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4545.exe
        5⤵
        
        PID:8228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34664.exe
        5⤵
        
        PID:12376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41305.exe
        5⤵
        
        PID:16964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53472.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53472.exe
      4⤵
      PID:9468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26825.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26825.exe
      4⤵
      PID:13840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52872.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52872.exe
      4⤵
      PID:5344
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30089.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30089.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57458.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57458.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19986.exe
        5⤵
        
        PID:5428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54425.exe
        6⤵
        
        PID:1668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16371.exe
        7⤵
        
        PID:14436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6057.exe
        7⤵
        
        PID:16840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41472.exe
        6⤵
        
        PID:9856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4553.exe
        6⤵
        
        PID:12404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63970.exe
        6⤵
        
        PID:6140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36936.exe
        5⤵
        
        PID:6744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29864.exe
        6⤵
        
        PID:11856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-73.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-73.exe
        6⤵
        
        PID:5728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55504.exe
        5⤵
        
        PID:9720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43561.exe
        5⤵
        
        PID:15352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17330.exe
        5⤵
        
        PID:6304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23096.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23096.exe
      4⤵
      PID:6068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49210.exe
        5⤵
        
        PID:6316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45578.exe
        6⤵
        
        PID:8244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34664.exe
        6⤵
        
        PID:12316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57153.exe
        6⤵
        
        PID:2492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9672.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35881.exe
        5⤵
        
        PID:13656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18608.exe
        5⤵
        
        PID:9276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58560.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58560.exe
      4⤵
      PID:6364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64026.exe
        5⤵
        
        PID:9224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31081.exe
        5⤵
        
        PID:12452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7105.exe
        5⤵
        
        PID:5872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6304.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6304.exe
      4⤵
      PID:9816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11840.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11840.exe
      4⤵
      PID:14196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19138.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19138.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7048
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17391.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17391.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19986.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19986.exe
      4⤵
      PID:5404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54425.exe
        5⤵
        
        PID:5220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29864.exe
        6⤵
        
        PID:11816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58098.exe
        6⤵
        
        PID:16304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17840.exe
        6⤵
        
        PID:4872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41472.exe
        5⤵
        
        PID:9848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4553.exe
        5⤵
        
        PID:11356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57634.exe
        5⤵
        
        PID:6620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28768.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28768.exe
      4⤵
      PID:6668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23186.exe
        5⤵
        
        PID:9288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21569.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:13276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58585.exe
        5⤵
        
        PID:15228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10745.exe
        5⤵
        
        PID:15860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47336.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47336.exe
      4⤵
      PID:9704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10216.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10216.exe
      4⤵
      PID:14324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25809.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25809.exe
      4⤵
      PID:3496
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1544.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1544.exe
    3⤵
    PID:2332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6361.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6361.exe
      4⤵
      PID:7264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51769.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51769.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:9328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48185.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48185.exe
      4⤵
      PID:11192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7105.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7105.exe
      4⤵
      PID:5880
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59746.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59746.exe
    3⤵
    PID:7872
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27095.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27095.exe
    3⤵
    PID:10572
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19433.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19433.exe
    3⤵
    PID:14804
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12617.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12617.exe
    3⤵
    PID:3472
- C:\Users\Admin\AppData\Local\Temp\Unicorn-30456.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-30456.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1368
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52922.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52922.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36306.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36306.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29010.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46809.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3737.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43922.exe
        7⤵
        
        PID:5900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37218.exe
        8⤵
        
        PID:9192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34664.exe
        8⤵
        
        PID:3672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16800.exe
        8⤵
        
        PID:16928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55977.exe
        7⤵
        
        PID:8048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12935.exe
        7⤵
        
        PID:10900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12929.exe
        7⤵
        
        PID:14544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41881.exe
        7⤵
        
        PID:17876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25016.exe
        6⤵
        
        PID:6028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8961.exe
        7⤵
        
        PID:2748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64161.exe
        7⤵
        
        PID:10988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8304.exe
        7⤵
        
        PID:15100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51089.exe
        7⤵
        
        PID:15744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13024.exe
        6⤵
        
        PID:8680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14632.exe
        6⤵
        
        PID:13188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15601.exe
        6⤵
        
        PID:4992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27307.exe
        6⤵
        
        PID:16032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5967.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2048.exe
        6⤵
        
        PID:6284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35666.exe
        7⤵
        
        PID:8100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45713.exe
        7⤵
        
        PID:10752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40593.exe
        7⤵
        
        PID:14920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51089.exe
        7⤵
        
        PID:1452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28209.exe
        6⤵
        
        PID:8736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20519.exe
        6⤵
        
        PID:12628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45280.exe
        6⤵
        
        PID:3052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10216.exe
        5⤵
        
        PID:1976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34130.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49242.exe
        7⤵
        
        PID:10816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26857.exe
        7⤵
        
        PID:14872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18608.exe
        7⤵
        
        PID:7056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45713.exe
        6⤵
        
        PID:12704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41073.exe
        6⤵
        
        PID:16092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46089.exe
        6⤵
        
        PID:1076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17519.exe
        5⤵
        
        PID:7676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60289.exe
        5⤵
        
        PID:10560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20938.exe
        5⤵
        
        PID:14408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51912.exe
        5⤵
        
        PID:5940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60265.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60265.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56306.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27282.exe
        6⤵
        Executes dropped EXE
        
        PID:432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35872.exe
        7⤵
        
        PID:6476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-793.exe
        8⤵
        
        PID:6932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43233.exe
        9⤵
        
        PID:16796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63777.exe
        8⤵
        
        PID:10884
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10884 -s 220
        9⤵
        Program crash
        
        PID:11504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38097.exe
        8⤵
        
        PID:10916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15849.exe
        8⤵
        
        PID:6372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39344.exe
        7⤵
        
        PID:8468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58785.exe
        7⤵
        
        PID:12164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65467.exe
        7⤵
        
        PID:2772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17040.exe
        6⤵
        
        PID:5176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34130.exe
        7⤵
        
        PID:7724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29864.exe
        8⤵
        
        PID:11864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58098.exe
        8⤵
        
        PID:14800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7184.exe
        8⤵
        
        PID:16764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45713.exe
        7⤵
        
        PID:12756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25971.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:14812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20319.exe
        6⤵
        
        PID:7752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19952.exe
        6⤵
        
        PID:10540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56699.exe
        6⤵
        
        PID:15656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42976.exe
        6⤵
        
        PID:1156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23944.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51130.exe
        6⤵
        
        PID:6040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22698.exe
        7⤵
        
        PID:7324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60290.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:11228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36281.exe
        8⤵
        
        PID:14964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3928.exe
        8⤵
        
        PID:15536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51961.exe
        7⤵
        
        PID:10300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56545.exe
        7⤵
        
        PID:14364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47745.exe
        7⤵
        
        PID:17000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48281.exe
        6⤵
        
        PID:7924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50896.exe
        6⤵
        
        PID:10628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54434.exe
        6⤵
        
        PID:14852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31304.exe
        6⤵
        
        PID:16344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30583.exe
        5⤵
        
        PID:5972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44514.exe
        6⤵
        
        PID:8648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9008.exe
        6⤵
        
        PID:11416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33400.exe
        6⤵
        
        PID:15992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1888.exe
        6⤵
        
        PID:15672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3128.exe
        5⤵
        
        PID:8800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3607.exe
        5⤵
        
        PID:11716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63145.exe
        5⤵
        
        PID:16036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33839.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33839.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35450.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2048.exe
        6⤵
        
        PID:6276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-793.exe
        7⤵
        
        PID:2768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63777.exe
        7⤵
        
        PID:10868
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10868 -s 220
        8⤵
        Program crash
        
        PID:10368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62881.exe
        7⤵
        
        PID:13968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8336.exe
        7⤵
        
        PID:16748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62216.exe
        6⤵
        
        PID:9900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27785.exe
        6⤵
        
        PID:13376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62953.exe
        6⤵
        
        PID:15684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6952.exe
        5⤵
        
        PID:5316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17794.exe
        6⤵
        
        PID:7648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32226.exe
        7⤵
        
        PID:9916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47330.exe
        7⤵
        
        PID:11368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34680.exe
        7⤵
        
        PID:15604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45713.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:12724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23858.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3983.exe
        5⤵
        
        PID:3060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33947.exe
        6⤵
        
        PID:14188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14497.exe
        6⤵
        
        PID:4524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19952.exe
        5⤵
        
        PID:10548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20408.exe
        5⤵
        
        PID:14428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41193.exe
        5⤵
        
        PID:1304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10680.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10680.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3548
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3548 -s 628
        5⤵
        Program crash
        
        PID:6816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35951.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35951.exe
      4⤵
      PID:6108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2609.exe
        5⤵
        
        PID:7896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48595.exe
        6⤵
        
        PID:5588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45713.exe
        5⤵
        
        PID:12748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17330.exe
        5⤵
        
        PID:16884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35000.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35000.exe
      4⤵
      PID:8340
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16441.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16441.exe
      4⤵
      PID:11632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34960.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34960.exe
      4⤵
      PID:392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47833.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47833.exe
      4⤵
      PID:16388
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49305.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49305.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30162.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30162.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:4672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32762.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20370.exe
        6⤵
        
        PID:2528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47570.exe
        7⤵
        
        PID:6524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-793.exe
        8⤵
        
        PID:5508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4679.exe
        8⤵
        
        PID:11908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24554.exe
        8⤵
        
        PID:15576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54258.exe
        8⤵
        
        PID:16308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35312.exe
        7⤵
        
        PID:8508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15321.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:13252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23968.exe
        7⤵
        
        PID:16340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49737.exe
        7⤵
        
        PID:10880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12048.exe
        6⤵
        
        PID:6572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4545.exe
        7⤵
        
        PID:8144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34664.exe
        7⤵
        
        PID:12292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16800.exe
        7⤵
        
        PID:16920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56272.exe
        6⤵
        
        PID:9480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52026.exe
        6⤵
        
        PID:13884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57338.exe
        6⤵
        
        PID:16756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15783.exe
        5⤵
        
        PID:6260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35770.exe
        6⤵
        
        PID:7544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63305.exe
        6⤵
        
        PID:11488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8905.exe
        6⤵
        
        PID:5804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61457.exe
        5⤵
        
        PID:9100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37431.exe
        5⤵
        
        PID:11520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20776.exe
        5⤵
        
        PID:6252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14624.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14624.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19986.exe
        5⤵
        
        PID:5420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6921.exe
        6⤵
        
        PID:6700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55178.exe
        7⤵
        
        PID:8596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49849.exe
        7⤵
        
        PID:11392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16120.exe
        7⤵
        
        PID:17144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51561.exe
        6⤵
        
        PID:9176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43089.exe
        6⤵
        
        PID:13048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33594.exe
        6⤵
        
        PID:16288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-736.exe
        6⤵
        
        PID:15980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61249.exe
        5⤵
        
        PID:6768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18210.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:12220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56306.exe
        6⤵
        
        PID:15132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24945.exe
        5⤵
        
        PID:10152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35872.exe
        5⤵
        
        PID:13820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42145.exe
        5⤵
        
        PID:4392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23559.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23559.exe
      4⤵
      PID:5736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12505.exe
        5⤵
        
        PID:6924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42018.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36776.exe
        6⤵
        
        PID:12240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24082.exe
        6⤵
        
        PID:15912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-929.exe
        6⤵
        
        PID:17124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51073.exe
        5⤵
        
        PID:8476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52920.exe
        5⤵
        
        PID:12176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54642.exe
        5⤵
        
        PID:15876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33584.exe
        5⤵
        
        PID:15680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18993.exe
        5⤵
        
        PID:16888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50481.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50481.exe
      4⤵
      PID:7036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4545.exe
        5⤵
        
        PID:7716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34664.exe
        5⤵
        
        PID:12308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39473.exe
        5⤵
        
        PID:5624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45304.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45304.exe
      4⤵
      PID:9436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26825.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26825.exe
      4⤵
      PID:13860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45272.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45272.exe
      4⤵
      PID:16072
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7695.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7695.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65242.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65242.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44874.exe
        5⤵
        
        PID:1900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5032.exe
        6⤵
        
        PID:6352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29864.exe
        7⤵
        
        PID:11848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16960.exe
        7⤵
        
        PID:15544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18065.exe
        7⤵
        
        PID:7696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15623.exe
        6⤵
        
        PID:9532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52026.exe
        6⤵
        
        PID:13832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47441.exe
        6⤵
        
        PID:1216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36360.exe
        5⤵
        
        PID:6392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6273.exe
        6⤵
        
        PID:9120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28393.exe
        6⤵
        
        PID:13220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18608.exe
        6⤵
        
        PID:5704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9760.exe
        5⤵
        
        PID:9612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43657.exe
        5⤵
        
        PID:13288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56378.exe
        5⤵
        
        PID:6740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8096.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8096.exe
      4⤵
      PID:5364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24410.exe
        5⤵
        
        PID:6436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-793.exe
        6⤵
        
        PID:8188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63777.exe
        6⤵
        
        PID:10892
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10892 -s 184
        7⤵
        Program crash
        
        PID:11052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22144.exe
        6⤵
        
        PID:13388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51586.exe
        6⤵
        
        PID:15276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31663.exe
        5⤵
        
        PID:8832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28275.exe
        6⤵
        
        PID:13796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6905.exe
        6⤵
        
        PID:2780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23298.exe
        5⤵
        
        PID:13176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1266.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:16048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33759.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33759.exe
      4⤵
      PID:5564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29864.exe
        5⤵
        
        PID:11876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25128.exe
        5⤵
        
        PID:15532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62625.exe
        5⤵
        
        PID:14616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21488.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21488.exe
      4⤵
      PID:9512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43361.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43361.exe
      4⤵
      PID:13824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35475.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35475.exe
      4⤵
      PID:5604
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32305.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32305.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43146.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43146.exe
      4⤵
      PID:1288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6921.exe
        5⤵
        
        PID:6692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10969.exe
        6⤵
        
        PID:8032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18955.exe
        7⤵
        
        PID:12468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53042.exe
        7⤵
        
        PID:6492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12656.exe
        6⤵
        
        PID:10652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48569.exe
        6⤵
        
        PID:14828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9321.exe
        6⤵
        
        PID:17412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32624.exe
        5⤵
        
        PID:7476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18519.exe
        5⤵
        
        PID:11528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27307.exe
        5⤵
        
        PID:808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3880.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3880.exe
      4⤵
      PID:2244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3777.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9584.exe
        5⤵
        
        PID:12576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16608.exe
        5⤵
        
        PID:3492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6111.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6111.exe
      4⤵
      PID:9640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18576.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18576.exe
      4⤵
      PID:13344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42145.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42145.exe
      4⤵
      PID:16312
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59872.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59872.exe
    3⤵
    PID:5348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54425.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54425.exe
      4⤵
      PID:7120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53570.exe
        5⤵
        
        PID:11604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1617.exe
        5⤵
        
        PID:1176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23321.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23321.exe
      4⤵
      PID:3940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28664.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28664.exe
      4⤵
      PID:3100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1305.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1305.exe
      4⤵
      PID:16276
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63817.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63817.exe
    3⤵
    PID:6732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11945.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11945.exe
      4⤵
      PID:8392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9584.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9584.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:12676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-744.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-744.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5300
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3841.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3841.exe
    3⤵
    PID:9632
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55416.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55416.exe
    3⤵
    PID:13996
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27233.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27233.exe
    3⤵
    PID:6640
- C:\Users\Admin\AppData\Local\Temp\Unicorn-14119.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-14119.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4896
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3633.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3633.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38522.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38522.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16234.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19986.exe
        6⤵
        
        PID:5412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61514.exe
        7⤵
        
        PID:6844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60850.exe
        8⤵
        
        PID:8728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9008.exe
        8⤵
        
        PID:11760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33400.exe
        8⤵
        
        PID:15964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51089.exe
        8⤵
        
        PID:2660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18888.exe
        7⤵
        
        PID:7996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31871.exe
        7⤵
        
        PID:12848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24769.exe
        7⤵
        
        PID:15432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45297.exe
        6⤵
        
        PID:6944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4545.exe
        7⤵
        
        PID:8132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62122.exe
        8⤵
        
        PID:12828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49970.exe
        8⤵
        
        PID:17300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34664.exe
        7⤵
        
        PID:11712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25632.exe
        7⤵
        
        PID:16812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48104.exe
        6⤵
        
        PID:9444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52026.exe
        6⤵
        
        PID:13852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1881.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:16172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23096.exe
        5⤵
        
        PID:6076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2801.exe
        6⤵
        
        PID:8052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12656.exe
        6⤵
        
        PID:10668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48569.exe
        6⤵
        
        PID:14820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34752.exe
        6⤵
        
        PID:15216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22815.exe
        5⤵
        
        PID:7820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49849.exe
        5⤵
        
        PID:11004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45280.exe
        5⤵
        
        PID:6748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12896.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12896.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52274.exe
        5⤵
        
        PID:5332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6361.exe
        6⤵
        
        PID:7024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29723.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:14880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38921.exe
        7⤵
        
        PID:5800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61177.exe
        6⤵
        
        PID:9740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3609.exe
        6⤵
        
        PID:15148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-744.exe
        6⤵
        
        PID:5844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21663.exe
        5⤵
        
        PID:7708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25539.exe
        6⤵
        
        PID:4212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9200.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:11460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63937.exe
        5⤵
        
        PID:15264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20304.exe
        5⤵
        
        PID:17516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31535.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31535.exe
      4⤵
      PID:5668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14337.exe
        5⤵
        
        PID:7000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36251.exe
        6⤵
        
        PID:13964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53810.exe
        6⤵
        
        PID:16392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21104.exe
        5⤵
        
        PID:7908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62794.exe
        5⤵
        
        PID:15024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9936.exe
        5⤵
        
        PID:15184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49737.exe
        5⤵
        
        PID:16056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35017.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35017.exe
      4⤵
      PID:7828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48096.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48096.exe
      4⤵
      PID:10596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25865.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25865.exe
      4⤵
      PID:14096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21409.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21409.exe
      4⤵
      PID:17028
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10488.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10488.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65050.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65050.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:5012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2881.exe
        5⤵
        
        PID:2796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61218.exe
        6⤵
        
        PID:5960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10601.exe
        7⤵
        
        PID:9128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34664.exe
        7⤵
        
        PID:12300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41305.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42904.exe
        6⤵
        
        PID:7864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1289.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:12664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42721.exe
        6⤵
        
        PID:15208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50009.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20114.exe
        6⤵
        
        PID:4452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9584.exe
        6⤵
        
        PID:12584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16608.exe
        6⤵
        
        PID:6580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58856.exe
        5⤵
        
        PID:8556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25794.exe
        5⤵
        
        PID:12488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18296.exe
        5⤵
        
        PID:15308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-265.exe
        5⤵
        
        PID:5504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23280.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23280.exe
      4⤵
      PID:2648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5992.exe
        5⤵
        
        PID:6860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60651.exe
        6⤵
        
        PID:13940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53889.exe
        6⤵
        
        PID:2032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49448.exe
        5⤵
        
        PID:9780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45010.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:14180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49737.exe
        5⤵
        
        PID:16068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50480.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50480.exe
      4⤵
      PID:6644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19362.exe
        5⤵
        
        PID:11696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44553.exe
        5⤵
        
        PID:15448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27274.exe
        5⤵
        
        PID:15940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11976.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11976.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:9624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10880.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10880.exe
      4⤵
      PID:13952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19138.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19138.exe
      4⤵
      PID:15908
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34415.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34415.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2881.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2881.exe
      4⤵
      PID:4616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13361.exe
        5⤵
        
        PID:6216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12713.exe
        6⤵
        
        PID:8236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25099.exe
        7⤵
        
        PID:13320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29576.exe
        7⤵
        
        PID:16004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34664.exe
        6⤵
        
        PID:11692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41305.exe
        6⤵
        
        PID:16876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39936.exe
        5⤵
        
        PID:9028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38120.exe
        5⤵
        
        PID:12160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49737.exe
        5⤵
        
        PID:16060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26848.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26848.exe
      4⤵
      PID:5484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20114.exe
        5⤵
        
        PID:8644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9584.exe
        5⤵
        
        PID:12684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41305.exe
        5⤵
        
        PID:16828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9079.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9079.exe
      4⤵
      PID:9316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33578.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33578.exe
      4⤵
      PID:13596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47441.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47441.exe
      4⤵
      PID:5892
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42881.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42881.exe
    3⤵
    PID:4324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14233.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14233.exe
      4⤵
      PID:2380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53009.exe
        5⤵
        
        PID:9812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61065.exe
        5⤵
        
        PID:4956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1809.exe
        5⤵
        
        PID:2280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3512.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3512.exe
      4⤵
      PID:9352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27712.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27712.exe
      4⤵
      PID:13568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63977.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63977.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4992
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22319.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22319.exe
    3⤵
    PID:7220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6657.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6657.exe
      4⤵
      PID:9240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29737.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29737.exe
      4⤵
      PID:13044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51401.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51401.exe
      4⤵
      PID:16780
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40008.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40008.exe
    3⤵
    PID:9272
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43035.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43035.exe
    3⤵
    PID:10892
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61529.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61529.exe
    3⤵
    PID:16732
- C:\Users\Admin\AppData\Local\Temp\Unicorn-44401.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-44401.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2676
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31506.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31506.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25362.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25362.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16338.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43538.exe
        6⤵
        
        PID:5460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55562.exe
        7⤵
        
        PID:7368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65425.exe
        8⤵
        
        PID:13560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60321.exe
        7⤵
        
        PID:10336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32040.exe
        7⤵
        
        PID:14388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56306.exe
        7⤵
        
        PID:5304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40304.exe
        6⤵
        
        PID:972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65370.exe
        7⤵
        
        PID:8064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6193.exe
        7⤵
        
        PID:12804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58602.exe
        7⤵
        
        PID:11084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8799.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53754.exe
        6⤵
        
        PID:10760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24769.exe
        6⤵
        
        PID:15560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34336.exe
        5⤵
        
        PID:6172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-793.exe
        6⤵
        
        PID:6516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24435.exe
        7⤵
        
        PID:15668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3736.exe
        7⤵
        
        PID:10860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63777.exe
        6⤵
        
        PID:10876
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10876 -s 220
        7⤵
        Program crash
        
        PID:10744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20137.exe
        6⤵
        
        PID:15188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25160.exe
        6⤵
        
        PID:17444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49048.exe
        5⤵
        
        PID:8528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58785.exe
        5⤵
        
        PID:12152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49131.exe
        5⤵
        
        PID:16788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4832.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4832.exe
      4⤵
      PID:1404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43538.exe
        5⤵
        
        PID:5388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34130.exe
        6⤵
        
        PID:7636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51576.exe
        6⤵
        
        PID:11732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64626.exe
        6⤵
        
        PID:3472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51619.exe
        6⤵
        
        PID:1628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6584.exe
        5⤵
        
        PID:4560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14087.exe
        5⤵
        
        PID:10592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29074.exe
        5⤵
        
        PID:14108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34176.exe
        5⤵
        
        PID:14600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8575.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8575.exe
      4⤵
      PID:6160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61618.exe
        5⤵
        
        PID:7892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30248.exe
        5⤵
        
        PID:11272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49745.exe
        5⤵
        
        PID:14404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59537.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59537.exe
      4⤵
      PID:9016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35319.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35319.exe
      4⤵
      PID:12256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63145.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63145.exe
      4⤵
      PID:7604
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61521.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61521.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49394.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49394.exe
      4⤵
      PID:2012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2313.exe
        5⤵
        
        PID:5016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34130.exe
        6⤵
        
        PID:7680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58458.exe
        7⤵
        
        PID:2532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64818.exe
        7⤵
        
        PID:12356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2008.exe
        7⤵
        
        PID:5540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45713.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:12764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1274.exe
        6⤵
        
        PID:6232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6584.exe
        5⤵
        
        PID:8136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17123.exe
        6⤵
        
        PID:13456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10176.exe
        6⤵
        
        PID:5512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45800.exe
        5⤵
        
        PID:10776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53962.exe
        5⤵
        
        PID:4120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41881.exe
        5⤵
        
        PID:17716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17040.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17040.exe
      4⤵
      PID:4500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3185.exe
        5⤵
        
        PID:8172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21208.exe
        5⤵
        
        PID:10840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40593.exe
        5⤵
        
        PID:14908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51089.exe
        5⤵
        
        PID:15740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62216.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62216.exe
      4⤵
      PID:9908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60458.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60458.exe
      4⤵
      PID:12396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13944.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13944.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3680
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43648.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43648.exe
    3⤵
    PID:2824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53434.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53434.exe
      4⤵
      PID:5596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34130.exe
        5⤵
        
        PID:7660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27403.exe
        6⤵
        
        PID:13724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12664.exe
        6⤵
        
        PID:14568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45713.exe
        5⤵
        
        PID:12772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59787.exe
        5⤵
        
        PID:15528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53672.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53672.exe
      4⤵
      PID:9036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43985.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43985.exe
      4⤵
      PID:12260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58635.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58635.exe
      4⤵
      PID:4384
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36641.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36641.exe
    3⤵
    PID:5128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19138.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19138.exe
      4⤵
      PID:7976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37160.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37160.exe
      4⤵
      PID:10620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48569.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48569.exe
      4⤵
      PID:14792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9321.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9321.exe
      4⤵
      PID:17420
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59704.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59704.exe
    3⤵
    PID:2044
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33008.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33008.exe
    3⤵
    PID:11312
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64467.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64467.exe
    3⤵
    PID:15220
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58562.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58562.exe
    3⤵
    PID:1572
- C:\Users\Admin\AppData\Local\Temp\Unicorn-55440.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-55440.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4208
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40546.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40546.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10089.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10089.exe
      4⤵
      PID:4252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54306.exe
        5⤵
        
        PID:6804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43642.exe
        6⤵
        
        PID:7952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45713.exe
        6⤵
        
        PID:12740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17994.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:16804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32432.exe
        5⤵
        
        PID:7844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60512.exe
        5⤵
        
        PID:11340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7065.exe
        5⤵
        
        PID:15248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42307.exe
        5⤵
        
        PID:5772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55385.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55385.exe
      4⤵
      PID:6972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15209.exe
        5⤵
        
        PID:9364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13977.exe
        5⤵
        
        PID:13604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9401.exe
        5⤵
        
        PID:16016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41280.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41280.exe
      4⤵
      PID:9800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45010.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45010.exe
      4⤵
      PID:14172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10241.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10241.exe
      4⤵
      PID:11376
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33176.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33176.exe
    3⤵
    PID:2556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48722.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48722.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36730.exe
        5⤵
        
        PID:8108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7560.exe
        5⤵
        
        PID:10832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23592.exe
        5⤵
        
        PID:14724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25658.exe
        5⤵
        
        PID:16824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41856.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41856.exe
      4⤵
      PID:9088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48400.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48400.exe
      4⤵
      PID:6940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24769.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24769.exe
      4⤵
      PID:16864
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40584.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40584.exe
    3⤵
    PID:6100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11945.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11945.exe
      4⤵
      PID:8368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50235.exe
        5⤵
        
        PID:7160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9584.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9584.exe
      4⤵
      PID:12668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41305.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41305.exe
      4⤵
      PID:17156
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14944.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14944.exe
    3⤵
    PID:9332
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24912.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24912.exe
    3⤵
    PID:13588
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51427.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51427.exe
    3⤵
    PID:15612
- C:\Users\Admin\AppData\Local\Temp\Unicorn-7104.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-7104.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4984
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34402.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34402.exe
    3⤵
    PID:3000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12017.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12017.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17514.exe
        5⤵
        
        PID:7216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47057.exe
        5⤵
        
        PID:11220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46177.exe
        5⤵
        
        PID:15312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17297.exe
        5⤵
        
        PID:6540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31663.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31663.exe
      4⤵
      PID:8828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23298.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23298.exe
      4⤵
      PID:13168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51619.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51619.exe
      4⤵
      PID:5028
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33672.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33672.exe
    3⤵
    PID:6984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61914.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61914.exe
      4⤵
      PID:7816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34664.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34664.exe
      4⤵
      PID:11396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24776.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24776.exe
      4⤵
      PID:5256
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58856.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58856.exe
    3⤵
    PID:8460
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25794.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25794.exe
    3⤵
    PID:12512
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51082.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51082.exe
    3⤵
    PID:552
- C:\Users\Admin\AppData\Local\Temp\Unicorn-44642.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-44642.exe
  2⤵
  PID:712
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39314.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39314.exe
    3⤵
    PID:7164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44426.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44426.exe
      4⤵
      PID:8848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1226.exe
        5⤵
        
        PID:17588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9008.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9008.exe
      4⤵
      PID:11432
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33400.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33400.exe
      4⤵
      PID:15948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41305.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41305.exe
      4⤵
      PID:16908
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4472.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4472.exe
    3⤵
    PID:7148
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19928.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19928.exe
    3⤵
    PID:12944
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51658.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51658.exe
    3⤵
    PID:15372
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26776.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26776.exe
    3⤵
    PID:15876
- C:\Users\Admin\AppData\Local\Temp\Unicorn-10255.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-10255.exe
  2⤵
  PID:6640
- C:\Users\Admin\AppData\Local\Temp\Unicorn-13680.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-13680.exe
  2⤵
  PID:10180
- C:\Users\Admin\AppData\Local\Temp\Unicorn-20369.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-20369.exe
  2⤵
  PID:13800
- C:\Users\Admin\AppData\Local\Temp\Unicorn-41098.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-41098.exe
  2⤵
  PID:3236

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3548 -ip 3548
1⤵
PID:5564

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 10868 -ip 10868
1⤵
PID:11200

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 10876 -ip 10876
1⤵
PID:10412

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 10892 -ip 10892
1⤵
PID:10468

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 10884 -ip 10884
1⤵
PID:10708

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:5324

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 6508 -ip 6508
1⤵
PID:14972

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-10073.exe

Filesize
468KB

MD5
38c1f3435869ac741a71f7928ddb7802

SHA1
1c65b2a25b4207cabf824f28f1deb20a92371a19

SHA256
8b521ec3af4b497d27554e71596e534d3d6fa300696071a1c9f25d3f2cfc1c87

SHA512
d32de9bd82153626fb927aa06f4c27c75971282ffbbc42d18b3844494162402de7ac74f2222acf6e97ad51c6d53a57ed90d588919a0fafb19299debbf766d4c9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-10488.exe

Filesize
468KB

MD5
b0fdf6c3abc687ab9a92701c15386733

SHA1
afb6a94ffb465b3a84523bdc59468059b7ddb1a1

SHA256
838e100f00c3262eb4c5d790f14c082c145a072aeca8ee63a9e135303f44690c

SHA512
aeb5356b61c1731d25330efe4ca0022debe3a7c41eaab67e0316e54f956eb929449da68a2452c22b3940c609f12f452b43009d4729fe0d720d69ac98d6b3ff8d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-14119.exe

Filesize
468KB

MD5
fc9d14bbde5c9e904c30f20bcc6a87e1

SHA1
20dc94a693c93f8d1c31015d77776f4f32d5b45c

SHA256
fee0020d3f00209530b02b24ace69875b8ac9eb2d2a8e877d0657281b4401033

SHA512
50568a2069cb8f8da9e2e76e12333f13d8eabcc38899de364dab93e14ca1e211b4be16c443b9fceaea7de150e01a80717c816adb7bb01308ad3474ae32617417

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-18314.exe

Filesize
468KB

MD5
f629f1e363ff40cb4529d44ea043415b

SHA1
a4b838cc6da68ab8491cb5b748ad17f95d1133f9

SHA256
14da8af71dea3116856c9e580a4679d6e848c5ef2d1ebabc85b09d8cbc333f25

SHA512
5875dc482cf9a187966fa0cc8c86fa158319335aeb4961208824aa9ee95c797157f3d89d66a2d39016c751a4657515a28d28afe397463de58fdadb3addaf3230

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-20370.exe

Filesize
468KB

MD5
c098731d3f5db066f5fded9ebc02db23

SHA1
1d5b2b930538c36b5b50058fb0f270ec092fe5e4

SHA256
722a649046b31a9d3e636d2b8c88effb97ca89e9d4d70cda9b235872906713fb

SHA512
4ebe0c6c918b477f9e7f826712159ccfe4d11efff12cb38fa91bdc9816193017500c6c20a7834d28f92c7e037844f1eff0f03f8ea2c7ffa5bba1f0767498aa0b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-21536.exe

Filesize
468KB

MD5
fe9a1a92a1d9d7e99b218354e94a1de6

SHA1
d5c67d93346e66c0e35058cfb38284ba2df05f90

SHA256
bde61430bc413a17763956cc85629ea9d6206d3176ee72ba529982d5a95807f0

SHA512
5120b6e24a256973faac08701b73066ace57f0f5909732d78a2b36639cc922a2418b4cc291b2c04391395e3106bba090f689bf023318e48a0f7563ea98a82a90

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-23455.exe

Filesize
468KB

MD5
85ca5059b63463b3ab8be1701f6c9b06

SHA1
6fc83862cd050799eb07837d44570184491db774

SHA256
040ce795a580e51c8d4af6362709b43d3fec6daaef48901aa491875cea42ea12

SHA512
255fef8abd13eba53aad607ce52547fb5eb45584b2386dc5af12a205372666b1c8c1803e2eaebe127337b99d76bb24ddba3b05c9e5dade53fabe26a2f82144c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-25376.exe

Filesize
468KB

MD5
4bd09317d18f95308abc9e660b09f439

SHA1
b760ff622c6525a98859daa2525b90df8ca26b40

SHA256
9558885a2259a044b82bd08cf226e456d0a852130a665975a8599fd336fa6a6e

SHA512
1ee8c906e22dc0b890c3904864b54b9186f159dfc7618acf21d2a4ec8f5879b4b2a5fcb82101187735d127f5569cf0287852be705402b4f70e88dc69fc767bcb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-28330.exe

Filesize
468KB

MD5
76ed1753a2684cafd7accb7f054eb6df

SHA1
b0c635cb98491d78dfc021973a17909a30c1c35c

SHA256
3e8f2bbf4db5e57218c19317c9b8684864697c604223bded4f3167b440a9f121

SHA512
12201f252ce15026b8902982b6f4a943206ce3ddf2199e7059d50ea126ee589364f82e1ce724e7899ef535528458e0b10c38dc3c029b6501b8c98821488e65f5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-29010.exe

Filesize
468KB

MD5
5a8f6600f300c1a7cf955c8804cae2b1

SHA1
0084be3c48b57e956ce66ac032e5e241f67f8dea

SHA256
b938b7fa9388c2c349a9f3970a272a91d259115c87faf9a3c4ddbd054491e2b5

SHA512
70f0090111c2fa0811134381d4dae55c16994d3633e728a18b2d9a038d4eac00bec9b36655503e131b8a2628310d7bf901922b85cdc09daf8c0e43b8c1e0e433

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-30089.exe

Filesize
468KB

MD5
e5a075ad013bb9e3de44e6b7c46b22b3

SHA1
5323667ff4b47020f5f4bf695065a0f181caec91

SHA256
108af4a186e74ae67d62980a8529f40567a9a06334680c697d6389634983ff8e

SHA512
44baec389e7d866313d64fe53738b2fdde671b4ace93eed0e0087be01a92dd6af6c0d54c0833a4934f23d11ece311ecb4151e33d4e13cabd06f40752297a0ffb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-30162.exe

Filesize
468KB

MD5
30d4787ad2039d81d70a2cd7aac4ea6d

SHA1
387cb16f775c00c9a1bd6be2df5a8ea8a3129e3a

SHA256
28503838ab90ade5c59a85287d06e9e57cc3b6c90ba376dec71ef405cde48e91

SHA512
a8bdbd3f17600981e6fd58d9f8e4769f9e81f20888684d4b2b075745c20c34c74db0bb1a8144296a5b3e0dab17f45ef9fc3f65c5de760c5788da6d8451c66b0e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-30367.exe

Filesize
468KB

MD5
35d4bd20aaa811fddf230f4ab2bedacb

SHA1
9fa38618e70b98fe88d7680adf80f8b806cf6c16

SHA256
009157646bf51e8fc3631528163400c8be618d1b2b6106ea37c425ff99c18cd5

SHA512
b277d501f4b07c8a16e4716280eafdf92337fbfb1984ddb452e38905c8a6d95c1fec650a961bf9b165e72190554a5c2c7e32eec32a3a4af04639e037c16dcb79

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-30456.exe

Filesize
468KB

MD5
d327dc86e32c72fe07772b36e3a712db

SHA1
5ebf7def1848c7d3fb40d62060ceb3b9b74564c4

SHA256
19ffeaf135359cc6256ff4155ee2f0a937a86181016dcfc55bd194157a441794

SHA512
0a41bfaeeda0ab40488ebefd4e2e2ba1812f5a17c72522d06c17ca7d46980ceaa90a81f5cebf9a50f99175c0c8d31fd9d05250aaecf8f47c4c02e164afba6c77

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-31506.exe

Filesize
468KB

MD5
49ef5fd7d3699cf6d5d42c98709ef0c4

SHA1
1f802aa9c5b0a11c27a5a6a9f111b0a164308f88

SHA256
1415c0fdc0843e3e19889f6eefae06058bd52884044e2f061fbbea30459ba6b9

SHA512
fc5cd8893b1c5eae8e8ad323e3068575f5960fb8cd611950d71be5689e998d603a5608bdeb095b50506988668b97b3e3fb392ea243bc7253023175dea857d714

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-32969.exe

Filesize
468KB

MD5
42e60c7896d0c8e8a714ed9e235ed0e3

SHA1
a380e63db97076f199a038908c88df05807cbd67

SHA256
2cd8767acfc5da44e881fa7eacefafbc887dc8a03ac70dbdefb5b480d3e20ac0

SHA512
0fcbe810f260dd990f8f2f5028f52ef4632541f65e082558455c7c6fa93f47c0001ab00b626e80afa85e35af8147e3e2da491f354ab49a36d2e260839f86cce5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-36306.exe

Filesize
468KB

MD5
480defeba1b17d8e126876606f85469c

SHA1
8641829b63461b2fff09341d5eba093459e8aa3c

SHA256
4911ca1842efc4b6586e327369fa0d68de7f833c76210bae253cc47c2159a6a9

SHA512
398ca0f9aea9f4005246b169e5ce36f31c7b12728a1c677b387227105eeaecb908c7acdbe0d22d891cadeb779d3994c8de10990d25f954593e4719a6f62c0d8c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-3633.exe

Filesize
468KB

MD5
01edd42aa8bfd34e242c3b7744c180cb

SHA1
4d6acba56f843ab3e67d6557c94e9e3039950a73

SHA256
35b8573bd9f5f6f9786768409f2deb28f7c1f87b2874efce6dc903adab8599a5

SHA512
c931687b0fe3ee4a402f8255bdd8d18052317fe571fe7d8d93ccafbfd527322bec651247f7de0990426f07c78d12e67354187c4821b5f2ef5101c31719d1f84c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-3697.exe

Filesize
468KB

MD5
0221a68ee52e1558adcc091737e396aa

SHA1
062dd4c91d26407b57ebb3541194b5e666842eae

SHA256
b9d06f72ebd4a27aeedeba6b21f4e21e014e747441138caa11c19aa70d92870f

SHA512
a6e8f7f8912e0046178855aa5bdc710257f20f140cdae262dbd86650093139a243ec62db6068ae99c6a305301a21276020375283e9a4fbcdc88d0cf0a2a011d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-384.exe

Filesize
468KB

MD5
325f2115e020ecdeab072f085fa32fa5

SHA1
2dc3ae333449473ac70b00c9c623ebc84b5150b4

SHA256
fa2b4679d748526a08fa058942689ddc1732104a97330b23c6264219390fd2bd

SHA512
2bef0f369a9d4e3f77a580d49ad370efb26a6e6be662da3ae0be9779067ac3ab73e608bb8dddb6e2326ceaa62dc9dab7b3a7e4e29ab20fda32db41deb736367b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-38522.exe

Filesize
468KB

MD5
a4017acac6d0291dfc8ce007e47ad563

SHA1
000d25cd92517a3b40d2a362c71e69df82d21fc9

SHA256
a528f1d6262ef0bf43a5e920820e7ec91ce5d14701356eb540d70cf7c0bffd04

SHA512
070469580e2ff0454f5bb9a6e60107fc5418129c22c0be8d9ce1a8a886bb3efc18ab4cd35510f7de958a2f89c12953f2c02b740621794a8704500aa3907ab297

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-41402.exe

Filesize
468KB

MD5
e5a3cf41bedd0f3f1f22db6a8f3e56c4

SHA1
972df0ce0ae062ef96161d430520389f3ac89fa5

SHA256
1b8ffa2ee2a9323b9361e749b479ff2d2690774f1471d8e05a1aa41e7017d10a

SHA512
3f4cbe42baf0d215137e8b71360760fa2a88903c67b76ba0cec60835110d23f30ac627ca745f8ef2a49de1db6b956837fe6c7f32539deda5456a37cbc81c0816

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-44401.exe

Filesize
468KB

MD5
fc59a2beedb2ef43bad8f46bb39a4c0d

SHA1
1ebc68ad1c2fed43b5d3b509205d5e1814272a0e

SHA256
a50da458dbf4e0160136b99462f9a2c36485f67f3be5b8de07aad0aa87ea51bf

SHA512
df454220a8a57117f90ed8e3f5807691da9153804132372b47ece56b6e9b49059fce010cc6b22f3560859aeac1da9fc32d464acaee8ce752bc522faa6307dfa6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-45922.exe

Filesize
468KB

MD5
dd873d70955b50e7ff1785018e76d2f7

SHA1
7e2c70eefcaf6061b3f5c94353611d867b6c3b1f

SHA256
ef1bdb33c0cd967541ec17bfb4bd04307c5a1016c6baf14597c6c7b498806a48

SHA512
ccb72d469d1e97d7c066d427538b24412b89055bdc2d93eaf7edc82ffe6a43f8eaf9d71243155153ff8d709cf52b1d1dc654462d8439c7ad964b12f86ce0cd38

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-46809.exe

Filesize
468KB

MD5
5194b2af1fbd7b2a6b5551511eb8e35f

SHA1
3d3d2464f10b655bc306f8dc79b6fd3f07bfc23f

SHA256
73cb293337c4a437e897febfcf6a0755c06d905c788e82531d6eccdade8c1f33

SHA512
907af1aff882904cd7b5dcfbc8b211c00d795351596a81eb92489ace82accb0e24d2174cc86efcb0ae48b0c29df47003d6a81a542959140e9459c49f73852d62

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-49305.exe

Filesize
468KB

MD5
698ee1d2aa8560468c2f790c47b06d6d

SHA1
8bffcec823a8a1efbe2c94223918bbea58053735

SHA256
6c363039106c5f550356a9290019a61e57423db192cc8b9db46e7832dcff8412

SHA512
2a12c1e5751cc7dc6ccf8dffada469dbf91617d13529be631e7069eb544d5f2e3292a8e406c7bb9cde0beb2a0e2c629e6ac1122930f7db7090e26a2982f3b9f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-49482.exe

Filesize
468KB

MD5
2766fce4086dab552c6245cfa99ecc81

SHA1
8752133664ed2afb4caa0603ad9f562c3712a1e8

SHA256
6d7d63fb6b67c4a339c05ac6be2c7df163ecd6ead478b108bd498d034a47b91e

SHA512
d54003ed1bd411be4c1e8d57d82dee8f4ca4c2cd8f61e3dbea39d1b5eb5d4e7777114cb0207ba26983ae47cda277c21616ee6a0b051b8b652d20edf85566ca75

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-52922.exe

Filesize
468KB

MD5
e3dab0dea2695da92897185372ea3774

SHA1
56063e365e5e3ee4a9ec20fe32e9b9e604a4b934

SHA256
2fb201c4ebe0989529cd3289933c82ac4b3657585869bca47851f9d67a25db41

SHA512
0c327dcf26d1af2d0df549db1de83a7a69416c0344b7a9af94ec441fd3bd197c236c20dec540899901cbe6259c0d9fd580e0a2e83198a209071ecc11246a9e31

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-54858.exe

Filesize
468KB

MD5
679c2c47b64b88d9944e6f071f8d130b

SHA1
dc176716765fa743e4431138c017e636475ed0f3

SHA256
ceeb93819eb5382f8f7f833e169d0d1fec7affa95af051fc9d87f45188d2f691

SHA512
10a2b25b6c99b6fac4eea6c714ee5a25160b94eb094f3664fc5f5b103d43b990928b25519c7993442c43ca28bb8674c7c7e2e122185f2c50291844bef00cfe49

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-55440.exe

Filesize
468KB

MD5
b1c6ae0da87cc4a9bf9948c78db5497d

SHA1
950e90becd202eae266e09eb537908ad740e1f83

SHA256
d7269d84588a11615fb2f90ee1804b8f5c1bb4c185b187192f6d25752837e3f5

SHA512
e8f4b05e255866a62c60b1314828881355c3c050c490ce203df2a96c639826ce700d61749a235855edb086d18669585f6b3f5ac811feb6451c6dcd9ca4aa9202

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-56306.exe

Filesize
468KB

MD5
9dca9054dafbb62f44d1a3a5b67b15f2

SHA1
6aa45dbaa8dbcfd06527f4a91b8e2ecf4291e007

SHA256
cd24613ca3ea603aef141724692cb0267b777e79bdba8d524d88d849e51cfe8b

SHA512
9149ccc794d3dde3adc3fd082e6ea8841b9323e5e0f539feb24c990a66d0d178a0d6bd67b947fcd253db2c57a0d01798075f404daae3332be7dadcec79bcaa0f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-58490.exe

Filesize
468KB

MD5
e7e7ee1785873a25c4a730685a85dd58

SHA1
43bedf130954d37722e109b744d41474ac4128b9

SHA256
69a662694c2695fb25978c99069dd76544548afa5c17fdf96ed9f2eab218811d

SHA512
2614af1032496f9921c1100d11f950ceae99107c9d1308d078ab4da42c59cee6fb4671f07a2a9a8c47ed72c42e832e94e02391e1e637cab161e7630b62a705b7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-60265.exe

Filesize
468KB

MD5
03ae51d746b24013db724056378f6e27

SHA1
5f9a56ec520f16b6ca67401a3361b406fe7b7cd5

SHA256
da181a817b7469fe23eee500a0d327f972af1274a7dd2cdb3a96446948a5f88d

SHA512
1bdc307669577d188fa610854ad94363d59474cf4dbf60113c42b7bf08602189ae6422e88c751590c8cf397c07a6902607d6f65486fed2e2ba1c4e11a719fe2a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-7695.exe

Filesize
468KB

MD5
15643a69062c5b6b1d17e00a62bb413d

SHA1
3329c069f26ef537ee734f548125595cd9869fc2

SHA256
40dde8716d4f30e9ecd444cb3b62227b08f3ced41d0a2dd8ec574557c51d2e94

SHA512
bad07cbfc5a904f4a4d467cec7ac8b409dfc6e1ee33614a06ca9072027fc646987fa2bcaa4e93cf7b3429b5c75bca714e34a258da06c736903186b4ba565fef4

Download Submit
memory/228-246-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/432-388-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/452-240-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/544-307-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/684-381-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/712-455-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/860-41-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/900-258-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1016-113-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1104-296-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1108-13-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1132-190-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1152-201-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1192-235-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1288-450-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1296-228-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1368-19-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1404-407-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1568-227-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1600-408-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1676-168-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1748-393-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1828-182-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1884-50-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1900-454-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1940-304-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1964-348-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2012-409-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2056-127-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2152-311-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2308-399-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2396-164-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2452-322-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2528-456-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2556-471-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2616-30-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2648-449-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2676-81-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2712-306-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2736-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2824-410-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3000-427-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3008-257-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3196-120-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3412-57-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3484-368-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3536-105-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3548-390-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3580-341-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3596-391-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3632-292-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3656-70-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3664-382-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3784-293-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3792-383-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3884-219-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3964-174-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3976-6-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4092-394-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4172-71-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4208-132-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4252-437-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4276-305-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4280-344-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4324-451-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4348-308-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4512-404-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4532-99-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4564-202-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4616-423-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4652-211-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4672-154-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4704-87-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4772-180-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4896-42-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4912-272-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4984-309-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5012-255-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5088-82-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5132-457-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5180-475-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5332-491-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5348-492-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5364-493-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5404-494-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5472-503-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5648-538-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5660-539-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5668-541-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5692-545-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5716-546-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5736-553-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5744-552-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5852-559-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5900-558-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/6040-582-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/14600-2720-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads