d33f1219a2e9de77d1d55fdab4bd113c628685d1360d3840852ac1a44e7edb6e

Analysis

max time kernel
120s
max time network
111s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
30/09/2024, 04:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d33f1219a2e9de77d1d55fdab4bd113c628685d1360d3840852ac1a44e7edb6eN.exe
Size

468KB
MD5

2d9346ea1beb34972389d37681dab310
SHA1

4287bb87c5ab21066d9554d35108a68c74f3ddc6
SHA256

d33f1219a2e9de77d1d55fdab4bd113c628685d1360d3840852ac1a44e7edb6e
SHA512

c42722bd0a9e4002b6461b7c7bf2ceec72d3ff5faffd2e82d1b5e6e001750112d747320450042d2396f5de5d871a246c3fe4223a44f6a6f26be9e7a180fa15d6
SSDEEP

3072:2rz7ogKxjx8YFbYOPz3yRf8/Eptj6PpwPmHx+lOvEln0ycZ1SOlm:2rfotyYFlPDyRfuB9lEl0nZ1S

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
4912	Unicorn-21131.exe
4304	Unicorn-40202.exe
1344	Unicorn-61177.exe
3864	Unicorn-8209.exe
2264	Unicorn-4680.exe
3668	Unicorn-18415.exe
2980	Unicorn-56611.exe
1636	Unicorn-64265.exe
3292	Unicorn-10425.exe
1964	Unicorn-2833.exe
3416	Unicorn-2568.exe
2260	Unicorn-62240.exe
4572	Unicorn-33869.exe
2500	Unicorn-25509.exe
2956	Unicorn-25509.exe
3620	Unicorn-19954.exe
1196	Unicorn-26085.exe
2964	Unicorn-26085.exe
992	Unicorn-6219.exe
3944	Unicorn-25820.exe
1228	Unicorn-6219.exe
2576	Unicorn-14387.exe
3684	Unicorn-25322.exe
4896	Unicorn-35784.exe
4880	Unicorn-3988.exe
4476	Unicorn-20325.exe
2856	Unicorn-49852.exe
2660	Unicorn-48700.exe
1416	Unicorn-48700.exe
2896	Unicorn-3604.exe
448	Unicorn-11772.exe
4788	Unicorn-28109.exe
5056	Unicorn-28109.exe
944	Unicorn-3412.exe
3596	Unicorn-57252.exe
5016	Unicorn-29458.exe
1388	Unicorn-38124.exe
4056	Unicorn-24090.exe
2020	Unicorn-32258.exe
2276	Unicorn-12923.exe
216	Unicorn-18523.exe
3068	Unicorn-32258.exe
3396	Unicorn-33485.exe
3552	Unicorn-49821.exe
4044	Unicorn-29955.exe
232	Unicorn-620.exe
3264	Unicorn-46292.exe
2592	Unicorn-5259.exe
1028	Unicorn-15997.exe
2292	Unicorn-26202.exe
4760	Unicorn-65389.exe
4680	Unicorn-24357.exe
4948	Unicorn-7282.exe
4744	Unicorn-21581.exe
4868	Unicorn-7666.exe
3172	Unicorn-5628.exe
3324	Unicorn-13796.exe
3076	Unicorn-21965.exe
1684	Unicorn-21965.exe
4304	Unicorn-21965.exe
3276	Unicorn-13604.exe
4580	Unicorn-13604.exe
3128	Unicorn-23885.exe
3640	Unicorn-23885.exe

Program crash 51 IoCs

pid	pid_target	Process	procid_target
2020	4304	WerFault.exe	85
2292	2260	WerFault.exe	101
2700	3620	WerFault.exe	108
796	2964	WerFault.exe	111
3536	1228	WerFault.exe	113
5568	2592	WerFault.exe	147
5924	3128	WerFault.exe	163
5632	4536	WerFault.exe	173
6292	4876	WerFault.exe	166
5116	2856	WerFault.exe	120
6184	2292	WerFault.exe	149
2264	5696	WerFault.exe	213
5048	3776	WerFault.exe	188
2448	5240	WerFault.exe	310
7912	3684	WerFault.exe	115
7628	3540	WerFault.exe	245
6684	6128	WerFault.exe	223
10640	4092	WerFault.exe	167
9728	6996	WerFault.exe	287
10788	6424	WerFault.exe	278
10848	6028	WerFault.exe	247
11888	7904	WerFault.exe	444
12764	6248	WerFault.exe	343
12848	5676	WerFault.exe	211
11700	3472	WerFault.exe	324
15136	7228	WerFault.exe	399
15356	2520	WerFault.exe	360
1948	7792	WerFault.exe	414
14108	5256	WerFault.exe	391
6504	7952	WerFault.exe	421
6708	5632	WerFault.exe	375
524	5684	WerFault.exe	381
1204	6208	WerFault.exe	366
15076	6092	WerFault.exe	436
13156	7784	WerFault.exe	413
13428	4128	WerFault.exe	393
8784	7676	WerFault.exe	407
14724	6832	WerFault.exe	387
14504	2128	WerFault.exe	226
14460	7992	WerFault.exe	422
3980	4500	WerFault.exe	225
15232	6044	WerFault.exe	260
1556	6216	WerFault.exe	266
14836	6432	WerFault.exe	279
6560	6756	WerFault.exe	282
6660	1028	WerFault.exe	148
15148	2964	WerFault.exe	176
15668	4572	WerFault.exe	104
13884	7316	WerFault.exe	401
16240	5992	WerFault.exe	326
16232	4936	WerFault.exe	327

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2644.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8996.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50661.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56644.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63432.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56484.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45347.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40307.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6867.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32349.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56204.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32298.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31842.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13442.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16067.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61973.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33869.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56411.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3778.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18539.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64579.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58588.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50844.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5172.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38588.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22731.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53605.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40411.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22536.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17555.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61973.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3971.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28948.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1148.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61973.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25509.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54502.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32085.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4245.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26939.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7666.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53013.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29171.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-620.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51788.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3093.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52804.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18507.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49852.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59567.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32275.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51788.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2139.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61512.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	12080	dwm.exe
Token: SeChangeNotifyPrivilege	12080	dwm.exe
Token: 33	12080	dwm.exe
Token: SeIncBasePriorityPrivilege	12080	dwm.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
1604	d33f1219a2e9de77d1d55fdab4bd113c628685d1360d3840852ac1a44e7edb6eN.exe
4912	Unicorn-21131.exe
4304	Unicorn-40202.exe
1344	Unicorn-61177.exe
3864	Unicorn-8209.exe
2264	Unicorn-4680.exe
3668	Unicorn-18415.exe
2980	Unicorn-56611.exe
1636	Unicorn-64265.exe
3292	Unicorn-10425.exe
2260	Unicorn-62240.exe
3416	Unicorn-2568.exe
1964	Unicorn-2833.exe
4572	Unicorn-33869.exe
2500	Unicorn-25509.exe
2956	Unicorn-25509.exe
2964	Unicorn-26085.exe
3684	Unicorn-25322.exe
2576	Unicorn-14387.exe
3944	Unicorn-25820.exe
1228	Unicorn-6219.exe
992	Unicorn-6219.exe
3620	Unicorn-19954.exe
1196	Unicorn-26085.exe
4896	Unicorn-35784.exe
4476	Unicorn-20325.exe
4880	Unicorn-3988.exe
2856	Unicorn-49852.exe
2660	Unicorn-48700.exe
1416	Unicorn-48700.exe
2896	Unicorn-3604.exe
448	Unicorn-11772.exe
4788	Unicorn-28109.exe
5056	Unicorn-28109.exe
3068	Unicorn-32258.exe
216	Unicorn-18523.exe
2020	Unicorn-32258.exe
5016	Unicorn-29458.exe
1388	Unicorn-38124.exe
2276	Unicorn-12923.exe
944	Unicorn-3412.exe
4056	Unicorn-24090.exe
3596	Unicorn-57252.exe
3396	Unicorn-33485.exe
3552	Unicorn-49821.exe
232	Unicorn-620.exe
3264	Unicorn-46292.exe
4044	Unicorn-29955.exe
2592	Unicorn-5259.exe
1028	Unicorn-15997.exe
2292	Unicorn-26202.exe
4760	Unicorn-65389.exe
4680	Unicorn-24357.exe
4948	Unicorn-7282.exe
4744	Unicorn-21581.exe
3172	Unicorn-5628.exe
3324	Unicorn-13796.exe
4580	Unicorn-13604.exe
4304	Unicorn-21965.exe
3076	Unicorn-21965.exe
4868	Unicorn-7666.exe
3276	Unicorn-13604.exe
1684	Unicorn-21965.exe
3640	Unicorn-23885.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1604 wrote to memory of 4912	1604	d33f1219a2e9de77d1d55fdab4bd113c628685d1360d3840852ac1a44e7edb6eN.exe	82
PID 1604 wrote to memory of 4912	1604	d33f1219a2e9de77d1d55fdab4bd113c628685d1360d3840852ac1a44e7edb6eN.exe	82
PID 1604 wrote to memory of 4912	1604	d33f1219a2e9de77d1d55fdab4bd113c628685d1360d3840852ac1a44e7edb6eN.exe	82
PID 4912 wrote to memory of 4304	4912	Unicorn-21131.exe	85
PID 4912 wrote to memory of 4304	4912	Unicorn-21131.exe	85
PID 4912 wrote to memory of 4304	4912	Unicorn-21131.exe	85
PID 1604 wrote to memory of 1344	1604	d33f1219a2e9de77d1d55fdab4bd113c628685d1360d3840852ac1a44e7edb6eN.exe	86
PID 1604 wrote to memory of 1344	1604	d33f1219a2e9de77d1d55fdab4bd113c628685d1360d3840852ac1a44e7edb6eN.exe	86
PID 1604 wrote to memory of 1344	1604	d33f1219a2e9de77d1d55fdab4bd113c628685d1360d3840852ac1a44e7edb6eN.exe	86
PID 1344 wrote to memory of 3864	1344	Unicorn-61177.exe	90
PID 1344 wrote to memory of 3864	1344	Unicorn-61177.exe	90
PID 1344 wrote to memory of 3864	1344	Unicorn-61177.exe	90
PID 1604 wrote to memory of 3668	1604	d33f1219a2e9de77d1d55fdab4bd113c628685d1360d3840852ac1a44e7edb6eN.exe	91
PID 1604 wrote to memory of 3668	1604	d33f1219a2e9de77d1d55fdab4bd113c628685d1360d3840852ac1a44e7edb6eN.exe	91
PID 1604 wrote to memory of 3668	1604	d33f1219a2e9de77d1d55fdab4bd113c628685d1360d3840852ac1a44e7edb6eN.exe	91
PID 4912 wrote to memory of 2264	4912	Unicorn-21131.exe	92
PID 4912 wrote to memory of 2264	4912	Unicorn-21131.exe	92
PID 4912 wrote to memory of 2264	4912	Unicorn-21131.exe	92
PID 3864 wrote to memory of 2980	3864	Unicorn-8209.exe	96
PID 3864 wrote to memory of 2980	3864	Unicorn-8209.exe	96
PID 3864 wrote to memory of 2980	3864	Unicorn-8209.exe	96
PID 1344 wrote to memory of 1636	1344	Unicorn-61177.exe	97
PID 1344 wrote to memory of 1636	1344	Unicorn-61177.exe	97
PID 1344 wrote to memory of 1636	1344	Unicorn-61177.exe	97
PID 2264 wrote to memory of 3292	2264	Unicorn-4680.exe	98
PID 2264 wrote to memory of 3292	2264	Unicorn-4680.exe	98
PID 2264 wrote to memory of 3292	2264	Unicorn-4680.exe	98
PID 3668 wrote to memory of 1964	3668	Unicorn-18415.exe	99
PID 3668 wrote to memory of 1964	3668	Unicorn-18415.exe	99
PID 3668 wrote to memory of 1964	3668	Unicorn-18415.exe	99
PID 1604 wrote to memory of 3416	1604	d33f1219a2e9de77d1d55fdab4bd113c628685d1360d3840852ac1a44e7edb6eN.exe	100
PID 1604 wrote to memory of 3416	1604	d33f1219a2e9de77d1d55fdab4bd113c628685d1360d3840852ac1a44e7edb6eN.exe	100
PID 1604 wrote to memory of 3416	1604	d33f1219a2e9de77d1d55fdab4bd113c628685d1360d3840852ac1a44e7edb6eN.exe	100
PID 4912 wrote to memory of 2260	4912	Unicorn-21131.exe	101
PID 4912 wrote to memory of 2260	4912	Unicorn-21131.exe	101
PID 4912 wrote to memory of 2260	4912	Unicorn-21131.exe	101
PID 2980 wrote to memory of 4572	2980	Unicorn-56611.exe	104
PID 2980 wrote to memory of 4572	2980	Unicorn-56611.exe	104
PID 2980 wrote to memory of 4572	2980	Unicorn-56611.exe	104
PID 1636 wrote to memory of 2500	1636	Unicorn-64265.exe	105
PID 3292 wrote to memory of 2956	3292	Unicorn-10425.exe	106
PID 1636 wrote to memory of 2500	1636	Unicorn-64265.exe	105
PID 1636 wrote to memory of 2500	1636	Unicorn-64265.exe	105
PID 3292 wrote to memory of 2956	3292	Unicorn-10425.exe	106
PID 3292 wrote to memory of 2956	3292	Unicorn-10425.exe	106
PID 1344 wrote to memory of 3620	1344	Unicorn-61177.exe	108
PID 1344 wrote to memory of 3620	1344	Unicorn-61177.exe	108
PID 1344 wrote to memory of 3620	1344	Unicorn-61177.exe	108
PID 3416 wrote to memory of 1196	3416	Unicorn-2568.exe	109
PID 3416 wrote to memory of 1196	3416	Unicorn-2568.exe	109
PID 3416 wrote to memory of 1196	3416	Unicorn-2568.exe	109
PID 1964 wrote to memory of 2964	1964	Unicorn-2833.exe	111
PID 1964 wrote to memory of 2964	1964	Unicorn-2833.exe	111
PID 1964 wrote to memory of 2964	1964	Unicorn-2833.exe	111
PID 3864 wrote to memory of 992	3864	Unicorn-8209.exe	110
PID 3864 wrote to memory of 992	3864	Unicorn-8209.exe	110
PID 3864 wrote to memory of 992	3864	Unicorn-8209.exe	110
PID 2264 wrote to memory of 1228	2264	Unicorn-4680.exe	113
PID 2264 wrote to memory of 1228	2264	Unicorn-4680.exe	113
PID 2264 wrote to memory of 1228	2264	Unicorn-4680.exe	113
PID 4912 wrote to memory of 3944	4912	Unicorn-21131.exe	112
PID 4912 wrote to memory of 3944	4912	Unicorn-21131.exe	112
PID 4912 wrote to memory of 3944	4912	Unicorn-21131.exe	112
PID 3668 wrote to memory of 2576	3668	Unicorn-18415.exe	114

C:\Users\Admin\AppData\Local\Temp\d33f1219a2e9de77d1d55fdab4bd113c628685d1360d3840852ac1a44e7edb6eN.exe
"C:\Users\Admin\AppData\Local\Temp\d33f1219a2e9de77d1d55fdab4bd113c628685d1360d3840852ac1a44e7edb6eN.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1604
- C:\Users\Admin\AppData\Local\Temp\Unicorn-21131.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-21131.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4912
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40202.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40202.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4304
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4304 -s 720
      4⤵
      Program crash
      PID:2020
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4680.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4680.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10425.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10425.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25509.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3988.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-620.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43293.exe
        8⤵
        
        PID:3568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36573.exe
        9⤵
        
        PID:5512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57149.exe
        10⤵
        
        PID:6976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36509.exe
        11⤵
        
        PID:8712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5020.exe
        12⤵
        
        PID:13596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40971.exe
        11⤵
        
        PID:12648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58164.exe
        10⤵
        
        PID:10128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31842.exe
        10⤵
        
        PID:13844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53231.exe
        9⤵
        
        PID:5560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22285.exe
        10⤵
        
        PID:9556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50095.exe
        10⤵
        
        PID:13552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55755.exe
        9⤵
        
        PID:10748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61247.exe
        9⤵
        
        PID:14204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30459.exe
        8⤵
        
        PID:6432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23133.exe
        9⤵
        
        PID:6560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36509.exe
        10⤵
        
        PID:8484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-795.exe
        9⤵
        
        PID:10096
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6432 -s 640
        9⤵
        Program crash
        
        PID:14836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-85.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-85.exe
        8⤵
        
        PID:7800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36509.exe
        9⤵
        
        PID:8504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25979.exe
        9⤵
        
        PID:12416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53668.exe
        9⤵
        
        PID:13268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12227.exe
        8⤵
        
        PID:10144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20874.exe
        8⤵
        
        PID:13800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7667.exe
        7⤵
        
        PID:3776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61845.exe
        8⤵
        
        PID:6028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13428.exe
        9⤵
        
        PID:5248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33821.exe
        10⤵
        
        PID:8016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15773.exe
        11⤵
        
        PID:11996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-899.exe
        10⤵
        
        PID:12136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24262.exe
        11⤵
        
        PID:208
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6028 -s 740
        9⤵
        Program crash
        
        PID:10848
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3776 -s 724
        8⤵
        Program crash
        
        PID:5048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44195.exe
        7⤵
        
        PID:6404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32085.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:7176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41621.exe
        9⤵
        
        PID:12204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15523.exe
        9⤵
        
        PID:13188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7235.exe
        8⤵
        
        PID:11308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42907.exe
        8⤵
        
        PID:14092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39757.exe
        8⤵
        
        PID:8084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10195.exe
        7⤵
        
        PID:7636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56213.exe
        8⤵
        
        PID:11184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36851.exe
        8⤵
        
        PID:12092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15098.exe
        7⤵
        
        PID:11260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37411.exe
        7⤵
        
        PID:15332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5259.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2592
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2592 -s 632
        7⤵
        Program crash
        
        PID:5568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62051.exe
        6⤵
        
        PID:1464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51477.exe
        7⤵
        
        PID:6236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14108.exe
        8⤵
        
        PID:7152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36509.exe
        9⤵
        
        PID:8704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40971.exe
        9⤵
        
        PID:12688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4467.exe
        9⤵
        
        PID:15636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65263.exe
        8⤵
        
        PID:10244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22906.exe
        8⤵
        
        PID:14192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58293.exe
        8⤵
        
        PID:6344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44788.exe
        7⤵
        
        PID:7728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28341.exe
        8⤵
        
        PID:8440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14530.exe
        7⤵
        
        PID:10088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37708.exe
        7⤵
        
        PID:13692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-899.exe
        7⤵
        
        PID:5540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48700.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24357.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19173.exe
        7⤵
        
        PID:2852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12644.exe
        8⤵
        
        PID:6020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4684.exe
        9⤵
        
        PID:3420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45437.exe
        10⤵
        
        PID:7932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11911.exe
        11⤵
        
        PID:11472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16772.exe
        11⤵
        
        PID:8464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48948.exe
        10⤵
        
        PID:10468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9627.exe
        9⤵
        
        PID:8984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44915.exe
        9⤵
        
        PID:12944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50021.exe
        9⤵
        
        PID:15484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50844.exe
        8⤵
        
        PID:7112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4604.exe
        9⤵
        
        PID:9296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23971.exe
        9⤵
        
        PID:13324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3123.exe
        9⤵
        
        PID:13436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25578.exe
        8⤵
        
        PID:11140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7251.exe
        8⤵
        
        PID:14540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30459.exe
        7⤵
        
        PID:6424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16501.exe
        8⤵
        
        PID:6912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9124.exe
        9⤵
        
        PID:7712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-899.exe
        9⤵
        
        PID:10380
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6424 -s 608
        8⤵
        Program crash
        
        PID:10788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1621.exe
        7⤵
        
        PID:1444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61973.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56644.exe
        8⤵
        
        PID:12744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29524.exe
        7⤵
        
        PID:10812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63739.exe
        7⤵
        
        PID:14388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40147.exe
        6⤵
        
        PID:2036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7282.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43101.exe
        6⤵
        
        PID:5352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26973.exe
        7⤵
        
        PID:6300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23133.exe
        8⤵
        
        PID:7048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-956.exe
        9⤵
        
        PID:5876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16053.exe
        10⤵
        
        PID:10412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44932.exe
        10⤵
        
        PID:2148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53084.exe
        9⤵
        
        PID:11892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37235.exe
        9⤵
        
        PID:4808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51236.exe
        8⤵
        
        PID:9776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31842.exe
        8⤵
        
        PID:13208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51887.exe
        7⤵
        
        PID:7752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61973.exe
        8⤵
        
        PID:9264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47791.exe
        8⤵
        
        PID:12664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29739.exe
        8⤵
        
        PID:5844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23658.exe
        7⤵
        
        PID:11040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61247.exe
        7⤵
        
        PID:14060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65244.exe
        6⤵
        
        PID:5064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63880.exe
        7⤵
        
        PID:4416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22493.exe
        8⤵
        
        PID:8896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43011.exe
        8⤵
        
        PID:15348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54324.exe
        7⤵
        
        PID:11276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54875.exe
        6⤵
        
        PID:6684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32877.exe
        7⤵
        
        PID:11724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48196.exe
        7⤵
        
        PID:2180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8958.exe
        6⤵
        
        PID:8680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18139.exe
        5⤵
        
        PID:5372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6219.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6219.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1228
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1228 -s 636
        5⤵
        Program crash
        
        PID:3536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32258.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32258.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23885.exe
        5⤵
        
        PID:4532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56661.exe
        6⤵
        
        PID:5676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3620.exe
        7⤵
        
        PID:5520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34965.exe
        8⤵
        
        PID:7688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54397.exe
        9⤵
        
        PID:6852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26675.exe
        9⤵
        
        PID:12396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63836.exe
        8⤵
        
        PID:11452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47883.exe
        8⤵
        
        PID:12352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11100.exe
        8⤵
        
        PID:5988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42291.exe
        7⤵
        
        PID:8180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5020.exe
        8⤵
        
        PID:6352
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5676 -s 744
        7⤵
        Program crash
        
        PID:12848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26515.exe
        6⤵
        
        PID:5240
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5240 -s 720
        7⤵
        Program crash
        
        PID:2448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5674.exe
        6⤵
        
        PID:7404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8958.exe
        6⤵
        
        PID:10472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56588.exe
        5⤵
        
        PID:2664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12852.exe
        6⤵
        
        PID:5360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31701.exe
        7⤵
        
        PID:7876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56525.exe
        8⤵
        
        PID:6104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4931.exe
        7⤵
        
        PID:6272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25994.exe
        7⤵
        
        PID:15008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16443.exe
        6⤵
        
        PID:6380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41621.exe
        7⤵
        
        PID:12220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55700.exe
        7⤵
        
        PID:14432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25723.exe
        7⤵
        
        PID:4748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3093.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56411.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61973.exe
        6⤵
        
        PID:9332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32139.exe
        6⤵
        
        PID:14084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14171.exe
        6⤵
        
        PID:15876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54028.exe
        5⤵
        
        PID:10892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63739.exe
        5⤵
        
        PID:14360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64844.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64844.exe
      4⤵
      PID:4936
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62240.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62240.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2260
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2260 -s 720
      4⤵
      Program crash
      PID:2292
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25820.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25820.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3604.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3604.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21965.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48493.exe
        6⤵
        
        PID:5688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8835.exe
        6⤵
        
        PID:936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5172.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37469.exe
        8⤵
        
        PID:4028
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5256 -s 652
        8⤵
        Program crash
        
        PID:14108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45259.exe
        6⤵
        
        PID:4760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7012.exe
        7⤵
        
        PID:11196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36851.exe
        7⤵
        
        PID:12992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48268.exe
        6⤵
        
        PID:6192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37610.exe
        6⤵
        
        PID:15276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6388.exe
        6⤵
        
        PID:15800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45244.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45244.exe
      4⤵
      PID:3452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45347.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45347.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57149.exe
        5⤵
        
        PID:1404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12388.exe
        6⤵
        
        PID:8760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7294.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7294.exe
      4⤵
      PID:6092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22285.exe
        5⤵
        
        PID:9564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64526.exe
        6⤵
        
        PID:6856
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6092 -s 492
        5⤵
        Program crash
        
        PID:15076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45363.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45363.exe
      4⤵
      PID:10880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6171.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6171.exe
      4⤵
      PID:14396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64486.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64486.exe
      4⤵
      PID:3468
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29458.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29458.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:5016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32629.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32629.exe
      4⤵
      PID:4600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8996.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50844.exe
        5⤵
        
        PID:5392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61013.exe
        6⤵
        
        PID:8668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13461.exe
        5⤵
        
        PID:10208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29540.exe
        5⤵
        
        PID:13784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26939.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8204
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63380.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63380.exe
    3⤵
    PID:4752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2748.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2748.exe
      4⤵
      PID:5136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62053.exe
        5⤵
        
        PID:728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50157.exe
        6⤵
        
        PID:5728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-899.exe
        6⤵
        
        PID:6268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46076.exe
        6⤵
        
        PID:5504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34899.exe
        5⤵
        
        PID:9720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31842.exe
        5⤵
        
        PID:13712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18500.exe
        5⤵
        
        PID:2088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50844.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50844.exe
      4⤵
      PID:6832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12388.exe
        5⤵
        
        PID:8744
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6832 -s 664
        5⤵
        Program crash
        
        PID:14724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64115.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64115.exe
      4⤵
      PID:10608
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43077.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43077.exe
    3⤵
    PID:6176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15816.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15816.exe
      4⤵
      PID:6156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61773.exe
        5⤵
        
        PID:5544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1459.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1459.exe
      4⤵
      PID:9004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44915.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44915.exe
      4⤵
      PID:12952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11676.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11676.exe
      4⤵
      PID:6088
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3778.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3778.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:7944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28232.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28232.exe
      4⤵
      PID:5176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56644.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56644.exe
      4⤵
      PID:12344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28971.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28971.exe
      4⤵
      PID:15580
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53811.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53811.exe
    3⤵
    PID:11076
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-763.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-763.exe
    3⤵
    PID:14376
- C:\Users\Admin\AppData\Local\Temp\Unicorn-61177.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-61177.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1344
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8209.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8209.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56611.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56611.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33869.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35784.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33485.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9276.exe
        8⤵
        
        PID:2912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10916.exe
        9⤵
        
        PID:2428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11591.exe
        10⤵
        
        PID:5724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33821.exe
        11⤵
        
        PID:8228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25581.exe
        12⤵
        
        PID:13248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54925.exe
        12⤵
        
        PID:3040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6638.exe
        10⤵
        
        PID:8868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61512.exe
        11⤵
        System Location Discovery: System Language Discovery
        
        PID:14044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14442.exe
        10⤵
        
        PID:12752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2932.exe
        10⤵
        
        PID:6796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29499.exe
        9⤵
        
        PID:6896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61973.exe
        10⤵
        
        PID:9316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23971.exe
        10⤵
        
        PID:12576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62988.exe
        10⤵
        
        PID:2068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65267.exe
        9⤵
        
        PID:10440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14355.exe
        9⤵
        
        PID:13004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16659.exe
        9⤵
        
        PID:2612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31611.exe
        8⤵
        
        PID:6256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15816.exe
        9⤵
        
        PID:4536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19213.exe
        10⤵
        
        PID:8592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57204.exe
        9⤵
        
        PID:8980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31842.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:13192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9180.exe
        9⤵
        
        PID:15508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27578.exe
        8⤵
        
        PID:7952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29301.exe
        9⤵
        
        PID:8764
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7952 -s 636
        9⤵
        Program crash
        
        PID:6504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65268.exe
        8⤵
        
        PID:10424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53947.exe
        8⤵
        
        PID:11604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45820.exe
        7⤵
        
        PID:2724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45347.exe
        7⤵
        
        PID:6216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23133.exe
        8⤵
        
        PID:5940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33821.exe
        9⤵
        
        PID:5108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-899.exe
        9⤵
        
        PID:12028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18563.exe
        8⤵
        
        PID:9684
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6216 -s 652
        8⤵
        Program crash
        
        PID:1556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5950.exe
        7⤵
        
        PID:7792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61973.exe
        8⤵
        
        PID:8960
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7792 -s 636
        8⤵
        Program crash
        
        PID:1948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20858.exe
        7⤵
        
        PID:10836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47203.exe
        7⤵
        
        PID:14028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29955.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26957.exe
        7⤵
        
        PID:4020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43309.exe
        8⤵
        
        PID:6188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23133.exe
        9⤵
        
        PID:7064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12196.exe
        10⤵
        
        PID:8996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56644.exe
        10⤵
        
        PID:12336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5811.exe
        10⤵
        
        PID:1128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51887.exe
        8⤵
        
        PID:7784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36893.exe
        9⤵
        
        PID:8564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63432.exe
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:12436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36684.exe
        10⤵
        
        PID:1912
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7784 -s 648
        9⤵
        Program crash
        
        PID:13156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47587.exe
        8⤵
        
        PID:10716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7251.exe
        8⤵
        
        PID:1568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2587.exe
        7⤵
        
        PID:2772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25653.exe
        8⤵
        
        PID:4136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50292.exe
        8⤵
        
        PID:8384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22147.exe
        8⤵
        
        PID:1296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6258.exe
        7⤵
        
        PID:8512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58653.exe
        8⤵
        
        PID:10620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49637.exe
        8⤵
        
        PID:2676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59908.exe
        7⤵
        
        PID:384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18003.exe
        7⤵
        
        PID:15628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53883.exe
        6⤵
        
        PID:3268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19307.exe
        6⤵
        
        PID:6056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7196.exe
        7⤵
        
        PID:7576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49789.exe
        8⤵
        
        PID:12268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47236.exe
        8⤵
        
        PID:14960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4931.exe
        7⤵
        
        PID:9752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50499.exe
        7⤵
        
        PID:14348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52075.exe
        6⤵
        
        PID:5592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53629.exe
        7⤵
        
        PID:12552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49445.exe
        7⤵
        
        PID:11376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49294.exe
        6⤵
        
        PID:11580
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4572 -s 768
        6⤵
        Program crash
        
        PID:15668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49852.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15997.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43293.exe
        7⤵
        
        PID:3620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36573.exe
        8⤵
        
        PID:5556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40813.exe
        9⤵
        
        PID:5684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21133.exe
        10⤵
        
        PID:8848
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5684 -s 636
        10⤵
        Program crash
        
        PID:524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52684.exe
        9⤵
        
        PID:11160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25890.exe
        9⤵
        
        PID:14560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30459.exe
        7⤵
        
        PID:6416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13703.exe
        8⤵
        
        PID:7164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61973.exe
        9⤵
        
        PID:9284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23971.exe
        9⤵
        
        PID:11428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2005.exe
        7⤵
        
        PID:7924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19021.exe
        8⤵
        
        PID:8628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25581.exe
        9⤵
        
        PID:13256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57692.exe
        8⤵
        
        PID:12312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36372.exe
        8⤵
        
        PID:11272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19326.exe
        7⤵
        
        PID:10176
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1028 -s 688
        7⤵
        Program crash
        
        PID:6660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48316.exe
        6⤵
        
        PID:5112
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2856 -s 756
        6⤵
        Program crash
        
        PID:5116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26202.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59629.exe
        6⤵
        
        PID:2260
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2292 -s 752
        6⤵
        Program crash
        
        PID:6184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2379.exe
        5⤵
        
        PID:1432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10642.exe
        5⤵
        
        PID:5508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46973.exe
        6⤵
        
        PID:2188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61973.exe
        7⤵
        
        PID:9256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40691.exe
        7⤵
        
        PID:2956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19651.exe
        7⤵
        
        PID:11700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43940.exe
        6⤵
        
        PID:11100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40411.exe
        6⤵
        
        PID:15292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48699.exe
        5⤵
        
        PID:1744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28341.exe
        6⤵
        
        PID:8432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12260.exe
        5⤵
        
        PID:10080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8042.exe
        5⤵
        
        PID:13744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6219.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6219.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28109.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21581.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18405.exe
        7⤵
        
        PID:5380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18805.exe
        8⤵
        
        PID:5316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8140.exe
        9⤵
        
        PID:2736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61973.exe
        10⤵
        
        PID:9228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56644.exe
        10⤵
        
        PID:6440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14171.exe
        10⤵
        
        PID:7864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6707.exe
        6⤵
        
        PID:5404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13442.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56781.exe
        7⤵
        
        PID:7416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4428.exe
        8⤵
        
        PID:12536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16004.exe
        8⤵
        
        PID:16292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5123.exe
        7⤵
        
        PID:11292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2302.exe
        6⤵
        
        PID:6492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-293.exe
        6⤵
        
        PID:11652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11502.exe
        5⤵
        
        PID:4092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50797.exe
        6⤵
        
        PID:5868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21576.exe
        7⤵
        
        PID:692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9124.exe
        8⤵
        
        PID:5816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25581.exe
        9⤵
        
        PID:13240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41276.exe
        9⤵
        
        PID:512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39995.exe
        7⤵
        
        PID:8652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49534.exe
        8⤵
        
        PID:1416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5890.exe
        7⤵
        
        PID:12300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59567.exe
        6⤵
        
        PID:4792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61973.exe
        7⤵
        
        PID:9148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56644.exe
        7⤵
        
        PID:12308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30507.exe
        7⤵
        
        PID:1256
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4092 -s 488
        6⤵
        Program crash
        
        PID:10640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45243.exe
        5⤵
        
        PID:5220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54108.exe
        5⤵
        
        PID:5700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61973.exe
        6⤵
        
        PID:9360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24070.exe
        7⤵
        
        PID:4740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32139.exe
        6⤵
        
        PID:13332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24090.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24090.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13604.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56661.exe
        6⤵
        
        PID:5668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28125.exe
        7⤵
        
        PID:6768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44285.exe
        8⤵
        
        PID:4816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16053.exe
        9⤵
        
        PID:4800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12051.exe
        8⤵
        
        PID:11900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9570.exe
        8⤵
        
        PID:14572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42483.exe
        7⤵
        
        PID:7648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65061.exe
        8⤵
        
        PID:2120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36763.exe
        8⤵
        
        PID:1744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50420.exe
        8⤵
        
        PID:7472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58459.exe
        7⤵
        
        PID:11844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34932.exe
        7⤵
        
        PID:15068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22923.exe
        7⤵
        
        PID:6092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7683.exe
        6⤵
        
        PID:6200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15239.exe
        7⤵
        
        PID:5016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29960.exe
        8⤵
        
        PID:9392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32139.exe
        8⤵
        
        PID:12428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19459.exe
        8⤵
        
        PID:3144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50380.exe
        7⤵
        
        PID:10624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1002.exe
        7⤵
        
        PID:13352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1429.exe
        6⤵
        
        PID:5444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37469.exe
        7⤵
        
        PID:9140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56644.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:12636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38100.exe
        7⤵
        
        PID:3732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29524.exe
        6⤵
        
        PID:10796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64844.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64844.exe
      4⤵
      PID:2272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10916.exe
        5⤵
        
        PID:2128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13236.exe
        6⤵
        
        PID:6248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53605.exe
        7⤵
        
        PID:5384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40085.exe
        8⤵
        
        PID:11916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23499.exe
        8⤵
        
        PID:15084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58396.exe
        8⤵
        
        PID:7992
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6248 -s 628
        7⤵
        Program crash
        
        PID:12764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50660.exe
        6⤵
        
        PID:8968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7879.exe
        7⤵
        
        PID:12172
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2128 -s 740
        6⤵
        Program crash
        
        PID:14504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49775.exe
        5⤵
        
        PID:7228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61973.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9220
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7228 -s 548
        6⤵
        Program crash
        
        PID:15136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23658.exe
        5⤵
        
        PID:10872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6867.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:15044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8891.exe
        5⤵
        
        PID:8216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42547.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42547.exe
      4⤵
      PID:6276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55229.exe
        5⤵
        
        PID:6992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37469.exe
        6⤵
        
        PID:9244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40691.exe
        6⤵
        
        PID:1624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3699.exe
        6⤵
        
        PID:13620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2139.exe
        5⤵
        
        PID:10292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8490.exe
        5⤵
        
        PID:12708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54948.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54948.exe
      4⤵
      PID:7676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36893.exe
        5⤵
        
        PID:8856
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7676 -s 660
        5⤵
        Program crash
        
        PID:8784
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64265.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64265.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25509.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25509.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20325.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49821.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43293.exe
        7⤵
        
        PID:3192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20621.exe
        8⤵
        
        PID:5284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54300.exe
        8⤵
        
        PID:5812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6540.exe
        9⤵
        
        PID:10436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26867.exe
        9⤵
        
        PID:15168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58588.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:3100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33850.exe
        8⤵
        
        PID:8604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46276.exe
        8⤵
        
        PID:8060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14574.exe
        6⤵
        
        PID:4376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46292.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2452.exe
        6⤵
        
        PID:4492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29173.exe
        7⤵
        
        PID:5400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7107.exe
        6⤵
        
        PID:5388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63973.exe
        7⤵
        
        PID:6940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39197.exe
        8⤵
        
        PID:9496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12980.exe
        9⤵
        
        PID:12440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32532.exe
        9⤵
        
        PID:3436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32139.exe
        8⤵
        
        PID:11740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35900.exe
        8⤵
        
        PID:6504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2139.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:10300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-85.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-85.exe
        6⤵
        
        PID:7808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27656.exe
        7⤵
        
        PID:8536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21402.exe
        5⤵
        
        PID:4976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12644.exe
        6⤵
        
        PID:1560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64933.exe
        7⤵
        
        PID:6564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20173.exe
        8⤵
        
        PID:8460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58164.exe
        7⤵
        
        PID:10152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31842.exe
        7⤵
        
        PID:13664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20036.exe
        7⤵
        
        PID:6292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54492.exe
        6⤵
        
        PID:8164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61973.exe
        7⤵
        
        PID:9340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23971.exe
        7⤵
        
        PID:12940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55204.exe
        7⤵
        
        PID:11888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48163.exe
        6⤵
        
        PID:10856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47516.exe
        6⤵
        
        PID:13988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27860.exe
        5⤵
        
        PID:6756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13895.exe
        6⤵
        
        PID:5216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9124.exe
        7⤵
        
        PID:5380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50661.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:9384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50292.exe
        7⤵
        
        PID:12128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4851.exe
        7⤵
        
        PID:6848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59404.exe
        6⤵
        
        PID:9756
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6756 -s 656
        6⤵
        Program crash
        
        PID:6560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48700.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48700.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65389.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2644.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17653.exe
        7⤵
        
        PID:6356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51887.exe
        7⤵
        
        PID:7772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12196.exe
        8⤵
        
        PID:8804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64973.exe
        9⤵
        
        PID:11980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23011.exe
        8⤵
        
        PID:12960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14171.exe
        8⤵
        
        PID:8976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55755.exe
        7⤵
        
        PID:10744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56484.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57355.exe
        5⤵
        
        PID:5992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50157.exe
        6⤵
        
        PID:8372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43453.exe
        7⤵
        
        PID:12512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50676.exe
        6⤵
        
        PID:12480
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5992 -s 636
        6⤵
        Program crash
        
        PID:16240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35668.exe
        5⤵
        
        PID:8780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51907.exe
        5⤵
        
        PID:12656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58837.exe
        5⤵
        
        PID:3704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7666.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7666.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:4868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22536.exe
        5⤵
        
        PID:5624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21576.exe
        6⤵
        
        PID:6732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56293.exe
        7⤵
        
        PID:7884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37469.exe
        8⤵
        
        PID:9376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9939.exe
        8⤵
        
        PID:13732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12635.exe
        8⤵
        
        PID:1780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9923.exe
        7⤵
        
        PID:10820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55382.exe
        7⤵
        
        PID:12392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7084.exe
        7⤵
        
        PID:4752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20579.exe
        6⤵
        
        PID:5996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17117.exe
        7⤵
        
        PID:12240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63764.exe
        7⤵
        
        PID:15060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12443.exe
        7⤵
        
        PID:15340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10882.exe
        6⤵
        
        PID:9448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23500.exe
        6⤵
        
        PID:14448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59567.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61973.exe
        6⤵
        
        PID:9276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23971.exe
        6⤵
        
        PID:13148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43964.exe
        6⤵
        
        PID:15488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15874.exe
        5⤵
        
        PID:10284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3059.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3059.exe
      4⤵
      PID:5484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53885.exe
        5⤵
        
        PID:3956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44669.exe
        6⤵
        
        PID:7912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54895.exe
        6⤵
        
        PID:11600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49892.exe
        5⤵
        
        PID:8456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54043.exe
        5⤵
        
        PID:12160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27437.exe
        5⤵
        
        PID:1248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61779.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61779.exe
      4⤵
      PID:6012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39197.exe
        5⤵
        
        PID:9480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32139.exe
        5⤵
        
        PID:13340
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55060.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55060.exe
      4⤵
      PID:10572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46309.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46309.exe
      4⤵
      PID:12372
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19954.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19954.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3620
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3620 -s 636
      4⤵
      Program crash
      PID:2700
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38124.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38124.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13604.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13604.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48493.exe
        5⤵
        
        PID:5696
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5696 -s 616
        6⤵
        Program crash
        
        PID:2264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44108.exe
        5⤵
        
        PID:3852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9124.exe
        6⤵
        
        PID:3496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40469.exe
        7⤵
        
        PID:11968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15331.exe
        7⤵
        
        PID:14928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11691.exe
        7⤵
        
        PID:1436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-899.exe
        6⤵
        
        PID:11636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7602.exe
        5⤵
        
        PID:9740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37708.exe
        5⤵
        
        PID:13672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51636.exe
        5⤵
        
        PID:1348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32275.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32275.exe
      4⤵
      PID:3824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62053.exe
        5⤵
        
        PID:4956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1148.exe
        6⤵
        
        PID:5336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37293.exe
        7⤵
        
        PID:12104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2419.exe
        5⤵
        
        PID:9584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63830.exe
        5⤵
        
        PID:13544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35605.exe
        5⤵
        
        PID:6924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64579.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64579.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3644.exe
        5⤵
        
        PID:8544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61236.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61236.exe
      4⤵
      PID:8876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29042.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29042.exe
      4⤵
      PID:13824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43268.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43268.exe
      4⤵
      PID:2240
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56179.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56179.exe
    3⤵
    PID:1228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26293.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26293.exe
      4⤵
      PID:5840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52821.exe
        5⤵
        
        PID:7144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7196.exe
        6⤵
        
        PID:5440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40557.exe
        7⤵
        
        PID:3264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36763.exe
        7⤵
        
        PID:7344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54516.exe
        6⤵
        
        PID:5368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50460.exe
        5⤵
        
        PID:7464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53629.exe
        6⤵
        
        PID:12560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8412.exe
        6⤵
        
        PID:6784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4245.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:11316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1710.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1710.exe
      4⤵
      PID:6204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50157.exe
        5⤵
        
        PID:4504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54307.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54307.exe
      4⤵
      PID:8832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52404.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52404.exe
      4⤵
      PID:12680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9835.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9835.exe
      4⤵
      PID:7148
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27059.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27059.exe
    3⤵
    PID:5304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22453.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22453.exe
      4⤵
      PID:6024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62925.exe
        5⤵
        
        PID:7316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36509.exe
        6⤵
        
        PID:8684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32238.exe
        7⤵
        
        PID:7284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17619.exe
        6⤵
        
        PID:9708
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7316 -s 656
        6⤵
        Program crash
        
        PID:13884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65263.exe
        5⤵
        
        PID:10184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31842.exe
        5⤵
        
        PID:13632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6596.exe
        5⤵
        
        PID:1028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29219.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29219.exe
      4⤵
      PID:8144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14132.exe
        5⤵
        
        PID:11240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18507.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:15204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41443.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41443.exe
      4⤵
      PID:1316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21771.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21771.exe
      4⤵
      PID:15320
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47405.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47405.exe
    3⤵
    PID:2520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61973.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61973.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:8236
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2520 -s 672
      4⤵
      Program crash
      PID:15356
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-242.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-242.exe
    3⤵
    PID:10336
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44891.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44891.exe
    3⤵
    PID:14324
- C:\Users\Admin\AppData\Local\Temp\Unicorn-18415.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-18415.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3668
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2833.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2833.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26085.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26085.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2964
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2964 -s 720
        5⤵
        Program crash
        
        PID:796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18523.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18523.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5628.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22536.exe
        6⤵
        
        PID:5616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53013.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31701.exe
        8⤵
        
        PID:6500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23541.exe
        9⤵
        
        PID:11092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43374.exe
        9⤵
        
        PID:13996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61532.exe
        8⤵
        
        PID:9732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40411.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:15304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49391.exe
        7⤵
        
        PID:8120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4354.exe
        7⤵
        
        PID:11436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33116.exe
        7⤵
        
        PID:15392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50636.exe
        6⤵
        
        PID:6828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31701.exe
        7⤵
        
        PID:7860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7879.exe
        8⤵
        
        PID:12188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51823.exe
        7⤵
        
        PID:11828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29066.exe
        7⤵
        
        PID:14972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30178.exe
        6⤵
        
        PID:6692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8958.exe
        6⤵
        
        PID:11764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48996.exe
        5⤵
        
        PID:5444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64579.exe
        5⤵
        
        PID:7368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27381.exe
        6⤵
        
        PID:8576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57775.exe
        6⤵
        
        PID:12504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35988.exe
        6⤵
        
        PID:15548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19435.exe
        5⤵
        
        PID:8452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29042.exe
        5⤵
        
        PID:13852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25012.exe
        5⤵
        
        PID:15792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58979.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58979.exe
      4⤵
      PID:2700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19469.exe
        5⤵
        
        PID:6128
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6128 -s 720
        6⤵
        Program crash
        
        PID:6684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42675.exe
        5⤵
        
        PID:7212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61973.exe
        6⤵
        
        PID:9352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32139.exe
        6⤵
        
        PID:14096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27627.exe
        6⤵
        
        PID:15804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-882.exe
        5⤵
        
        PID:10724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23692.exe
        5⤵
        
        PID:13540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18539.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18539.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16501.exe
        5⤵
        
        PID:5632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12196.exe
        6⤵
        
        PID:8900
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5632 -s 660
        6⤵
        Program crash
        
        PID:6708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9539.exe
        5⤵
        
        PID:10564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25506.exe
        5⤵
        
        PID:13836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65427.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65427.exe
      4⤵
      PID:8172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36509.exe
        5⤵
        
        PID:8724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49416.exe
        6⤵
        
        PID:7656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13892.exe
        6⤵
        
        PID:13880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40971.exe
        5⤵
        
        PID:12696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13403.exe
        5⤵
        
        PID:11804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52564.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52564.exe
      4⤵
      PID:10136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21404.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21404.exe
      4⤵
      PID:13752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28435.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28435.exe
      4⤵
      PID:7100
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14387.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14387.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28109.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28109.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21965.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32349.exe
        6⤵
        
        PID:5648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14476.exe
        7⤵
        
        PID:6824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24584.exe
        8⤵
        
        PID:1852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7323.exe
        7⤵
        
        PID:8612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5890.exe
        7⤵
        
        PID:12320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58101.exe
        7⤵
        
        PID:5340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60636.exe
        6⤵
        
        PID:6948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53605.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50085.exe
        8⤵
        
        PID:12820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32611.exe
        7⤵
        
        PID:11108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28402.exe
        7⤵
        
        PID:7124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56093.exe
        7⤵
        
        PID:5256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64395.exe
        6⤵
        
        PID:8952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42694.exe
        7⤵
        
        PID:6580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3779.exe
        6⤵
        
        PID:12824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59612.exe
        6⤵
        
        PID:6720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48996.exe
        5⤵
        
        PID:5432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64579.exe
        5⤵
        
        PID:6356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27656.exe
        6⤵
        
        PID:8556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51061.exe
        7⤵
        
        PID:14052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38884.exe
        7⤵
        
        PID:16312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28948.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:10692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22706.exe
        5⤵
        
        PID:13532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22916.exe
        5⤵
        
        PID:3612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45244.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45244.exe
      4⤵
      PID:4536
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4536 -s 632
        5⤵
        Program crash
        
        PID:5632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5362.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5362.exe
      4⤵
      PID:5320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12852.exe
        5⤵
        
        PID:2352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50157.exe
        6⤵
        
        PID:8200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31917.exe
        7⤵
        
        PID:11908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2227.exe
        5⤵
        
        PID:9644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31842.exe
        5⤵
        
        PID:13648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42045.exe
        5⤵
        
        PID:13876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4907.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4907.exe
      4⤵
      PID:5696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61013.exe
        5⤵
        
        PID:8696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57583.exe
        5⤵
        
        PID:9736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10661.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10661.exe
      4⤵
      PID:10200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12507.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12507.exe
      4⤵
      PID:13680
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32258.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32258.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13796.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13796.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32349.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20341.exe
        6⤵
        
        PID:6996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24861.exe
        7⤵
        
        PID:6688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50157.exe
        8⤵
        
        PID:8208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16053.exe
        9⤵
        
        PID:936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29171.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:4404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44724.exe
        8⤵
        
        PID:11856
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6996 -s 636
        7⤵
        Program crash
        
        PID:9728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43619.exe
        5⤵
        
        PID:6676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33821.exe
        6⤵
        
        PID:8216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40469.exe
        7⤵
        
        PID:11956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54307.exe
        5⤵
        
        PID:8820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3971.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-899.exe
        5⤵
        
        PID:3104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32275.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32275.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15816.exe
        5⤵
        
        PID:6208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29301.exe
        6⤵
        
        PID:9040
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6208 -s 608
        6⤵
        Program crash
        
        PID:1204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10307.exe
        5⤵
        
        PID:10344
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4500 -s 656
        5⤵
        Program crash
        
        PID:3980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27386.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27386.exe
      4⤵
      PID:7992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11812.exe
        5⤵
        
        PID:8520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57381.exe
        6⤵
        
        PID:11756
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7992 -s 652
        5⤵
        Program crash
        
        PID:14460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3867.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3867.exe
      4⤵
      PID:8492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29042.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29042.exe
      4⤵
      PID:13700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60373.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60373.exe
      4⤵
      PID:2972
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64844.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64844.exe
    3⤵
    PID:4720
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42443.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42443.exe
    3⤵
    PID:5236
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37075.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37075.exe
    3⤵
    PID:7196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27656.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27656.exe
      4⤵
      PID:8740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40307.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40307.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:11632
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20812.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20812.exe
    3⤵
    PID:10684
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1898.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1898.exe
    3⤵
    PID:14656
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29260.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29260.exe
    3⤵
    PID:5804
- C:\Users\Admin\AppData\Local\Temp\Unicorn-2568.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-2568.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3416
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26085.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26085.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11772.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11772.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21965.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22536.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52629.exe
        7⤵
        
        PID:6800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7196.exe
        8⤵
        
        PID:7904
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7904 -s 588
        9⤵
        Program crash
        
        PID:11888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62684.exe
        8⤵
        
        PID:6420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58667.exe
        8⤵
        
        PID:13868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42483.exe
        7⤵
        
        PID:1480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-967.exe
        8⤵
        
        PID:13104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62683.exe
        7⤵
        
        PID:7832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26100.exe
        7⤵
        
        PID:1556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22731.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51788.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29101.exe
        7⤵
        
        PID:7744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17288.exe
        8⤵
        
        PID:11584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14179.exe
        8⤵
        
        PID:14500
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3472 -s 612
        7⤵
        Program crash
        
        PID:11700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46139.exe
        6⤵
        
        PID:8840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3971.exe
        6⤵
        
        PID:12720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19347.exe
        6⤵
        
        PID:16276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6427.exe
        5⤵
        
        PID:5820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63485.exe
        6⤵
        
        PID:4936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1148.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41621.exe
        8⤵
        
        PID:12212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50292.exe
        7⤵
        
        PID:12116
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4936 -s 504
        7⤵
        Program crash
        
        PID:16232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16067.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54707.exe
        6⤵
        
        PID:12668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33213.exe
        6⤵
        
        PID:6900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7765.exe
        5⤵
        
        PID:6748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61973.exe
        6⤵
        
        PID:9304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23971.exe
        6⤵
        
        PID:13316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21739.exe
        5⤵
        
        PID:10276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5690.exe
        5⤵
        
        PID:14312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24628.exe
        5⤵
        
        PID:4580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45244.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45244.exe
      4⤵
      PID:2964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-828.exe
        5⤵
        
        PID:6080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12852.exe
        6⤵
        
        PID:220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33821.exe
        7⤵
        
        PID:5716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50292.exe
        7⤵
        
        PID:12232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20803.exe
        7⤵
        
        PID:13708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2227.exe
        6⤵
        
        PID:9636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23674.exe
        6⤵
        
        PID:13860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3316.exe
        6⤵
        
        PID:3872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50844.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50157.exe
        6⤵
        
        PID:8240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32298.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9668
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2964 -s 652
        5⤵
        Program crash
        
        PID:15148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20842.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20842.exe
      4⤵
      PID:6044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13895.exe
        5⤵
        
        PID:6620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27381.exe
        6⤵
        
        PID:8568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65372.exe
        5⤵
        
        PID:8476
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6044 -s 672
        5⤵
        Program crash
        
        PID:15232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64388.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64388.exe
      4⤵
      PID:7720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64085.exe
        5⤵
        
        PID:9532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9747.exe
        5⤵
        
        PID:13416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3946.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3946.exe
      4⤵
      PID:10656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36046.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36046.exe
      4⤵
      PID:14308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31622.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31622.exe
      4⤵
      PID:7032
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57252.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57252.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23885.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23885.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9380.exe
        5⤵
        
        PID:5748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20341.exe
        6⤵
        
        PID:7004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63496.exe
        7⤵
        
        PID:7940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56213.exe
        8⤵
        
        PID:11120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52804.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:14340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18515.exe
        8⤵
        
        PID:13052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28667.exe
        7⤵
        
        PID:10120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56747.exe
        7⤵
        
        PID:14020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50460.exe
        6⤵
        
        PID:7900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7541.exe
        7⤵
        
        PID:5260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13482.exe
        6⤵
        
        PID:11524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51788.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9124.exe
        6⤵
        
        PID:7708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54307.exe
        5⤵
        
        PID:8812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59021.exe
        6⤵
        
        PID:13276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55501.exe
        6⤵
        
        PID:15764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3971.exe
        5⤵
        
        PID:12736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11371.exe
        5⤵
        
        PID:4076
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17178.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17178.exe
    3⤵
    PID:640
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60620.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60620.exe
    3⤵
    PID:5244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13895.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13895.exe
      4⤵
      PID:6232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29101.exe
        5⤵
        
        PID:5916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32611.exe
        5⤵
        
        PID:10400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20042.exe
        5⤵
        
        PID:9696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56093.exe
        5⤵
        
        PID:5764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34323.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34323.exe
      4⤵
      PID:8936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25581.exe
        5⤵
        
        PID:12704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38588.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:15604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63451.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63451.exe
      4⤵
      PID:12832
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55723.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55723.exe
    3⤵
    PID:7736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46997.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46997.exe
      4⤵
      PID:10760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59540.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59540.exe
      4⤵
      PID:15184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17555.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17555.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7504
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21723.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21723.exe
    3⤵
    PID:11204
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46309.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46309.exe
    3⤵
    PID:15260
- C:\Users\Admin\AppData\Local\Temp\Unicorn-25322.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-25322.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3684
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3412.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3412.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32629.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32629.exe
      4⤵
      PID:4876
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4876 -s 636
        5⤵
        Program crash
        
        PID:6292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56204.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56204.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3540
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3540 -s 628
        5⤵
        Program crash
        
        PID:7628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2498.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2498.exe
      4⤵
      PID:7224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12388.exe
        5⤵
        
        PID:8644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56644.exe
        5⤵
        
        PID:12996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19651.exe
        5⤵
        
        PID:15584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4443.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4443.exe
      4⤵
      PID:10600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54502.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54502.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:13908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22916.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22916.exe
      4⤵
      PID:15760
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3443.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3443.exe
    3⤵
    PID:2904
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62731.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62731.exe
    3⤵
    PID:5184
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3684 -s 748
    3⤵
    - Program crash
    PID:7912
- C:\Users\Admin\AppData\Local\Temp\Unicorn-12923.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-12923.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2276
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23885.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23885.exe
    3⤵
    - Executes dropped EXE
    PID:3128
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3128 -s 720
      4⤵
      Program crash
      PID:5924
- C:\Users\Admin\AppData\Local\Temp\Unicorn-56709.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-56709.exe
  2⤵
  PID:2684
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50029.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50029.exe
    3⤵
    PID:6048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12852.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12852.exe
      4⤵
      PID:5372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52461.exe
        5⤵
        
        PID:8356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35091.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35091.exe
      4⤵
      PID:9604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31842.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31842.exe
      4⤵
      PID:13640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60877.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60877.exe
      4⤵
      PID:15824
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50844.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50844.exe
    3⤵
    PID:4128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61973.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61973.exe
      4⤵
      PID:8944
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4128 -s 696
      4⤵
      Program crash
      PID:13428
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23658.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23658.exe
    3⤵
    PID:10804
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63167.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63167.exe
    3⤵
    PID:6788
- C:\Users\Admin\AppData\Local\Temp\Unicorn-62579.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-62579.exe
  2⤵
  PID:6160
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16309.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16309.exe
    3⤵
    PID:7264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19021.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19021.exe
      4⤵
      PID:8636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65181.exe
        5⤵
        
        PID:1576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57692.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57692.exe
      4⤵
      PID:12328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53668.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53668.exe
      4⤵
      PID:10620
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-65263.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-65263.exe
    3⤵
    PID:10228
- C:\Users\Admin\AppData\Local\Temp\Unicorn-38899.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-38899.exe
  2⤵
  PID:7288
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61973.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61973.exe
    3⤵
    PID:9324
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23971.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23971.exe
    3⤵
    PID:2588
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60492.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60492.exe
    3⤵
    PID:15520
- C:\Users\Admin\AppData\Local\Temp\Unicorn-41867.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-41867.exe
  2⤵
  PID:10556
- C:\Users\Admin\AppData\Local\Temp\Unicorn-55196.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-55196.exe
  2⤵
  PID:14472

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4304 -ip 4304
1⤵
PID:1388

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 2260 -ip 2260
1⤵
PID:2520

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3620 -ip 3620
1⤵
PID:4924

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 2964 -ip 2964
1⤵
PID:3384

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 1228 -ip 1228
1⤵
PID:1912

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 2592 -ip 2592
1⤵
PID:5184

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 3128 -ip 3128
1⤵
PID:5992

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 4536 -ip 4536
1⤵
PID:6020

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 4876 -ip 4876
1⤵
PID:5360

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 4720 -ip 4720
1⤵
PID:5596

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4936 -ip 4936
1⤵
PID:5776

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 640 -ip 640
1⤵
PID:5936

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 3452 -ip 3452
1⤵
PID:5968

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 2904 -ip 2904
1⤵
PID:5216

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 2724 -ip 2724
1⤵
PID:724

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4056 -ip 4056
1⤵
PID:5364

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 2276 -ip 2276
1⤵
PID:2412

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 3596 -ip 3596
1⤵
PID:6376

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 2896 -ip 2896
1⤵
PID:6388

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 704 -p 4376 -ip 4376
1⤵
PID:6552

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 2260 -ip 2260
1⤵
PID:6708

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 5404 -ip 5404
1⤵
PID:6820

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 720 -p 2036 -ip 2036
1⤵
PID:6972

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 5140 -ip 5140
1⤵
PID:7056

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3268 -ip 3268
1⤵
PID:7064

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 5372 -ip 5372
1⤵
PID:6232

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 716 -p 1432 -ip 1432
1⤵
PID:5776

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 764 -p 5112 -ip 5112
1⤵
PID:6088

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 5016 -ip 5016
1⤵
PID:6072

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 2264 -ip 2264
1⤵
PID:6184

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 5688 -ip 5688
1⤵
PID:6688

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 1416 -ip 1416
1⤵
PID:6704

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 2856 -ip 2856
1⤵
PID:5312

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4476 -ip 4476
1⤵
PID:5976

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 4744 -ip 4744
1⤵
PID:6700

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 724 -p 4760 -ip 4760
1⤵
PID:6552

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 760 -p 3552 -ip 3552
1⤵
PID:6712

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 2292 -ip 2292
1⤵
PID:3656

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 3292 -ip 3292
1⤵
PID:840

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 756 -p 2956 -ip 2956
1⤵
PID:6376

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 5696 -ip 5696
1⤵
PID:6560

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 6128 -ip 6128
1⤵
PID:840

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 756 -p 5184 -ip 5184
1⤵
PID:5560

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 5432 -ip 5432
1⤵
PID:6096

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 688 -p 5220 -ip 5220
1⤵
PID:7112

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 5236 -ip 5236
1⤵
PID:2632

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 6064 -ip 6064
1⤵
PID:5300

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 676 -p 5444 -ip 5444
1⤵
PID:5144

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 740 -p 6356 -ip 6356
1⤵
PID:4908

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 5400 -ip 5400
1⤵
PID:5684

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 3540 -ip 3540
1⤵
PID:6572

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 3684 -ip 3684
1⤵
PID:7432

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 3776 -ip 3776
1⤵
PID:7528

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 732 -p 5284 -ip 5284
1⤵
PID:7572

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 5656 -ip 5656
1⤵
PID:8040

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 756 -p 2500 -ip 2500
1⤵
PID:8112

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 4492 -ip 4492
1⤵
PID:5112

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 5380 -ip 5380
1⤵
PID:7172

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 3620 -ip 3620
1⤵
PID:7448

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 5240 -ip 5240
1⤵
PID:2464

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 6028 -ip 6028
1⤵
PID:8896

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 716 -p 6996 -ip 6996
1⤵
PID:10372

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 728 -p 6424 -ip 6424
1⤵
PID:10920

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 4092 -ip 4092
1⤵
PID:8976

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 6416 -ip 6416
1⤵
PID:8736

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 6188 -ip 6188
1⤵
PID:10740

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 6268 -ip 6268
1⤵
PID:10388

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 5316 -ip 5316
1⤵
PID:11152

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 716 -p 3864 -ip 3864
1⤵
PID:11248

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 3264 -ip 3264
1⤵
PID:10104

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 764 -p 936 -ip 936
1⤵
PID:8604

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 748 -p 992 -ip 992
1⤵
PID:10372

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 7904 -ip 7904
1⤵
PID:12024

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 6156 -ip 6156
1⤵
PID:4404

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 6248 -ip 6248
1⤵
PID:11876

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 3472 -ip 3472
1⤵
PID:11744

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 5676 -ip 5676
1⤵
PID:11936

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 692 -ip 692
1⤵
PID:12572

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 4956 -ip 4956
1⤵
PID:12600

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 788 -p 6824 -ip 6824
1⤵
PID:12608

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 812 -p 5372 -ip 5372
1⤵
PID:12904

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 764 -p 5392 -ip 5392
1⤵
PID:12912

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 5724 -ip 5724
1⤵
PID:13124

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 816 -p 6204 -ip 6204
1⤵
PID:12392

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 7728 -ip 7728
1⤵
PID:12860

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 1744 -ip 1744
1⤵
PID:13944

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 836 -p 7912 -ip 7912
1⤵
PID:13292

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 844 -p 4536 -ip 4536
1⤵
PID:13740

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 8780 -ip 8780
1⤵
PID:13140

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 692 -p 6620 -ip 6620
1⤵
PID:4776

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 6864 -ip 6864
1⤵
PID:13884

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 6560 -ip 6560
1⤵
PID:13460

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4824 -ip 4824
1⤵
PID:12424

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 832 -p 6676 -ip 6676
1⤵
PID:7444

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 672 -p 2352 -ip 2352
1⤵
PID:14476

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 800 -p 7184 -ip 7184
1⤵
PID:14832

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 828 -p 6564 -ip 6564
1⤵
PID:14720

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 816 -p 7992 -ip 7992
1⤵
PID:14908

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 2128 -ip 2128
1⤵
PID:15016

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 6356 -ip 6356
1⤵
PID:15072

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 692 -p 1404 -ip 1404
1⤵
PID:15108

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 780 -p 7808 -ip 7808
1⤵
PID:15132

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 728 -p 7784 -ip 7784
1⤵
PID:15152

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 772 -p 6832 -ip 6832
1⤵
PID:15220

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 824 -p 7676 -ip 7676
1⤵
PID:15244

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4128 -ip 4128
1⤵
PID:13792

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 6208 -ip 6208
1⤵
PID:14608

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 780 -p 5684 -ip 5684
1⤵
PID:15020

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 5632 -ip 5632
1⤵
PID:13028

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 752 -p 7952 -ip 7952
1⤵
PID:14876

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 5256 -ip 5256
1⤵
PID:14892

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 836 -p 7792 -ip 7792
1⤵
PID:14052

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 2520 -ip 2520
1⤵
PID:13896

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 772 -p 7228 -ip 7228
1⤵
PID:5376

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 712 -p 6092 -ip 6092
1⤵
PID:14432

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 2964 -ip 2964
1⤵
PID:14988

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 824 -p 1028 -ip 1028
1⤵
PID:6356

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 840 -p 6756 -ip 6756
1⤵
PID:12812

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 6432 -ip 6432
1⤵
PID:15020

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 672 -p 6216 -ip 6216
1⤵
PID:3464

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4500 -ip 4500
1⤵
PID:15028

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 716 -p 8968 -ip 8968
1⤵
PID:15224

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 8200 -ip 8200
1⤵
PID:60

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 800 -p 6688 -ip 6688
1⤵
PID:14056

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 844 -p 8804 -ip 8804
1⤵
PID:15028

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 712 -p 8520 -ip 8520
1⤵
PID:6560

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 672 -p 15060 -ip 15060
1⤵
PID:15432

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 5748 -ip 5748
1⤵
PID:15480

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 3956 -ip 3956
1⤵
PID:15516

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 712 -p 4948 -ip 4948
1⤵
PID:15524

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4532 -ip 4532
1⤵
PID:15536

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 2664 -ip 2664
1⤵
PID:15552

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 5056 -ip 5056
1⤵
PID:15576

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 3172 -ip 3172
1⤵
PID:15604

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 668 -p 4572 -ip 4572
1⤵
PID:15620

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:12080

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 804 -p 5992 -ip 5992
1⤵
PID:11352

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 4936 -ip 4936
1⤵
PID:7032

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 704 -p 7316 -ip 7316
1⤵
PID:4512

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 732 -p 7164 -ip 7164
1⤵
PID:5712

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 756 -p 8628 -ip 8628
1⤵
PID:6496

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 804 -p 5248 -ip 5248
1⤵
PID:6520

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 792 -p 7720 -ip 7720
1⤵
PID:14920

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 6748 -ip 6748
1⤵
PID:4756

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 6012 -ip 6012
1⤵
PID:10160

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 6976 -ip 6976
1⤵
PID:11484

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 716 -p 5700 -ip 5700
1⤵
PID:4064

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 684 -p 6912 -ip 6912
1⤵
PID:16324

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 5696 -ip 5696
1⤵
PID:8044

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 824 -p 8372 -ip 8372
1⤵
PID:16316

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 804 -p 1444 -ip 1444
1⤵
PID:15376

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 5868 -ip 5868
1⤵
PID:5404

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 756 -p 5940 -ip 5940
1⤵
PID:15400

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 676 -p 5244 -ip 5244
1⤵
PID:15416

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 788 -p 5512 -ip 5512
1⤵
PID:15452

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-10425.exe

Filesize
468KB

MD5
0a1b68bfdc60e0555ea71f5a4ba3714c

SHA1
a0cebcaa8e5dc9d87022b3e07185205592164207

SHA256
e888467c757644304952a20866ee7350b8bcb209c7fb84b0d46ffc27b17c9b03

SHA512
251bc95a04e8a26230e4ad5223f1ace0af3d7d753817c80fb6500a47a55028183d727d47a20c9459c6fb3187c59ac852e322ef2e84501a741b496981363abad0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-11772.exe

Filesize
468KB

MD5
2be8b6638a100fe2482ac104b15a2a82

SHA1
b1a8b4675ee0453150a4c98aa55d3c25bf24a1d1

SHA256
5d8665f2752758ba6a89aa910fe0cc43ab7084d0539f3ed7e60acb570da01788

SHA512
2c27ea8ae2ce0afb67f88eb5c5c226452a8bfdaf69b258de5ad1a93c24b308641d86f709d55056236053aef1647ee01a4b74414b29ffefa90619aa7346b6c4c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-14387.exe

Filesize
468KB

MD5
2336c5433e9fa687e3b082c5a3539b21

SHA1
8f16409e566a433dc83d63b92c5296861ead9d4a

SHA256
d01354f84ba33049cb796c8f6ce5d75cf9eca05e7a363a36781ca083be7805a5

SHA512
34094d1a9ce61fdeac4bc70269d0b0db7f522c2bc1ee0362f26aa7a44b53c146edfbd592c60487436a1cbe67b5202e0d7c0bb3d451106a84ce1901569e994002

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-18415.exe

Filesize
468KB

MD5
b83f4f74621652fdcc0d8cf506483ec7

SHA1
5431bb196c926a383614abd822a0d5db0f6c5957

SHA256
8f4ac9b192a530ae8509c17c8257d3a26385d8e49ac7cdf23437f140f8049f22

SHA512
ebf810088676d803060a50340afd454b7acfe0b59308e279e017c7441ed4f1fc50896981ea4ec48c59882a54d801d60f38cc617542294520257a1cf84cbe9d5c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-19954.exe

Filesize
468KB

MD5
4d7454fbd7caf119ffde71b9e14e6cbc

SHA1
76232043aa9f2cb35380442eeaec498eaaf0fa38

SHA256
8f1bc34179db78b7c5fece6e42d6a4f271e44465478659c990c1c8df0da4c14b

SHA512
217ec38ba00c8f9b8c53252ca7ed955b3f8e78611c115d1fe2275a94dc385b8b3525bc612b2e636df53603c6e27affaf68ceb69e8873fb896781419d481fc72b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-20325.exe

Filesize
468KB

MD5
f26819722102e757c34bccb25ed12b03

SHA1
2962a0933b1a11d4604c9bd0b8110b47386d63a4

SHA256
6e2fc59b8f3d8747b24223c3c7da35cf4a7287532862ee85d5b4fc0a7fc5b027

SHA512
8e82ad0d2dd2e9733fdaebcee5d7a6387fea4493f2a3fed563a42015b3e5d9a337deb00359fb7014fa6ca5b226b6f6ff3ccdf6d52900b15fd758aa6e1144f54a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-21131.exe

Filesize
468KB

MD5
40e9199dedd4f9ccca4af01a01dc806b

SHA1
67ad65270c0029d95f088ccf0590344f4065e96f

SHA256
f842109bebca37152da20ffb595765b0ac15e20eaa47e5df84b36f2383b69a4e

SHA512
eed1f8bc31026bdf646aa4558742358eb374b853f08b769d3cf02375b82b80e52fcf9793fab747955c8bfa21a6eb3e3c925e620234c8a5e693a467ab9a35e1fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-25322.exe

Filesize
468KB

MD5
17887026f6129a8c9a2865a0ba0966aa

SHA1
425597b97d33dcdf1507a7642aea0634716971c0

SHA256
0aba1380cbaec6eeb11b982780bc4857a2d51d5a52c7193c7e92a050d8f6c012

SHA512
d66d888326c756c3c287631d72f96929f0febbdf58dfd52b27922077f33c5916cb97619e1dc387a6c2806caa94314eacfac27f90ea1191380829777785f86bcf

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-25509.exe

Filesize
468KB

MD5
fe86e975cf92362570ea25eddf4c48f1

SHA1
175e204bd93c182d3ac95404f2b8b145220a595a

SHA256
613066a0ea2c25faa9c3b5f2c6e88084c0cfeb3f55e4244d87127811dea68057

SHA512
ca103362ffa8f5a8c00a966b41171523881be3b426efc59dc9a0f6db3ab12bde1245e7a3411cf09d53717dc6aa3a868493535f3d846fc74764b9dfc3f20b69cb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-2568.exe

Filesize
468KB

MD5
440d2cfd76bd7ab5fac2b9acb8c1d5dc

SHA1
cb6da47b84ad80b4bc4fa3def21cb929ca175a38

SHA256
deaa56ca200050e74a9c646741d421282b39ef7a672e3ed14f7f225c08b2c538

SHA512
cb689ce252085b79aab3b78d7385a5f8dbda500b0b6f0edf0aff49cd548dc3719c6506b0cf24e6c6aa12f7e5aeaef5208dcba5cf86da35b74a81cee60636fa96

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-25820.exe

Filesize
468KB

MD5
d526c6ae3e042994336e60eccae6e7ed

SHA1
e5a1601907932b071cbc57460be7096f620d4a97

SHA256
19129743d515f7f18588657c577f76a569baa8f2f0ad191dd661d674bc292cd6

SHA512
a4f943ba93834eb2a7591a773b83e2e1488c79c9a22cd37d7b1bf6714f3d46fca21178c217070f946315fcfe5b7865bfbed50835d8d4149f0cb649d456e255f0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-26085.exe

Filesize
468KB

MD5
78aaa8d73a93cbf39b89f797a12159cf

SHA1
8eff7790bdb3da9ba25448c0aeb9d86e59574554

SHA256
2b9f4650e72e4a386c63eaa3a98188c9159fa73e2c67a32c0b40f62bb9a9385d

SHA512
929316c32c242c174945615cf99609c562e71fb2fda7b10f6784d0c302375857ff4755ab894196dc881c6fac3f4bed6fcd7a2320ef8edd9393f4688fb1897ac8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-28109.exe

Filesize
468KB

MD5
b08d4fe5be1f6ca054fc4e8280e105ae

SHA1
a8abf14bec65a1ef3c354d51c5075e0d82b060df

SHA256
67336c091147b1993e4b1cc4da01a3681ed894059eb084543d6cd82eb4a75679

SHA512
2f04944e5ab24705fdd56ba79b20588ceca45afbfdc749f9677cebb35702f32510e83dc7cbb79d97ff7912ae7336239baa3b85e0902f5af31a586b153b174cc0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-2833.exe

Filesize
468KB

MD5
45fee47fd7ab594d6f8c8a1f453ceaeb

SHA1
43e461df0165d109c108dfe62042631b2d4ecc8a

SHA256
47db73ea23af3499ef3072e3a6e0c69fe480b985c93cd543bd855812038f4874

SHA512
f4ef6415d8255442f918b44748c31bd7489ade79c99a9c40653fbb421055cdfa8249f436bd95f27c06971c02126f06193ce1f8bf444de9be3277c2595f8af8ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-31701.exe

Filesize
468KB

MD5
943b9b26cd4c4c8c2af38526fdb531a2

SHA1
892cc0329605453d83bd1daaf75366b07ff008bb

SHA256
7a75456032e38d1250ef350b80ecc73a6c933e9cae72d5704d7c1076e360a008

SHA512
c9139ee0c0f286aa13c51d5dd7d00c9c5ac47ca6e5cd2c9ed928beefe4ac0d3db14d792a6924db91717a0ed298e886342b16cd9ecc79309cd7d122d8f26214b7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-33869.exe

Filesize
468KB

MD5
a1b351d5e37702002216df93b3787484

SHA1
fe5afc5adae4057c8449240c2a0365ff2308bce7

SHA256
dfb7ff447e73462426c1e1cf22c3465b69d97c16d385874d3d30446250a37563

SHA512
fc66e570c72893061277d69aee80e37b0e336534532e4d397e76d06aa128688b4762a94123cd31357213d4c767fa031177a3bfed3d8e8dd9048f9c7aa60ba055

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-35784.exe

Filesize
468KB

MD5
a35e6eddf0ffd638319ac8a883dc18dc

SHA1
67de3a1d990c13e9d382a7db123641080f186678

SHA256
44f42957850e40dbd924c17701dba308b8fcd7a6a86a192f85318d4fe6e96e99

SHA512
273e3c3dc56b42c7f06dfa5ec3d6a78871f7e28c28e60eb388c6e81e50ff7b39129e02965c0e517276ffb561300a6cd5ed9125d7a04dc4e5940566a3064ddb1a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-3604.exe

Filesize
468KB

MD5
c6e8a1e25a4a1ef049270d13d21e5e74

SHA1
bb540998d28df3dc270b770114964ef9ae2627c5

SHA256
130ca8873d638d6f8992b7fdecc3aefca72470dd88268f1bf237657cfd7e09e9

SHA512
b9286d19a9e068772c421e0221c1412e2ebea8519454962720b0692d14aaec6a4da05169a176bb4ad59b2b2ab1bcc2eb839aaabbbc3c6dfcad9cfda7be5079f8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-3988.exe

Filesize
468KB

MD5
8bffea6d18dec4c59139578aaeadc424

SHA1
e58fccfaa5f656212de48290c601f3b918a28412

SHA256
08af74818c64e9d3cb1eae5857964ead8b8eed55d4035d814adb93b5b969a2e9

SHA512
ba9c91f515f395f178f578778a8c6543cc6edebf489fdf51ac6edb134b863c91530f5ba6e59e30c8b49ac1c546297525edad907b1895cb9591ad5cd0e9386dc9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-40202.exe

Filesize
468KB

MD5
26ba05a8c3bce77288bcc26d2b5c2456

SHA1
2676366e792b48fbe3c06e4320247783ef4a13d4

SHA256
0048ffce1125d1d66fcec0e76f270221e9a41587624e378b3b7da9e0e8f3bc6b

SHA512
5843a8439324e2b0c74b2b2b113cafcbe13740cda6f693256318ef058b42e77c36f8b3b787857fdac7f18501910aaba38380596954b16db0722320df7a44d4fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-4680.exe

Filesize
468KB

MD5
aa430459a03417e125ae10af05ff03bc

SHA1
576a4676f53bd672f3ff7a5f6c85fa326b1f4e12

SHA256
db9dc65fb18ce8ac6e790dde3d045122fb9eebb9b4c4db5a5d8b5822ce42bbb7

SHA512
434690b5f2d9144acf34da1bec52a45ef57c5685445ba61a9184802ef9cc5319d824666c946b844a98944fe9f9d9fde8cb0b8aa9770232035193eca3a4ade94c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-48700.exe

Filesize
468KB

MD5
78a552ab28fc6d0fe81ca297c2a7a40e

SHA1
f22ef32683f0cdac7867d8a33caec42dd70eb1b8

SHA256
f55f1f75a67726a0d459187dbcc4819051eda7c3779d707d03704942850db738

SHA512
ccf96e73346a7c8109bd46ba11f8e33e8ca4ee9c7bfaeb5ad1227af9dc4ad26d519ee633f2229b8cbd6676c55b12b522db9469ba4669533b1cfc2ab0f3c4faa7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-49852.exe

Filesize
468KB

MD5
59a1e56f79c5a9cfb1d699b047951f84

SHA1
16570b31ebf5d5e87655dddce32780e4f486a28c

SHA256
16c9167e507f1b42aeee579deb2e878ead23c00a66522b8aadbad9897421e9dd

SHA512
ff770bef49f54c1241777ec01b3238a87c454e265a215bc838d614a4bdb1473953deccc9d8a24670cd45397e3828a583b44e2902d7f847db7581ebe97b30a746

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-56611.exe

Filesize
468KB

MD5
b49b74443977bcf4cf439a05be844a23

SHA1
8dce3005c6c3665a66d3e0df90c9413a5ca111ff

SHA256
f50221643cb81b1f18339bcd6e1fc06e399bd02aeb7f2c5546c27aa04766de8a

SHA512
23cd3fba6237f4fbd82db79a6be8d976a3f15f4e1a98e827bf7ba05961ed4c8c00341a97c7b6f3dcc6712a843eef7b6801db948ea0e278fe5168a064ec8b6dc9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-61177.exe

Filesize
468KB

MD5
98ffe7a702133c7b65410f4fbf834127

SHA1
859271763c0812a339830788799cc2c93be0fcdb

SHA256
ee21717a9f81ba120a215ad072c7a8f8d6208b433ac59d00e9a0476af5ac0466

SHA512
a34ecbcc3cd15e76cd151197678c5ed49b00473b14e24a7fa05b96e67e96477f1beb77a3dbc926103642d84f4607e21f241f1a238edd67645226ce217a5f35d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-6219.exe

Filesize
468KB

MD5
a097a3d0e3fca2f9fda7e7a0217dcb33

SHA1
573659d6c9f4658b7faf70ff25464b02e58b3b66

SHA256
ea2f1f179b5c002b28ccd80949e0b3008e183e19cecf3ddd95314be2f90073b6

SHA512
6de67ba7f8339271bae2948bb54f27dd5437bdd3ece7f5c690400997a79a398298bdc0e5217fb5ff130957b723cb9ed5aabb1acf4dcf04e4d76f2872db96e776

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-62240.exe

Filesize
468KB

MD5
cba246cd029a9fd355901f6c92b233b8

SHA1
8d3371c483eb2f2c9d392b326f094797c0637c5f

SHA256
fe60c7dc5f5fcf9e90050c58099e9d33458a956f1833a709257ef9fe0009db3b

SHA512
5b198a8eb797ac530e5974143257d7b845a9c2b3f15c51b26450073affefd5a31fd9ec77779538d1087c6cf5772de5516479b8490cb1ae786cf281ec1e8bdf2a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-64265.exe

Filesize
468KB

MD5
138200dbf33152d21ab8434e703ce4d4

SHA1
a9d9d1f7012afaacc4b2b30a52920165cb30bb85

SHA256
3d82871ae990e8a158b4ffcb7df428146342032d5a6d40f9667065943a5c1367

SHA512
df021c0fb798e2432ad6e41663f95bcbcbbee0c7c281f7dcb97fbc17fda6f235c1a19eb4e01925cf7f9dac5840cc896b2e239ff6c9c5e8510fbb5cfeeaafff9e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-8209.exe

Filesize
468KB

MD5
8279384ea6f5a8db6c8c33d7aca83836

SHA1
7487bb8a8f893b2e5857f0bf278552ddb16890af

SHA256
7fd9be922676ea978ce15f6509f8ef27cd71f253554ad6fda76e2ae2c9ffa41a

SHA512
585c60b77b456cd6944e4455885f17cf0cb24ac75a95f098c7203abf055156825a1f2b1a67a4a4adddde79dde67915d53965714237e879467310a96ed171ed81

Download Submit
memory/216-262-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/232-285-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/448-214-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/640-403-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/944-237-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/992-136-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1028-302-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1196-134-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1228-394-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1228-265-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1344-19-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1388-240-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1432-523-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1464-481-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1604-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1636-59-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1684-341-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1964-81-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1976-480-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2020-243-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2036-484-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2260-477-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2260-85-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2260-157-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2264-41-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2272-397-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2276-264-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2292-303-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2500-106-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2576-149-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2592-287-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2660-189-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2684-395-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2700-396-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2724-448-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2852-486-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2856-183-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2896-209-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2904-401-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2912-447-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2964-266-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2964-400-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2980-51-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3068-263-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3076-338-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3172-336-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3264-286-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3268-483-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3276-352-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3292-64-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3324-337-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3396-270-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3416-82-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3552-283-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3568-475-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3596-238-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3620-267-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3620-131-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3640-367-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3668-44-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3684-150-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3776-478-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3864-34-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3944-138-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4020-473-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4044-284-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4056-242-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4092-393-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4304-47-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4304-13-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4376-487-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4476-174-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4492-472-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4532-368-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4536-399-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4572-93-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4580-359-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4600-391-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4680-315-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4744-325-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4752-402-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4760-312-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4788-217-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4868-335-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4876-381-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4880-167-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4896-162-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4912-6-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4936-398-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4948-320-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4976-479-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5016-239-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5056-218-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5112-514-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5140-526-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5372-527-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/7124-2879-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/10620-2861-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads