e9bb5a4197c447bcc9a626ab093923eb562f61fce11799a7e8d2e808011aa958

Analysis

max time kernel
115s
max time network
120s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
04/10/2024, 03:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e9bb5a4197c447bcc9a626ab093923eb562f61fce11799a7e8d2e808011aa958N.exe
Size 184KB
Sample241004-dkffts1cql
SHA256 e9bb5a4197c447bcc9a626ab093923eb562f61fce11799a7e8d2e808011aa958
MD5 f04cd37e87c2162c14cbfb42beb93380
SHA1 a6844e5882c50c570cf27ff5ac937cbb3ac8203d
SHA512 fd37d34b1ceec9e34d7176b86c255e3833c8d7c39bc0d5139e0fa323ef0092982d62fa8d4f73ce87a8280df7e0b84d8459e34ef7f1e5053a46d909011fa7a4d3
SSDEEP 3072:R/+aqCoEk55NdymaZHSTJS09lvnqnveuR:R/Lo1bymfTQ09lPqnveu
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2728	Unicorn-61875.exe
4308	Unicorn-63344.exe
2960	Unicorn-58938.exe
548	Unicorn-1183.exe
2952	Unicorn-33664.exe
820	Unicorn-29257.exe
3996	Unicorn-42993.exe
1208	Unicorn-27254.exe
4052	Unicorn-65184.exe
5116	Unicorn-42526.exe
2516	Unicorn-48656.exe
1008	Unicorn-15599.exe
4852	Unicorn-44935.exe
4532	Unicorn-31479.exe
2380	Unicorn-13778.exe
5008	Unicorn-40129.exe
3020	Unicorn-34064.exe
4476	Unicorn-62138.exe
2080	Unicorn-3695.exe
4952	Unicorn-20032.exe
3476	Unicorn-36103.exe
4628	Unicorn-16502.exe
4192	Unicorn-19648.exe
1172	Unicorn-19456.exe
4368	Unicorn-65127.exe
1556	Unicorn-35984.exe
2772	Unicorn-62334.exe
3096	Unicorn-10333.exe
1752	Unicorn-30224.exe
2000	Unicorn-29155.exe
4000	Unicorn-42838.exe
3864	Unicorn-13238.exe
4032	Unicorn-54640.exe
3884	Unicorn-1910.exe
4136	Unicorn-6783.exe
4888	Unicorn-7581.exe
3032	Unicorn-45808.exe
2044	Unicorn-7961.exe
2496	Unicorn-27827.exe
2268	Unicorn-40633.exe
2808	Unicorn-60499.exe
3732	Unicorn-15247.exe
3236	Unicorn-47728.exe
1016	Unicorn-30131.exe
2140	Unicorn-24000.exe
4128	Unicorn-4281.exe
1036	Unicorn-60151.exe
4244	Unicorn-60151.exe
4176	Unicorn-14479.exe
3428	Unicorn-14479.exe
4984	Unicorn-29747.exe
2208	Unicorn-29398.exe
2784	Unicorn-32663.exe
404	Unicorn-59278.exe
780	Unicorn-7469.exe
4648	Unicorn-50032.exe
2896	Unicorn-65491.exe
744	Unicorn-65491.exe
4236	Unicorn-33696.exe
4552	Unicorn-60046.exe
3204	Unicorn-29782.exe
4416	Unicorn-40718.exe
4804	Unicorn-13446.exe
4380	Unicorn-58112.exe

Program crash 18 IoCs

pid	pid_target	Process	procid_target
6632	6816	WerFault.exe	240
6588	6808	WerFault.exe	239
8772	6208	WerFault.exe	223
9024	6216	WerFault.exe	224
15596	16220	WerFault.exe	716
17400	3788	WerFault.exe	724
17060	16068	WerFault.exe	730
16680	15172	WerFault.exe	742
17104	15124	WerFault.exe	736
17356	1940	WerFault.exe	738
17372	16416	WerFault.exe	768
5076	15500	WerFault.exe	747
2136	15640	WerFault.exe	755
15112	15736	WerFault.exe	758
3564	16236	WerFault.exe	733
1884	16620	WerFault.exe	770
5236	16796	WerFault.exe	778
5576	16884	WerFault.exe	784

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12301.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61367.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27613.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50849.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53856.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32969.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49505.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58170.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57228.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51363.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13138.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33267.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61674.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-95.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62865.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4560.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23595.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10102.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1974.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25168.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30902.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5821.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57228.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19305.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22467.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27254.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32013.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27904.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3693.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64897.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32048.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54506.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17763.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49518.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55383.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19394.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5536.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32027.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36313.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34947.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48563.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48656.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1135.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47313.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26685.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21814.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34826.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11517.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34947.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50503.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11266.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57228.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29398.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1919.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8783.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60234.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29782.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52974.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41838.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32027.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48563.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28816.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29110.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64494.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2364	e9bb5a4197c447bcc9a626ab093923eb562f61fce11799a7e8d2e808011aa958N.exe
2728	Unicorn-61875.exe
2960	Unicorn-58938.exe
4308	Unicorn-63344.exe
820	Unicorn-29257.exe
2952	Unicorn-33664.exe
3996	Unicorn-42993.exe
1208	Unicorn-27254.exe
4052	Unicorn-65184.exe
5116	Unicorn-42526.exe
2516	Unicorn-48656.exe
1008	Unicorn-15599.exe
4852	Unicorn-44935.exe
4532	Unicorn-31479.exe
2380	Unicorn-13778.exe
5008	Unicorn-40129.exe
3020	Unicorn-34064.exe
4476	Unicorn-62138.exe
2080	Unicorn-3695.exe
3476	Unicorn-36103.exe
4952	Unicorn-20032.exe
1556	Unicorn-35984.exe
1172	Unicorn-19456.exe
4628	Unicorn-16502.exe
4192	Unicorn-19648.exe
3096	Unicorn-10333.exe
2772	Unicorn-62334.exe
4368	Unicorn-65127.exe
1752	Unicorn-30224.exe
4000	Unicorn-42838.exe
2000	Unicorn-29155.exe
3864	Unicorn-13238.exe
4032	Unicorn-54640.exe
3884	Unicorn-1910.exe
4136	Unicorn-6783.exe
3032	Unicorn-45808.exe
2044	Unicorn-7961.exe
2496	Unicorn-27827.exe
2268	Unicorn-40633.exe
3732	Unicorn-15247.exe
2808	Unicorn-60499.exe
2140	Unicorn-24000.exe
3236	Unicorn-47728.exe
1016	Unicorn-30131.exe
4128	Unicorn-4281.exe
4984	Unicorn-29747.exe
1036	Unicorn-60151.exe
3428	Unicorn-14479.exe
4176	Unicorn-14479.exe
4244	Unicorn-60151.exe
404	Unicorn-59278.exe
2784	Unicorn-32663.exe
780	Unicorn-7469.exe
2208	Unicorn-29398.exe
4648	Unicorn-50032.exe
744	Unicorn-65491.exe
4552	Unicorn-60046.exe
4236	Unicorn-33696.exe
4416	Unicorn-40718.exe
4804	Unicorn-13446.exe
2896	Unicorn-65491.exe
3204	Unicorn-29782.exe
4380	Unicorn-58112.exe
1968	Unicorn-21718.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2364 wrote to memory of 2728	2364	e9bb5a4197c447bcc9a626ab093923eb562f61fce11799a7e8d2e808011aa958N.exe	89
PID 2364 wrote to memory of 2728	2364	e9bb5a4197c447bcc9a626ab093923eb562f61fce11799a7e8d2e808011aa958N.exe	89
PID 2364 wrote to memory of 2728	2364	e9bb5a4197c447bcc9a626ab093923eb562f61fce11799a7e8d2e808011aa958N.exe	89
PID 2728 wrote to memory of 4308	2728	Unicorn-61875.exe	93
PID 2728 wrote to memory of 4308	2728	Unicorn-61875.exe	93
PID 2728 wrote to memory of 4308	2728	Unicorn-61875.exe	93
PID 2364 wrote to memory of 2960	2364	e9bb5a4197c447bcc9a626ab093923eb562f61fce11799a7e8d2e808011aa958N.exe	94
PID 2364 wrote to memory of 2960	2364	e9bb5a4197c447bcc9a626ab093923eb562f61fce11799a7e8d2e808011aa958N.exe	94
PID 2364 wrote to memory of 2960	2364	e9bb5a4197c447bcc9a626ab093923eb562f61fce11799a7e8d2e808011aa958N.exe	94
PID 2960 wrote to memory of 548	2960	Unicorn-58938.exe	97
PID 2960 wrote to memory of 548	2960	Unicorn-58938.exe	97
PID 2960 wrote to memory of 548	2960	Unicorn-58938.exe	97
PID 4308 wrote to memory of 2952	4308	Unicorn-63344.exe	98
PID 4308 wrote to memory of 2952	4308	Unicorn-63344.exe	98
PID 4308 wrote to memory of 2952	4308	Unicorn-63344.exe	98
PID 2364 wrote to memory of 3996	2364	e9bb5a4197c447bcc9a626ab093923eb562f61fce11799a7e8d2e808011aa958N.exe	100
PID 2364 wrote to memory of 3996	2364	e9bb5a4197c447bcc9a626ab093923eb562f61fce11799a7e8d2e808011aa958N.exe	100
PID 2364 wrote to memory of 3996	2364	e9bb5a4197c447bcc9a626ab093923eb562f61fce11799a7e8d2e808011aa958N.exe	100
PID 2728 wrote to memory of 820	2728	Unicorn-61875.exe	99
PID 2728 wrote to memory of 820	2728	Unicorn-61875.exe	99
PID 2728 wrote to memory of 820	2728	Unicorn-61875.exe	99
PID 2960 wrote to memory of 1208	2960	Unicorn-58938.exe	102
PID 2960 wrote to memory of 1208	2960	Unicorn-58938.exe	102
PID 2960 wrote to memory of 1208	2960	Unicorn-58938.exe	102
PID 820 wrote to memory of 4052	820	Unicorn-29257.exe	105
PID 820 wrote to memory of 4052	820	Unicorn-29257.exe	105
PID 820 wrote to memory of 4052	820	Unicorn-29257.exe	105
PID 2728 wrote to memory of 5116	2728	Unicorn-61875.exe	106
PID 2728 wrote to memory of 5116	2728	Unicorn-61875.exe	106
PID 2728 wrote to memory of 5116	2728	Unicorn-61875.exe	106
PID 2952 wrote to memory of 2516	2952	Unicorn-33664.exe	107
PID 2952 wrote to memory of 2516	2952	Unicorn-33664.exe	107
PID 2952 wrote to memory of 2516	2952	Unicorn-33664.exe	107
PID 3996 wrote to memory of 1008	3996	Unicorn-42993.exe	108
PID 3996 wrote to memory of 1008	3996	Unicorn-42993.exe	108
PID 3996 wrote to memory of 1008	3996	Unicorn-42993.exe	108
PID 4308 wrote to memory of 4852	4308	Unicorn-63344.exe	109
PID 4308 wrote to memory of 4852	4308	Unicorn-63344.exe	109
PID 4308 wrote to memory of 4852	4308	Unicorn-63344.exe	109
PID 2364 wrote to memory of 4532	2364	e9bb5a4197c447bcc9a626ab093923eb562f61fce11799a7e8d2e808011aa958N.exe	110
PID 2364 wrote to memory of 4532	2364	e9bb5a4197c447bcc9a626ab093923eb562f61fce11799a7e8d2e808011aa958N.exe	110
PID 2364 wrote to memory of 4532	2364	e9bb5a4197c447bcc9a626ab093923eb562f61fce11799a7e8d2e808011aa958N.exe	110
PID 1208 wrote to memory of 2380	1208	Unicorn-27254.exe	111
PID 1208 wrote to memory of 2380	1208	Unicorn-27254.exe	111
PID 1208 wrote to memory of 2380	1208	Unicorn-27254.exe	111
PID 2960 wrote to memory of 5008	2960	Unicorn-58938.exe	112
PID 2960 wrote to memory of 5008	2960	Unicorn-58938.exe	112
PID 2960 wrote to memory of 5008	2960	Unicorn-58938.exe	112
PID 4052 wrote to memory of 3020	4052	Unicorn-65184.exe	113
PID 4052 wrote to memory of 3020	4052	Unicorn-65184.exe	113
PID 4052 wrote to memory of 3020	4052	Unicorn-65184.exe	113
PID 820 wrote to memory of 4476	820	Unicorn-29257.exe	114
PID 820 wrote to memory of 4476	820	Unicorn-29257.exe	114
PID 820 wrote to memory of 4476	820	Unicorn-29257.exe	114
PID 5116 wrote to memory of 2080	5116	Unicorn-42526.exe	115
PID 5116 wrote to memory of 2080	5116	Unicorn-42526.exe	115
PID 5116 wrote to memory of 2080	5116	Unicorn-42526.exe	115
PID 1008 wrote to memory of 4952	1008	Unicorn-15599.exe	116
PID 1008 wrote to memory of 4952	1008	Unicorn-15599.exe	116
PID 1008 wrote to memory of 4952	1008	Unicorn-15599.exe	116
PID 2728 wrote to memory of 3476	2728	Unicorn-61875.exe	117
PID 2728 wrote to memory of 3476	2728	Unicorn-61875.exe	117
PID 2728 wrote to memory of 3476	2728	Unicorn-61875.exe	117
PID 3996 wrote to memory of 4628	3996	Unicorn-42993.exe	118

C:\Users\Admin\AppData\Local\Temp\e9bb5a4197c447bcc9a626ab093923eb562f61fce11799a7e8d2e808011aa958N.exe
"C:\Users\Admin\AppData\Local\Temp\e9bb5a4197c447bcc9a626ab093923eb562f61fce11799a7e8d2e808011aa958N.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2364
- C:\Users\Admin\AppData\Local\Temp\Unicorn-61875.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-61875.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2728
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63344.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63344.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33664.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33664.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48656.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19648.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15247.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19667.exe
        8⤵
        
        PID:5704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-383.exe
        9⤵
        
        PID:6216
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6216 -s 632
        10⤵
        Program crash
        
        PID:9024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19945.exe
        9⤵
        
        PID:8800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63617.exe
        9⤵
        
        PID:12004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36362.exe
        9⤵
        
        PID:3788
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3788 -s 464
        10⤵
        Program crash
        
        PID:17400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32027.exe
        9⤵
        
        PID:3208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41830.exe
        8⤵
        
        PID:6916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9167.exe
        9⤵
        
        PID:9200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50759.exe
        9⤵
        
        PID:12184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7357.exe
        9⤵
        
        PID:16392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58940.exe
        9⤵
        
        PID:1236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29264.exe
        8⤵
        
        PID:8508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8569.exe
        8⤵
        
        PID:13056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32027.exe
        8⤵
        
        PID:4460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23942.exe
        7⤵
        
        PID:5900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49600.exe
        8⤵
        
        PID:6396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7391.exe
        9⤵
        
        PID:10980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51095.exe
        9⤵
        
        PID:16892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8341.exe
        9⤵
        
        PID:16728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29110.exe
        8⤵
        
        PID:10212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16928.exe
        8⤵
        
        PID:13616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48563.exe
        8⤵
        
        PID:17320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27904.exe
        7⤵
        
        PID:7424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24202.exe
        7⤵
        
        PID:9476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35472.exe
        7⤵
        
        PID:14152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49093.exe
        7⤵
        
        PID:648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60151.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13138.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37622.exe
        8⤵
        
        PID:7140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38704.exe
        9⤵
        
        PID:10120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35889.exe
        9⤵
        
        PID:15112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48563.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:6636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42846.exe
        8⤵
        
        PID:10184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38855.exe
        8⤵
        
        PID:13108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32027.exe
        8⤵
        
        PID:6176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52890.exe
        7⤵
        
        PID:7004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25155.exe
        8⤵
        
        PID:10748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43097.exe
        8⤵
        
        PID:16804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14274.exe
        8⤵
        
        PID:7952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18921.exe
        7⤵
        
        PID:11168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50849.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:15176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25191.exe
        7⤵
        
        PID:17940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63630.exe
        6⤵
        
        PID:5988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56720.exe
        7⤵
        
        PID:6568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34947.exe
        8⤵
        
        PID:11192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39913.exe
        8⤵
        
        PID:15292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44383.exe
        8⤵
        
        PID:18384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29110.exe
        7⤵
        
        PID:10204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49518.exe
        7⤵
        
        PID:13364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48563.exe
        7⤵
        
        PID:6592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3209.exe
        6⤵
        
        PID:7620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2082.exe
        7⤵
        
        PID:10016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5821.exe
        7⤵
        
        PID:5532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32749.exe
        6⤵
        
        PID:9580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18937.exe
        6⤵
        
        PID:14116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16228.exe
        6⤵
        
        PID:2024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65127.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14479.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10450.exe
        7⤵
        
        PID:5848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12770.exe
        8⤵
        
        PID:7132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57107.exe
        9⤵
        
        PID:7220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65450.exe
        9⤵
        
        PID:9708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4560.exe
        9⤵
        
        PID:15652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11486.exe
        9⤵
        
        PID:920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6038.exe
        8⤵
        
        PID:8484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50561.exe
        8⤵
        
        PID:12860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32027.exe
        8⤵
        
        PID:16988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26169.exe
        7⤵
        
        PID:6960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34947.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:11184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5821.exe
        8⤵
        
        PID:1976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55809.exe
        7⤵
        
        PID:9992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3193.exe
        7⤵
        
        PID:13160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2736.exe
        7⤵
        
        PID:17404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32027.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:16448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10870.exe
        6⤵
        
        PID:3856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53331.exe
        7⤵
        
        PID:6312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30595.exe
        8⤵
        
        PID:8548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58263.exe
        8⤵
        
        PID:13148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45806.exe
        8⤵
        
        PID:16392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50392.exe
        8⤵
        
        PID:18080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10173.exe
        7⤵
        
        PID:10112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55383.exe
        7⤵
        
        PID:13076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32027.exe
        7⤵
        
        PID:6364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41441.exe
        6⤵
        
        PID:6008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2082.exe
        7⤵
        
        PID:10036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5821.exe
        7⤵
        
        PID:2544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11517.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32969.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:14844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29128.exe
        6⤵
        
        PID:17832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59278.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48800.exe
        6⤵
        
        PID:5368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33267.exe
        7⤵
        
        PID:7688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7391.exe
        8⤵
        
        PID:11732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43481.exe
        8⤵
        
        PID:16704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35929.exe
        7⤵
        
        PID:9908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56529.exe
        7⤵
        
        PID:14324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57228.exe
        7⤵
        
        PID:1840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31952.exe
        6⤵
        
        PID:8396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55825.exe
        6⤵
        
        PID:12412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45769.exe
        6⤵
        
        PID:17340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13914.exe
        6⤵
        
        PID:6424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4150.exe
        5⤵
        
        PID:5916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-786.exe
        6⤵
        
        PID:7532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18419.exe
        7⤵
        
        PID:11216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5821.exe
        7⤵
        
        PID:15136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43196.exe
        7⤵
        
        PID:15936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31312.exe
        6⤵
        
        PID:10040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59514.exe
        6⤵
        
        PID:15220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41727.exe
        6⤵
        
        PID:18024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3693.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12086.exe
        5⤵
        
        PID:10508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51379.exe
        5⤵
        
        PID:15196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7597.exe
        5⤵
        
        PID:17684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44935.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44935.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19456.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30131.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53792.exe
        7⤵
        
        PID:5816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23840.exe
        8⤵
        
        PID:6516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47123.exe
        9⤵
        
        PID:8604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22704.exe
        9⤵
        
        PID:13988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48563.exe
        9⤵
        
        PID:6184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23033.exe
        8⤵
        
        PID:8936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2704.exe
        8⤵
        
        PID:13044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-934.exe
        8⤵
        
        PID:16684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17237.exe
        8⤵
        
        PID:5336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52890.exe
        7⤵
        
        PID:7128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47251.exe
        8⤵
        
        PID:11852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50503.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:15244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5845.exe
        8⤵
        
        PID:7888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19305.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:10712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49505.exe
        7⤵
        
        PID:14860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17422.exe
        7⤵
        
        PID:8832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10870.exe
        6⤵
        
        PID:1396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44992.exe
        7⤵
        
        PID:6760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3151.exe
        8⤵
        
        PID:11256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5821.exe
        8⤵
        
        PID:15256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53230.exe
        7⤵
        
        PID:10100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12809.exe
        7⤵
        
        PID:12568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50867.exe
        7⤵
        
        PID:4288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21757.exe
        6⤵
        
        PID:1660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34947.exe
        7⤵
        
        PID:11176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5821.exe
        7⤵
        
        PID:12132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64746.exe
        6⤵
        
        PID:9380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62945.exe
        6⤵
        
        PID:13680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35785.exe
        6⤵
        
        PID:17016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23741.exe
        6⤵
        
        PID:17964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29398.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10834.exe
        6⤵
        
        PID:6120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40192.exe
        7⤵
        
        PID:6788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24963.exe
        8⤵
        
        PID:11232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51095.exe
        8⤵
        
        PID:16908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29110.exe
        7⤵
        
        PID:10232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16928.exe
        7⤵
        
        PID:13624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48563.exe
        7⤵
        
        PID:5624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18886.exe
        6⤵
        
        PID:7732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47251.exe
        7⤵
        
        PID:11836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34742.exe
        7⤵
        
        PID:16228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31397.exe
        7⤵
        
        PID:17724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13933.exe
        6⤵
        
        PID:11064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4802.exe
        6⤵
        
        PID:14944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11470.exe
        6⤵
        
        PID:8384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42670.exe
        5⤵
        
        PID:5372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18083.exe
        6⤵
        
        PID:7392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44840.exe
        7⤵
        
        PID:18372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19126.exe
        6⤵
        
        PID:8780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38657.exe
        6⤵
        
        PID:14072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29148.exe
        6⤵
        
        PID:12136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56703.exe
        6⤵
        
        PID:7864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53178.exe
        5⤵
        
        PID:7808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34755.exe
        6⤵
        
        PID:11244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8118.exe
        6⤵
        
        PID:2408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31397.exe
        6⤵
        
        PID:17676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11517.exe
        5⤵
        
        PID:10836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32969.exe
        5⤵
        
        PID:14836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21651.exe
        5⤵
        
        PID:6264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62334.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62334.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14479.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12095.exe
        6⤵
        
        PID:6052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39232.exe
        7⤵
        
        PID:6728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62816.exe
        8⤵
        
        PID:9732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41049.exe
        8⤵
        
        PID:12912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57228.exe
        8⤵
        
        PID:1040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29110.exe
        7⤵
        
        PID:10224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49518.exe
        7⤵
        
        PID:12844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48563.exe
        7⤵
        
        PID:6152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46458.exe
        6⤵
        
        PID:7516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58648.exe
        7⤵
        
        PID:5072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18336.exe
        6⤵
        
        PID:9484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44138.exe
        6⤵
        
        PID:14132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32027.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10102.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14543.exe
        6⤵
        
        PID:7648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5839.exe
        7⤵
        
        PID:9156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40214.exe
        7⤵
        
        PID:4872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12694.exe
        6⤵
        
        PID:11532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14928.exe
        6⤵
        
        PID:16088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47313.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20182.exe
        5⤵
        
        PID:10848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49505.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:14988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17422.exe
        5⤵
        
        PID:8880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32663.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32663.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13138.exe
        5⤵
        
        PID:2604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37216.exe
        6⤵
        
        PID:7656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7391.exe
        7⤵
        
        PID:11724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43481.exe
        7⤵
        
        PID:16696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37958.exe
        6⤵
        
        PID:9624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27613.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:13740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43196.exe
        6⤵
        
        PID:16920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1974.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48243.exe
        6⤵
        
        PID:13472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23595.exe
        6⤵
        
        PID:16856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14317.exe
        5⤵
        
        PID:10860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58170.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:15036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60483.exe
        5⤵
        
        PID:7884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12205.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12205.exe
      4⤵
      PID:5840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33267.exe
        5⤵
        
        PID:7552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13458.exe
        6⤵
        
        PID:12120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23595.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52842.exe
        5⤵
        
        PID:9684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3021.exe
        5⤵
        
        PID:15172
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 15172 -s 468
        6⤵
        Program crash
        
        PID:16680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17995.exe
        5⤵
        
        PID:4396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52695.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52695.exe
      4⤵
      PID:6504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6130.exe
        5⤵
        
        PID:12056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51095.exe
        5⤵
        
        PID:16884
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 16884 -s 464
        6⤵
        Program crash
        
        PID:5576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64262.exe
        5⤵
        
        PID:17900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29152.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29152.exe
      4⤵
      PID:10476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52165.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52165.exe
      4⤵
      PID:15680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32222.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32222.exe
      4⤵
      PID:15604
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29257.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29257.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65184.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65184.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34064.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54640.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58112.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25936.exe
        8⤵
        
        PID:1932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40579.exe
        9⤵
        
        PID:7224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28470.exe
        9⤵
        
        PID:11300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64830.exe
        9⤵
        
        PID:16876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60983.exe
        8⤵
        
        PID:6816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53856.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:17164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57423.exe
        9⤵
        
        PID:7208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25168.exe
        8⤵
        
        PID:11628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5718.exe
        8⤵
        
        PID:16028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7430.exe
        7⤵
        
        PID:6764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8783.exe
        8⤵
        
        PID:7312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28470.exe
        8⤵
        
        PID:6116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64830.exe
        8⤵
        
        PID:16868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58673.exe
        7⤵
        
        PID:8348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7609.exe
        7⤵
        
        PID:12808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23104.exe
        7⤵
        
        PID:17148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59351.exe
        7⤵
        
        PID:12296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21718.exe
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:1968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9407.exe
        7⤵
        
        PID:6072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20528.exe
        8⤵
        
        PID:8476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57879.exe
        8⤵
        
        PID:13196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45806.exe
        8⤵
        
        PID:1332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57228.exe
        8⤵
        
        PID:6600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60983.exe
        7⤵
        
        PID:6936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50384.exe
        8⤵
        
        PID:15608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30791.exe
        8⤵
        
        PID:17924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25168.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:11644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5718.exe
        7⤵
        
        PID:16012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33957.exe
        7⤵
        
        PID:6084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60942.exe
        6⤵
        
        PID:6428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-662.exe
        7⤵
        
        PID:8956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44522.exe
        7⤵
        
        PID:14080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48563.exe
        7⤵
        
        PID:1996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8025.exe
        6⤵
        
        PID:9160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61694.exe
        6⤵
        
        PID:12280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50762.exe
        6⤵
        
        PID:15492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29128.exe
        6⤵
        
        PID:17840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1910.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8719.exe
        6⤵
        
        PID:5152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39718.exe
        7⤵
        
        PID:6808
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6808 -s 380
        8⤵
        Program crash
        
        PID:6588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11133.exe
        7⤵
        
        PID:11072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34313.exe
        7⤵
        
        PID:15188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33720.exe
        7⤵
        
        PID:7936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13081.exe
        6⤵
        
        PID:6536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50211.exe
        7⤵
        
        PID:8620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39238.exe
        7⤵
        
        PID:12988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57228.exe
        7⤵
        
        PID:5752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34832.exe
        6⤵
        
        PID:9072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4822.exe
        6⤵
        
        PID:6220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1760.exe
        6⤵
        
        PID:3672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50671.exe
        6⤵
        
        PID:8588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35069.exe
        5⤵
        
        PID:5172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38841.exe
        6⤵
        
        PID:6828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52515.exe
        7⤵
        
        PID:8896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57879.exe
        7⤵
        
        PID:13204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45806.exe
        7⤵
        
        PID:17176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57228.exe
        7⤵
        
        PID:3920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48711.exe
        6⤵
        
        PID:10168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46718.exe
        6⤵
        
        PID:3092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31433.exe
        6⤵
        
        PID:13788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29716.exe
        6⤵
        
        PID:6864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50279.exe
        5⤵
        
        PID:6472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8783.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32393.exe
        6⤵
        
        PID:8988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57217.exe
        6⤵
        
        PID:16736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37263.exe
        6⤵
        
        PID:17556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64897.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45158.exe
        5⤵
        
        PID:6360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19394.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:16068
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 16068 -s 464
        6⤵
        Program crash
        
        PID:17060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45434.exe
        5⤵
        
        PID:5896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62138.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62138.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6783.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43120.exe
        6⤵
        
        PID:5244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38841.exe
        7⤵
        
        PID:6836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52515.exe
        8⤵
        
        PID:5016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39897.exe
        8⤵
        
        PID:12308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45806.exe
        8⤵
        
        PID:16780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57228.exe
        8⤵
        
        PID:6292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26685.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58839.exe
        7⤵
        
        PID:13100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32027.exe
        7⤵
        
        PID:6028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43943.exe
        6⤵
        
        PID:5496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42416.exe
        7⤵
        
        PID:8996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50759.exe
        7⤵
        
        PID:12248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4560.exe
        7⤵
        
        PID:15660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37263.exe
        7⤵
        
        PID:17708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33680.exe
        6⤵
        
        PID:8808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3945.exe
        6⤵
        
        PID:12020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27696.exe
        6⤵
        
        PID:15468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55272.exe
        6⤵
        
        PID:7868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6918.exe
        5⤵
        
        PID:5264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38841.exe
        6⤵
        
        PID:6844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26464.exe
        7⤵
        
        PID:8960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50759.exe
        7⤵
        
        PID:12256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4560.exe
        7⤵
        
        PID:15604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30735.exe
        7⤵
        
        PID:12476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46023.exe
        6⤵
        
        PID:9716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51985.exe
        6⤵
        
        PID:12816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32054.exe
        6⤵
        
        PID:17052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16228.exe
        6⤵
        
        PID:4008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28461.exe
        5⤵
        
        PID:6400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51280.exe
        6⤵
        
        PID:7628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39238.exe
        6⤵
        
        PID:13004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57228.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:17148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40698.exe
        5⤵
        
        PID:9056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61694.exe
        5⤵
        
        PID:12216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50762.exe
        5⤵
        
        PID:15676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42949.exe
        5⤵
        
        PID:1452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7581.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7581.exe
      4⤵
      Executes dropped EXE
      PID:4888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9305.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9305.exe
      4⤵
      PID:5212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39718.exe
        5⤵
        
        PID:6816
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6816 -s 412
        6⤵
        Program crash
        
        PID:6632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35518.exe
        5⤵
        
        PID:9172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4822.exe
        5⤵
        
        PID:10160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38089.exe
        5⤵
        
        PID:17096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49321.exe
        5⤵
        
        PID:15644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32013.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32013.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50211.exe
        5⤵
        
        PID:8456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39238.exe
        5⤵
        
        PID:12996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57228.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39721.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39721.exe
      4⤵
      PID:7616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6495.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6495.exe
      4⤵
      PID:11720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55720.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55720.exe
      4⤵
      PID:17088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40870.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40870.exe
      4⤵
      PID:8584
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42526.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42526.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:5116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3695.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3695.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47728.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61680.exe
        6⤵
        
        PID:5992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18848.exe
        7⤵
        
        PID:5756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4770.exe
        8⤵
        
        PID:8788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5821.exe
        8⤵
        
        PID:1940
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1940 -s 436
        9⤵
        Program crash
        
        PID:17356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43196.exe
        8⤵
        
        PID:8240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60910.exe
        7⤵
        
        PID:8852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52970.exe
        7⤵
        
        PID:13448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21485.exe
        7⤵
        
        PID:4484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3006.exe
        7⤵
        
        PID:5556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10717.exe
        6⤵
        
        PID:7368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54771.exe
        7⤵
        
        PID:13800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51363.exe
        7⤵
        
        PID:5460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5561.exe
        6⤵
        
        PID:9424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52769.exe
        6⤵
        
        PID:13764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51397.exe
        6⤵
        
        PID:16604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59879.exe
        5⤵
        
        PID:4856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14159.exe
        6⤵
        
        PID:6732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7391.exe
        7⤵
        
        PID:11832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43481.exe
        7⤵
        
        PID:16712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31397.exe
        7⤵
        
        PID:17716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12694.exe
        6⤵
        
        PID:11524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14928.exe
        6⤵
        
        PID:16168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32237.exe
        5⤵
        
        PID:7752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54163.exe
        6⤵
        
        PID:9920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50739.exe
        6⤵
        
        PID:14952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23921.exe
        6⤵
        
        PID:7980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20182.exe
        5⤵
        
        PID:10868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49505.exe
        5⤵
        
        PID:14852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12062.exe
        5⤵
        
        PID:17544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60151.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60151.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12095.exe
        5⤵
        
        PID:6060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34035.exe
        6⤵
        
        PID:7440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50656.exe
        7⤵
        
        PID:13700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23595.exe
        7⤵
        
        PID:11008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4601.exe
        6⤵
        
        PID:9516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4802.exe
        6⤵
        
        PID:14972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19533.exe
        6⤵
        
        PID:5608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57121.exe
        5⤵
        
        PID:8184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56400.exe
        6⤵
        
        PID:11848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61079.exe
        6⤵
        
        PID:16620
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 16620 -s 436
        7⤵
        Program crash
        
        PID:1884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47734.exe
        6⤵
        
        PID:18112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55825.exe
        5⤵
        
        PID:12404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62106.exe
        5⤵
        
        PID:1184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23837.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23837.exe
      4⤵
      PID:5144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18000.exe
        5⤵
        
        PID:7608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7391.exe
        6⤵
        
        PID:9856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51095.exe
        6⤵
        
        PID:16900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63023.exe
        6⤵
        
        PID:16720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36697.exe
        5⤵
        
        PID:9640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5408.exe
        5⤵
        
        PID:14168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15698.exe
        5⤵
        
        PID:4092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53178.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53178.exe
      4⤵
      PID:7792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22675.exe
        5⤵
        
        PID:13816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51363.exe
        5⤵
        
        PID:5180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26784.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26784.exe
      4⤵
      PID:10968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32969.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32969.exe
      4⤵
      PID:15048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45272.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45272.exe
      4⤵
      PID:18008
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36103.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36103.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29747.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29747.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32272.exe
        5⤵
        
        PID:5420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16931.exe
        6⤵
        
        PID:7580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39411.exe
        7⤵
        
        PID:14204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64348.exe
        7⤵
        
        PID:1348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53418.exe
        6⤵
        
        PID:9528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38273.exe
        6⤵
        
        PID:14124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27244.exe
        6⤵
        
        PID:6444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33577.exe
        5⤵
        
        PID:7800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44128.exe
        6⤵
        
        PID:3184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24206.exe
        6⤵
        
        PID:17864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14317.exe
        5⤵
        
        PID:10884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58170.exe
        5⤵
        
        PID:15028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28597.exe
        5⤵
        
        PID:17748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33366.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33366.exe
      4⤵
      PID:6048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53552.exe
        5⤵
        
        PID:7596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48864.exe
        6⤵
        
        PID:17384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37627.exe
        6⤵
        
        PID:748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21814.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57210.exe
        5⤵
        
        PID:14904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20737.exe
        5⤵
        
        PID:3460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6493.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6493.exe
      4⤵
      PID:6492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63811.exe
        5⤵
        
        PID:13504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23595.exe
        5⤵
        
        PID:6180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37287.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37287.exe
      4⤵
      PID:10460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7712.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7712.exe
      4⤵
      PID:15472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60476.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60476.exe
      4⤵
      PID:8072
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7469.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7469.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61296.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61296.exe
      4⤵
      PID:6040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47488.exe
        5⤵
        
        PID:6928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34947.exe
        6⤵
        
        PID:11140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5821.exe
        6⤵
        
        PID:15804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43334.exe
        5⤵
        
        PID:9976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62865.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11401.exe
        5⤵
        
        PID:4020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48563.exe
        5⤵
        
        PID:6296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63287.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63287.exe
      4⤵
      PID:7296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30723.exe
        5⤵
        
        PID:11816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-425.exe
        5⤵
        
        PID:15308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18921.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18921.exe
      4⤵
      PID:11056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61674.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61674.exe
      4⤵
      PID:14920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9931.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9931.exe
      4⤵
      PID:12300
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5737.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5737.exe
    3⤵
    PID:5472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7327.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7327.exe
      4⤵
      PID:6416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3151.exe
        5⤵
        
        PID:9768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8118.exe
        5⤵
        
        PID:15356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30418.exe
        5⤵
        
        PID:15588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29110.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29110.exe
      4⤵
      PID:10132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34525.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34525.exe
      4⤵
      PID:13584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18798.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18798.exe
      4⤵
      PID:17972
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28816.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28816.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:7640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3535.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3535.exe
      4⤵
      PID:11012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6582.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6582.exe
      4⤵
      PID:14896
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43160.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43160.exe
    3⤵
    PID:9700
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29198.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29198.exe
    3⤵
    PID:11808
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23542.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23542.exe
    3⤵
    PID:16220
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 16220 -s 248
      4⤵
      Program crash
      PID:15596
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26015.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26015.exe
    3⤵
    PID:10568
- C:\Users\Admin\AppData\Local\Temp\Unicorn-58938.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-58938.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2960
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1183.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1183.exe
    3⤵
    - Executes dropped EXE
    PID:548
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27254.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27254.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13778.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13778.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30224.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65491.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58881.exe
        7⤵
        
        PID:16320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2806.exe
        6⤵
        
        PID:6128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33267.exe
        7⤵
        
        PID:7680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51475.exe
        8⤵
        
        PID:11224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5821.exe
        8⤵
        
        PID:15272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36313.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41838.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:14272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57228.exe
        7⤵
        
        PID:4948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37329.exe
        6⤵
        
        PID:7348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11266.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:15732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7451.exe
        7⤵
        
        PID:16676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13654.exe
        6⤵
        
        PID:11336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43073.exe
        6⤵
        
        PID:15844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13446.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42272.exe
        6⤵
        
        PID:2056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9167.exe
        7⤵
        
        PID:9192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50759.exe
        7⤵
        
        PID:12264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4560.exe
        7⤵
        
        PID:15584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57228.exe
        7⤵
        
        PID:17172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60983.exe
        6⤵
        
        PID:8132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5954.exe
        7⤵
        
        PID:13824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51363.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25168.exe
        6⤵
        
        PID:11652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18105.exe
        6⤵
        
        PID:15940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5157.exe
        6⤵
        
        PID:1240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11741.exe
        5⤵
        
        PID:6508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40387.exe
        6⤵
        
        PID:8144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32393.exe
        6⤵
        
        PID:8156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64830.exe
        6⤵
        
        PID:16852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53407.exe
        6⤵
        
        PID:17208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40698.exe
        5⤵
        
        PID:9080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61694.exe
        5⤵
        
        PID:12192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2329.exe
        5⤵
        
        PID:16152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51397.exe
        5⤵
        
        PID:16508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42838.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42838.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50032.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39200.exe
        6⤵
        
        PID:6136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29427.exe
        7⤵
        
        PID:7436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12694.exe
        7⤵
        
        PID:11556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14928.exe
        7⤵
        
        PID:16052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23593.exe
        6⤵
        
        PID:7432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22467.exe
        7⤵
        
        PID:11952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51095.exe
        7⤵
        
        PID:16936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25168.exe
        6⤵
        
        PID:11636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5718.exe
        6⤵
        
        PID:16020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20102.exe
        5⤵
        
        PID:5908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20528.exe
        6⤵
        
        PID:9020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26183.exe
        6⤵
        
        PID:14888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28597.exe
        6⤵
        
        PID:17732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9565.exe
        5⤵
        
        PID:8104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20405.exe
        6⤵
        
        PID:7940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31034.exe
        5⤵
        
        PID:11620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62590.exe
        5⤵
        
        PID:16072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12062.exe
        5⤵
        
        PID:17512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60046.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60046.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5074.exe
        5⤵
        
        PID:5400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33760.exe
        6⤵
        
        PID:7352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7391.exe
        7⤵
        
        PID:11800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43481.exe
        7⤵
        
        PID:16720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51498.exe
        6⤵
        
        PID:9416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55569.exe
        6⤵
        
        PID:13772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48563.exe
        6⤵
        
        PID:6372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23593.exe
        5⤵
        
        PID:3412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16816.exe
        6⤵
        
        PID:12388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2169.exe
        6⤵
        
        PID:1340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4469.exe
        6⤵
        
        PID:17692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7789.exe
        5⤵
        
        PID:11344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34826.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:15900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56319.exe
        5⤵
        
        PID:8376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64119.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64119.exe
      4⤵
      PID:5640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17315.exe
        5⤵
        
        PID:7496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51475.exe
        6⤵
        
        PID:11204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5821.exe
        6⤵
        
        PID:15868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20139.exe
        6⤵
        
        PID:11932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31312.exe
        5⤵
        
        PID:1216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59514.exe
        5⤵
        
        PID:15212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28597.exe
        5⤵
        
        PID:17740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38862.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38862.exe
      4⤵
      PID:8152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22467.exe
        5⤵
        
        PID:11944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51095.exe
        5⤵
        
        PID:16856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47542.exe
        5⤵
        
        PID:18164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5833.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5833.exe
      4⤵
      PID:11664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63120.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63120.exe
      4⤵
      PID:15984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40269.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40269.exe
      4⤵
      PID:17856
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40129.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40129.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:5008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29155.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29155.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33696.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21603.exe
        6⤵
        
        PID:2880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16931.exe
        7⤵
        
        PID:7568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53418.exe
        7⤵
        
        PID:9608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4802.exe
        7⤵
        
        PID:14960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58563.exe
        7⤵
        
        PID:5652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23593.exe
        6⤵
        
        PID:4716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32560.exe
        7⤵
        
        PID:11576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1193.exe
        7⤵
        
        PID:16116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7789.exe
        6⤵
        
        PID:11352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34826.exe
        6⤵
        
        PID:15892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44519.exe
        5⤵
        
        PID:5720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42800.exe
        6⤵
        
        PID:8908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50759.exe
        6⤵
        
        PID:12168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21664.exe
        6⤵
        
        PID:15232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43196.exe
        6⤵
        
        PID:16864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33680.exe
        5⤵
        
        PID:8820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41710.exe
        5⤵
        
        PID:12688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16854.exe
        5⤵
        
        PID:3160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42257.exe
        5⤵
        
        PID:17932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29782.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29782.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:3204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9983.exe
        5⤵
        
        PID:5956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14159.exe
        6⤵
        
        PID:7676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12694.exe
        6⤵
        
        PID:11540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14928.exe
        6⤵
        
        PID:16096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61367.exe
        5⤵
        
        PID:8136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21808.exe
        6⤵
        
        PID:11968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51566.exe
        6⤵
        
        PID:3992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25168.exe
        5⤵
        
        PID:11604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5718.exe
        5⤵
        
        PID:16104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48774.exe
        5⤵
        
        PID:8564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60750.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60750.exe
      4⤵
      PID:6496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12162.exe
        5⤵
        
        PID:9772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24157.exe
        5⤵
        
        PID:12664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43196.exe
        5⤵
        
        PID:6456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8025.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8025.exe
      4⤵
      PID:9148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61694.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61694.exe
      4⤵
      PID:12176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2329.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2329.exe
      4⤵
      PID:16328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29716.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29716.exe
      4⤵
      PID:5728
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13238.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13238.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65491.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65491.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6646.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6646.exe
      4⤵
      PID:6012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8783.exe
        5⤵
        
        PID:4464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52590.exe
        5⤵
        
        PID:12788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32027.exe
        5⤵
        
        PID:6656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9565.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9565.exe
      4⤵
      PID:8092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7391.exe
        5⤵
        
        PID:11892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43481.exe
        5⤵
        
        PID:16728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55825.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55825.exe
      4⤵
      PID:12420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62106.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62106.exe
      4⤵
      PID:4900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50632.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50632.exe
      4⤵
      PID:7892
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40718.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40718.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7679.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7679.exe
      4⤵
      PID:5632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14543.exe
        5⤵
        
        PID:3632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22467.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:12000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43097.exe
        6⤵
        
        PID:16796
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 16796 -s 464
        7⤵
        Program crash
        
        PID:5236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47734.exe
        6⤵
        
        PID:17948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12694.exe
        5⤵
        
        PID:11548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14928.exe
        5⤵
        
        PID:16080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37263.exe
        5⤵
        
        PID:17536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61367.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61367.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53155.exe
        5⤵
        
        PID:15280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33806.exe
        5⤵
        
        PID:18092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25168.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25168.exe
      4⤵
      PID:11672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37514.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37514.exe
      4⤵
      PID:15996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44742.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44742.exe
      4⤵
      PID:18064
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49094.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49094.exe
    3⤵
    PID:4892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57107.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57107.exe
      4⤵
      PID:7316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28470.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28470.exe
      4⤵
      PID:7848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58094.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58094.exe
      4⤵
      PID:16784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37263.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37263.exe
      4⤵
      PID:17572
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30560.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30560.exe
    3⤵
    PID:8512
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1368.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1368.exe
    3⤵
    PID:11680
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48641.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48641.exe
    3⤵
    PID:15948
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22606.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22606.exe
    3⤵
    PID:17908
- C:\Users\Admin\AppData\Local\Temp\Unicorn-42993.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-42993.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3996
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15599.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15599.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20032.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20032.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45808.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58496.exe
        6⤵
        
        PID:5352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33715.exe
        7⤵
        
        PID:6376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9935.exe
        8⤵
        
        PID:8980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50759.exe
        8⤵
        
        PID:12228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4560.exe
        8⤵
        
        PID:15648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42623.exe
        8⤵
        
        PID:15648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21097.exe
        7⤵
        
        PID:9096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64494.exe
        7⤵
        
        PID:12236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10425.exe
        7⤵
        
        PID:15532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44934.exe
        7⤵
        
        PID:18016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65287.exe
        6⤵
        
        PID:6000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23216.exe
        7⤵
        
        PID:9740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15798.exe
        7⤵
        
        PID:13028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5536.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57228.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49095.exe
        6⤵
        
        PID:10080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46718.exe
        6⤵
        
        PID:12928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31433.exe
        6⤵
        
        PID:13888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2004.exe
        6⤵
        
        PID:5328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38630.exe
        5⤵
        
        PID:5340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17763.exe
        6⤵
        
        PID:6344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49863.exe
        7⤵
        
        PID:9188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29639.exe
        7⤵
        
        PID:13864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51052.exe
        7⤵
        
        PID:1768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21097.exe
        6⤵
        
        PID:9088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64494.exe
        6⤵
        
        PID:12160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27530.exe
        6⤵
        
        PID:15124
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 15124 -s 436
        7⤵
        Program crash
        
        PID:17104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29185.exe
        6⤵
        
        PID:5536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61809.exe
        5⤵
        
        PID:7160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19571.exe
        6⤵
        
        PID:10804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38569.exe
        6⤵
        
        PID:15056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31397.exe
        6⤵
        
        PID:17668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8041.exe
        5⤵
        
        PID:8856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65441.exe
        5⤵
        
        PID:13032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16228.exe
        5⤵
        
        PID:17064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7961.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7961.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1135.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58810.exe
        5⤵
        
        PID:5140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12319.exe
        6⤵
        
        PID:6796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12274.exe
        7⤵
        
        PID:11488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1193.exe
        7⤵
        
        PID:16132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8825.exe
        6⤵
        
        PID:9688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30023.exe
        6⤵
        
        PID:12368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34530.exe
        6⤵
        
        PID:6460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43962.exe
        5⤵
        
        PID:8176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53395.exe
        6⤵
        
        PID:10048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30902.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:15788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36758.exe
        6⤵
        
        PID:5416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28621.exe
        5⤵
        
        PID:10520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55754.exe
        5⤵
        
        PID:15632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34488.exe
        5⤵
        
        PID:8160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42177.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42177.exe
      4⤵
      PID:5544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1919.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19459.exe
        6⤵
        
        PID:3740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39897.exe
        6⤵
        
        PID:12456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45806.exe
        6⤵
        
        PID:16976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57228.exe
        6⤵
        
        PID:6596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21097.exe
        5⤵
        
        PID:9064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64494.exe
        5⤵
        
        PID:12200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27530.exe
        5⤵
        
        PID:16212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34535.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34535.exe
      4⤵
      PID:5868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36016.exe
        5⤵
        
        PID:11080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35889.exe
        5⤵
        
        PID:15752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10334.exe
        5⤵
        
        PID:17820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32048.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32048.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:8528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33638.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33638.exe
      4⤵
      PID:13016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62923.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62923.exe
      4⤵
      PID:3464
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16502.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16502.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60499.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60499.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19667.exe
        5⤵
        
        PID:5696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-383.exe
        6⤵
        
        PID:6208
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6208 -s 628
        7⤵
        Program crash
        
        PID:8772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53687.exe
        6⤵
        
        PID:8844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15293.exe
        6⤵
        
        PID:12080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4566.exe
        6⤵
        
        PID:15264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30678.exe
        5⤵
        
        PID:6464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63651.exe
        6⤵
        
        PID:7292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2793.exe
        6⤵
        
        PID:11744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7357.exe
        6⤵
        
        PID:16400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10349.exe
        6⤵
        
        PID:9880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2160.exe
        5⤵
        
        PID:9128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4822.exe
        5⤵
        
        PID:10456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34624.exe
        5⤵
        
        PID:15640
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 15640 -s 464
        6⤵
        Program crash
        
        PID:2136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12650.exe
        5⤵
        
        PID:1640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5961.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5961.exe
      4⤵
      PID:5936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56720.exe
        5⤵
        
        PID:6488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-95.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-95.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:12508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2169.exe
        6⤵
        
        PID:15116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64454.exe
        6⤵
        
        PID:17916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29110.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:10196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65470.exe
        5⤵
        
        PID:13316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44375.exe
        5⤵
        
        PID:16556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48563.exe
        5⤵
        
        PID:6024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27904.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27904.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22467.exe
        5⤵
        
        PID:11936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61079.exe
        5⤵
        
        PID:16612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44527.exe
        5⤵
        
        PID:7400
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24202.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24202.exe
      4⤵
      PID:9468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35472.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35472.exe
      4⤵
      PID:14140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-276.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-276.exe
      4⤵
      PID:17124
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24000.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24000.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35043.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35043.exe
      4⤵
      PID:5764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40192.exe
        5⤵
        
        PID:6552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32560.exe
        6⤵
        
        PID:11708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1001.exe
        6⤵
        
        PID:16196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29110.exe
        5⤵
        
        PID:8600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49518.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48563.exe
        5⤵
        
        PID:6852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8022.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8022.exe
      4⤵
      PID:6528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34947.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:11148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5821.exe
        5⤵
        
        PID:15872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58881.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58881.exe
      4⤵
      PID:9336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6073.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6073.exe
      4⤵
      PID:13644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10699.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10699.exe
      4⤵
      PID:1344
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10678.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10678.exe
    3⤵
    PID:5880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44992.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44992.exe
      4⤵
      PID:6740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38704.exe
        5⤵
        
        PID:10064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5821.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:15924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53599.exe
        5⤵
        
        PID:17956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58903.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58903.exe
      4⤵
      PID:9672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54785.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54785.exe
      4⤵
      PID:12904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57255.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57255.exe
      4⤵
      PID:17280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2050.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2050.exe
      4⤵
      PID:6324
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23952.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23952.exe
    3⤵
    PID:7280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34947.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34947.exe
      4⤵
      PID:3688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5821.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5821.exe
      4⤵
      PID:15284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14206.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14206.exe
      4⤵
      PID:8200
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39545.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39545.exe
    3⤵
    PID:8324
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63475.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63475.exe
    3⤵
    PID:13660
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31459.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31459.exe
    3⤵
    PID:5492
- C:\Users\Admin\AppData\Local\Temp\Unicorn-31479.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-31479.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4532
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35984.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35984.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27827.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27827.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33808.exe
        5⤵
        
        PID:5516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29984.exe
        6⤵
        
        PID:7088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3151.exe
        7⤵
        
        PID:10060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5821.exe
        7⤵
        
        PID:15736
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 15736 -s 444
        8⤵
        Program crash
        
        PID:15112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34748.exe
        7⤵
        
        PID:1292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47626.exe
        6⤵
        
        PID:9008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55008.exe
        7⤵
        
        PID:4700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56271.exe
        7⤵
        
        PID:7968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52974.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:13068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48563.exe
        6⤵
        
        PID:5504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36833.exe
        5⤵
        
        PID:7188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12274.exe
        6⤵
        
        PID:11480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1193.exe
        6⤵
        
        PID:16124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24869.exe
        6⤵
        
        PID:11784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64746.exe
        5⤵
        
        PID:9368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62945.exe
        5⤵
        
        PID:13668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24692.exe
        5⤵
        
        PID:6992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31129.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31129.exe
      4⤵
      PID:5568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61779.exe
        5⤵
        
        PID:7120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5618.exe
        6⤵
        
        PID:9592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24157.exe
        6⤵
        
        PID:11324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43196.exe
        6⤵
        
        PID:16696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34102.exe
        5⤵
        
        PID:8648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6077.exe
        5⤵
        
        PID:13188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48563.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39905.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39905.exe
      4⤵
      PID:6868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56656.exe
        5⤵
        
        PID:9492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8569.exe
        5⤵
        
        PID:12944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43580.exe
        5⤵
        
        PID:17104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61674.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61674.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:10004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60065.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60065.exe
      4⤵
      PID:13168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51738.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51738.exe
      4⤵
      PID:16224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16228.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16228.exe
      4⤵
      PID:3284
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40633.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40633.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18816.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18816.exe
      4⤵
      PID:5600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-850.exe
        5⤵
        
        PID:6612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2930.exe
        6⤵
        
        PID:9124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39897.exe
        6⤵
        
        PID:12384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45806.exe
        6⤵
        
        PID:16992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57228.exe
        6⤵
        
        PID:6756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21097.exe
        5⤵
        
        PID:9104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64494.exe
        5⤵
        
        PID:12272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10425.exe
        5⤵
        
        PID:15484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34530.exe
        5⤵
        
        PID:3304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32230.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32230.exe
      4⤵
      PID:1560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22531.exe
        5⤵
        
        PID:9540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25481.exe
        5⤵
        
        PID:12680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57228.exe
        5⤵
        
        PID:6068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52446.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52446.exe
      4⤵
      PID:8892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20973.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20973.exe
      4⤵
      PID:13848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16228.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16228.exe
      4⤵
      PID:6996
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12301.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12301.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13455.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13455.exe
      4⤵
      PID:7104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56272.exe
        5⤵
        
        PID:9556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23019.exe
        6⤵
        
        PID:10992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25481.exe
        5⤵
        
        PID:12696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57228.exe
        5⤵
        
        PID:6692
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43230.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43230.exe
      4⤵
      PID:10092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55383.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55383.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32027.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32027.exe
      4⤵
      PID:5712
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45770.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45770.exe
    3⤵
    PID:6912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35139.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35139.exe
      4⤵
      PID:11024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35889.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35889.exe
      4⤵
      PID:15780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30735.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30735.exe
      4⤵
      PID:8388
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53009.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53009.exe
    3⤵
    PID:10024
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42953.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42953.exe
    3⤵
    PID:12572
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60234.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60234.exe
    3⤵
    PID:2484
- C:\Users\Admin\AppData\Local\Temp\Unicorn-10333.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-10333.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3096
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7193.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7193.exe
    3⤵
    PID:5424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17763.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17763.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20227.exe
        5⤵
        
        PID:8612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54506.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:13088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60606.exe
        5⤵
        
        PID:3180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57228.exe
        5⤵
        
        PID:17396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55223.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55223.exe
      4⤵
      PID:9028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64494.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64494.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:12208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27530.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27530.exe
      4⤵
      PID:16236
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 16236 -s 436
        5⤵
        Program crash
        
        PID:3564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57795.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57795.exe
      4⤵
      PID:7460
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61809.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61809.exe
    3⤵
    PID:7152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34947.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34947.exe
      4⤵
      PID:11120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5821.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5821.exe
      4⤵
      PID:15160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43196.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43196.exe
      4⤵
      PID:7336
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40430.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40430.exe
    3⤵
    PID:10072
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15190.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15190.exe
    3⤵
    PID:13596
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60234.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60234.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2508
- C:\Users\Admin\AppData\Local\Temp\Unicorn-4281.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-4281.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4128
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11327.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11327.exe
    3⤵
    PID:5832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36336.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36336.exe
      4⤵
      PID:6088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15712.exe
        5⤵
        
        PID:7860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37686.exe
        5⤵
        
        PID:11392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4560.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:15500
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 15500 -s 436
        6⤵
        Program crash
        
        PID:5076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43196.exe
        5⤵
        
        PID:16740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35450.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35450.exe
      4⤵
      PID:10924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49505.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49505.exe
      4⤵
      PID:15008
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27705.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27705.exe
    3⤵
    PID:6100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54163.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54163.exe
      4⤵
      PID:9352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6281.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6281.exe
      4⤵
      PID:15428
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19305.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19305.exe
    3⤵
    PID:10720
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49505.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49505.exe
    3⤵
    PID:14868
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28206.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28206.exe
    3⤵
    PID:18072
- C:\Users\Admin\AppData\Local\Temp\Unicorn-20031.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-20031.exe
  2⤵
  PID:6092
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33267.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33267.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:7720
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15849.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15849.exe
    3⤵
    PID:10956
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52305.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52305.exe
    3⤵
    PID:15020
- C:\Users\Admin\AppData\Local\Temp\Unicorn-55525.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-55525.exe
  2⤵
  PID:7708
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6130.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6130.exe
    3⤵
    PID:12088
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44250.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44250.exe
    3⤵
    PID:16416
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 16416 -s 464
      4⤵
      Program crash
      PID:17372
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37331.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37331.exe
    3⤵
    PID:16840
- C:\Users\Admin\AppData\Local\Temp\Unicorn-33121.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-33121.exe
  2⤵
  PID:11160
- C:\Users\Admin\AppData\Local\Temp\Unicorn-28713.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-28713.exe
  2⤵
  PID:15204
- C:\Users\Admin\AppData\Local\Temp\Unicorn-57392.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-57392.exe
  2⤵
  PID:17848

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=3908,i,8231329449558834090,4540802069600791165,262144 --variations-seed-version --mojo-platform-channel-handle=1048 /prefetch:8
1⤵
PID:4992

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 6808 -ip 6808
1⤵
PID:7048

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 6816 -ip 6816
1⤵
PID:7068

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 6208 -ip 6208
1⤵
PID:6632

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 6216 -ip 6216
1⤵
PID:3688

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 16220 -ip 16220
1⤵
PID:14936

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 15112 -ip 15112
1⤵
PID:16848

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 3788 -ip 3788
1⤵
PID:17336

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 15172 -ip 15172
1⤵
PID:17008

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 15232 -ip 15232
1⤵
PID:3796

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 16328 -ip 16328
1⤵
PID:17132

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 1940 -ip 1940
1⤵
PID:17312

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 16416 -ip 16416
1⤵
PID:17328

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 15732 -ip 15732
1⤵
PID:15348

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 15500 -ip 15500
1⤵
PID:1952

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 16236 -ip 16236
1⤵
PID:2104

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 15676 -ip 15676
1⤵
PID:3464

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 16856 -ip 16856
1⤵
PID:3180

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 16620 -ip 16620
1⤵
PID:8336

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 15532 -ip 15532
1⤵
PID:5336

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 16712 -ip 16712
1⤵
PID:17404

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 16612 -ip 16612
1⤵
PID:16224

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 15660 -ip 15660
1⤵
PID:16672

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 16728 -ip 16728
1⤵
PID:5224

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 15868 -ip 15868
1⤵
PID:16444

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 680 -p 15604 -ip 15604
1⤵
PID:5320

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 16720 -ip 16720
1⤵
PID:5328

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 2544 -ip 2544
1⤵
PID:5392

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1976 -ip 1976
1⤵
PID:5448

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 16804 -ip 16804
1⤵
PID:5536

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 15648 -ip 15648
1⤵
PID:5584

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 668 -p 12132 -ip 12132
1⤵
PID:5668

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 684 -p 16876 -ip 16876
1⤵
PID:5680

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 16884 -ip 16884
1⤵
PID:5488

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
PID:8972

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Unicorn-10333.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-10333.exe
Size 184KB
SHA256 f838cbadab5ebce0b9e5fd26bb528e2ae110ab52f0b7abc5ca69ceee636d1ee1
MD5 d26fa7a011c7ec2bcb328e6dbaa33b29
SHA1 7cb2374d05946bc7d6745eac9e67bbc30a408b67
SHA512 0aa1b873b403edb951bcdf4f60b45e07b80e4e2f67d54f647f2d08c73eeda2bdc01c8b66c791768695d91cf4349ff246f84e01644231e8ef9280aef420115922
SSDEEP 3072:R/+aqcoEk55NdymaZHSTJS09lvnqnveuR:R/Vo1bymfTQ09lPqnveu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-1183.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-1183.exe
Size 184KB
SHA256 a0167120822d3ee459d397c8832782ed576b3aab114ef423790cdc9af26a0cab
MD5 c4b29709ad82b613ea2c1d1c90fee5ca
SHA1 8863bf8c5117b4b9745088b0e64ca2c262532133
SHA512 95e8f926519bdf3e7a993b81b3c8be3cd75e68faacaba2c634b218e5c93e0d60ce0579aef89d5487a64d03d595853c84cc1a34385461cb5c3eb2f7470c7dac12
SSDEEP 3072:R/+aqCoEk55NdyPaZHSTJS09lvnqnveuw:R/Lo1byPfTQ09lPqnveu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-13238.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-13238.exe
Size 184KB
SHA256 abc62d2849289414e24bf832c888fae0015b96ad6664492e398b20d181f208a8
MD5 1afe6670a952cdd377375844e29a2182
SHA1 4ee407056b0308c8b9bf7d7d7a59b717e2f146f5
SHA512 d77711be11f5c09240c2184c46e4f41ad9428ec17f9e4e58c3a3d5bc8c56ce0204de48fd183887c8b2a3ef992700a8b9a64ee26bc1e5c7b71a84180342a83113
SSDEEP 3072:R/+aqCoEk55NdyPaZHSTiS09lvnqnveuR:R/Lo1byPfTR09lPqnveu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-13778.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-13778.exe
Size 184KB
SHA256 2d2b662ddfe107eeec989b2c013fb7ee7a258ac5677f89b4e919185fb5d1ff40
MD5 6cf9cb0e35fb9e732958547866f671aa
SHA1 9ca5f37b1bc8bb5ae0612559367f52c7c9218260
SHA512 c10840ab7bb9fd56554f7884560b7e253583b665d8330f3b7bbf1889853e6e05a726564eab57337c86a8089f4fb894f06979179c76ae0425479a256c1ac652e2
SSDEEP 3072:R/+arCoEk55NdyPaZHSTJS0PlvnqnveuR:R/mo1byPfTQ0PlPqnveu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-15599.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-15599.exe
Size 184KB
SHA256 fe95b261f1e907900f836d30b3bbc936d323dbae6b59a9780dc8d9d01214d7e9
MD5 e258fc58ac252903b387b628224d26ef
SHA1 e36e313bdd3239f28a4cdbb3899deff484667197
SHA512 12c4d68a4e760ca5c629948ee5fab74e9989972aed13bf7f3a765d4a8537234f6bf37d586237f9e01d458338769381dd972c5fa26e00c819ce6b93a0a7807cf3
SSDEEP 3072:R/+aqRoEk55NdymaZHSTJS0zlvnqnveuR:R/so1bymfTQ0zlPqnveu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-15698.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-15698.exe
Size 184KB
SHA256 ae5b4c9a3196701fa4f5cfb93bbe197cd7f9507cf9e8359ad1ea14524b86e3f3
MD5 83e12dd4ffcacc424500cd9d6248b8bb
SHA1 0d98a46147760c5f891d9bbbcb71ac4b361a7516
SHA512 7bd06e9fb7af8919cef61b2e3d5d2929b69e688b6fde36bd75600d4af88759b8aaa111aac02b3f423ca2730649993c3783f8274077daff9d76056de32fb8e161
SSDEEP 3072:H/+aqCoER55NdymaZHSTJS0JlvnqnveuR:H/LowbymfTQ0JlPqnveu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-16502.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-16502.exe
Size 184KB
SHA256 c475858d1ad9bbea0d38540ababb62acf7981f9cd50bba29e8fb2bb4c9605070
MD5 71ca0287650a87f2d5cf62661bffdf08
SHA1 230073c6fb8076fb70f87fbe2d1fc677fbfa6617
SHA512 d8e163edf95af29b7666991eb0e0900e3774df7bb0e665526559f7e09deb701c897ea4ef01a1b896434abc43ece69da4e772d2dd0f1113c5638d1af074bac22c
SSDEEP 3072:R/+aqCoEk55NdymaZHSTJS0flvnqnveuR:R/Lo1bymfTQ0flPqnveu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-19456.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-19456.exe
Size 184KB
SHA256 c711480081cb2137d46753e4bc60e267026a0a598bea5e630f11e9e1a846f974
MD5 67465a628e65f7db54e1edb533b36c4f
SHA1 5031f199f76262dcb03fec63e245ca5297cd01c8
SHA512 9f5bfa33fdc4444d4cb6b4a1f391be83ee692483e5de40e0f21bdb707b7a8101a7448da7cb733b1e88525154268705a989ff3276a085a4ca748fa4f967e5f7ce
SSDEEP 3072:R/WaqCoEkn5NdymaZHSTJS0hlvnqnveuR:R/TorbymfTQ0hlPqnveu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-19648.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-19648.exe
Size 184KB
SHA256 c5b0001976ef6e6089d8f0ab591f4cfa224f436771a0a3415be56562b18f76bb
MD5 7cdea1a1bba56ad3fb2a79eb9105ac81
SHA1 37bb194a65e4eb559781a0c9d143b0ab2489b99c
SHA512 82627eb1fde0296f7c648eb5745be107acd9a50a4db80158237b3130b8098a81528782de5e07bfd9d9239a2dcad3a10527ad19cc4fc94fe354134b3cdf0919c7
SSDEEP 3072:R/+aqCoEk5ANdymaZHSTJSc0lvnqnveuR:R/LoEbymfTQc0lPqnveu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-20032.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-20032.exe
Size 184KB
SHA256 587eaab9a0eb711242bbc58d5457e81ee2aa0bac23ea67346be724e9344c1a0c
MD5 6fc2ae6c17a369907e6d8907150fd7ba
SHA1 aee1c6204b3a3cc113bc151be99d6ba0adedc254
SHA512 b8701992b2282bb1728e325d515fad4c15c6b9c014c8925cb10f1c167444084b30676fa2a8c7bee4710438f91f49f9411e64b8d6444f6bfd3338e4b017a95190
SSDEEP 3072:R/+aqRoEk5tNdymaZHSTJS0zlvnqnveuR:R/soBbymfTQ0zlPqnveu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-27254.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-27254.exe
Size 184KB
SHA256 8e1188f91009e07c8743de9530bef23e1f736cc09f5eb2ddb0a1b710a08f9ff9
MD5 3148dc925150ca2474505d7222f00e4f
SHA1 69b5ec4a861c2c0d52b914fd9b27dcc2b5a3211e
SHA512 e9cd564e9c5a351fc7f5166f96d2708ac69edbf070a7441ad3b00e36d65bc6dd9b6305ff3f3625037907a3f034d4cefa7ee7778031b975c840ced7ae858736ea
SSDEEP 3072:R/+aqCoEk55NdyPaZHSTJS0PlvnqnveuR:R/Lo1byPfTQ0PlPqnveu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-29155.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-29155.exe
Size 184KB
SHA256 ac5fc0496d248f18319697f4f90ec2493c9e1fa7aa4c175bf3662243e0e8560e
MD5 23e0be87cd531da13de9c824c1c6e86d
SHA1 6fb9061ee52b4b0fe51b20a8734ff246200c54ef
SHA512 8b0941329d867949e3079dd87a7ed8c42f68ad9e50a5569b6043f3fa0c176d18401ffef4db34698339fbee610feab05f53c511c64eab97d8007e73dfc36065f4
SSDEEP 3072:R/+aqCoEk55NdyPaZUSTJSJ9lvnqnveuR:R/Lo1byP2TQJ9lPqnveu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-29257.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-29257.exe
Size 184KB
SHA256 da7dd7d6391120411547df49a7017cb8180606a7fde089a3cb6aa20754918131
MD5 9f4ce2abde79f6459c4b7827d9c4d05f
SHA1 521d60654d35203b0424c628ef95da5e652bfa85
SHA512 3568a383243c282049646f5282feefe696335faf689d5f221696919f646e1ed23658d3df1d4a4a356be39b8c448453a1f1a39aa45af8efeae4c150dd4115212e
SSDEEP 3072:R/+aqCoEk55NdymaZHSTJS0elvnqnveuR:R/Lo1bymfTQ0elPqnveu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-30224.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-30224.exe
Size 184KB
SHA256 583603aff41b4c59394a1756c29025f40206c68931fa39b8aa70cdb1fe2ccbf7
MD5 2c9a1a97aaf98da0f92247263406c676
SHA1 798b8a98da28429785833933a10d34447acbc15a
SHA512 684093ee31b9833f38cb93afae4adc0f3ee4c8503c4f5d185823467232adf805116aef947a424eaee9d08036945814d44b3845d6c049f592e7ff58830a21adfd
SSDEEP 3072:R/+arCoEk55NdyPaZH0TJS0PlvnqnveuR:R/mo1byP1TQ0PlPqnveu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-31479.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-31479.exe
Size 184KB
SHA256 565ace1037da2290955bf64d0320154ebc0b0490ed1bb617c289cd1b676bfe5a
MD5 2d13e971eba94176f2f0b465e1567d15
SHA1 fcdcfe89e011e5934df50eab9cc7991f37efd912
SHA512 040cd7d37da947012768cc528ee98752ff1567f60da2fa828ab4d761c34f1ffb9347dacda2043168b4885073ad0428e19eadb29b5cbe8783465aa2f0baca90be
SSDEEP 3072:R/+aqCoEk55NdymaZHSTJS00lvnqnveuR:R/Lo1bymfTQ00lPqnveu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-33664.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-33664.exe
Size 184KB
SHA256 f142e8b47c5616c5452246a87b93e43bdd4f1e18c09092ab87b7b77d7b2b680a
MD5 84f2f78c893055e4e272f45d09cf2226
SHA1 bd8df62ce932231a523ff4d223e686a6b7bc4db0
SHA512 e1ab26e0bab604ef23afeae74cf78e57ccbead2b7dc2496af27572196088a991e10c1137155e3e9fbf1c3447858363ebd79d7a5650ca634e93d880caa3946573
SSDEEP 3072:R/+aqCoEk55NdymaZHSTJSchlvnqnveuR:R/Lo1bymfTQchlPqnveu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-34064.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-34064.exe
Size 184KB
SHA256 1e2c3e8a8c08277de59635cf95d004f22f6d31b58897c814d064421fa229c14d
MD5 2a7d585e4b3174b15caa7855f560d535
SHA1 1e905bf06e85e43079ee082d487d42a760dca458
SHA512 c4ac00672c123ddd0724ab9dd6c8c6ad183ceef641c9d26327b8737d2660429f31ae020c203f3866a1af28c5916d03de1c96ab950ece77ef1361c910cce48e81
SSDEEP 3072:R/+aqCoEk55NdymaZHSTJSMelv+qnveuR:R/Lo1bymfTQMelmqnveu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-35984.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-35984.exe
Size 184KB
SHA256 6366af0def703c3eab5267aa04258d28b545b628d86ca83eada8132471ef06bf
MD5 0ff033d09a8a9a9c6483576b175fac95
SHA1 30d984ea93cf5fbcd8bc77964e9fa4eda02893b2
SHA512 c2948eb42fb59ff9a6036ad7a51e8726d746d13a4ef7e73f7e66e66e456b6ae96451271f9c62250082dd4f13a4cb9906093b39b2c15aab6086696b68a1039c77
SSDEEP 3072:R/+aqCoEk55NdymaZHSTJS02lvnqnveuR:R/Lo1bymfTQ02lPqnveu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-36103.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-36103.exe
Size 184KB
SHA256 a130f98130a0625424d9a47bfe749fa5fc40257f06c89f6cd2b0ff9238b09958
MD5 e3aeb088fa16a37bb932648f0da662cd
SHA1 883f1352e71dd18e18deca72e2235138aa8db24b
SHA512 4529092d494ef2caf281ac32c8922db5e3a6bb784d1c71d852bebac0c087f0d9d24556e9faf18df7d404b52f2650717f422bc160a20c453235e7319b9e854247
SSDEEP 3072:R/+aqCoEk55NdymaZHSTJS0TlvnqnveuR:R/Lo1bymfTQ0TlPqnveu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-3695.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-3695.exe
Size 184KB
SHA256 c5ee12621b7a0abe3d6be8641e1550c5cf90a6fa2818502b9a7b1a019a226501
MD5 f0d8f267372a14145ee7d918d8b48d68
SHA1 bf2c529b550f0b32e30899af411849fb7013bed5
SHA512 e3105dc576254e1c3e5b8cd659f315ec711a5e1aff9eb0bf914b5cb123ac2ed4b26938bd449e571680cc83b1d2e1a08b8712b9bc66c1e4314bd2f4cc8ee8e797
SSDEEP 3072:R/+aqCoEk55NdymaZHSTJS0Jlvnqnveuy:R/Lo1bymfTQ0JlPqnveu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-40129.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-40129.exe
Size 184KB
SHA256 a077d6a5f20eddf83bca82cc2ef133b0cd2471160e597368536197c3e73bfbfe
MD5 66feada12f432d16bee9ec9cc7ae5f03
SHA1 95f75011f31f52d62ed7ba42aa830b9c2c503226
SHA512 403c167a923777ead669f7dc46b547bd206c0b68ef160be430ffdacd178c309fc8cb780bafd06e025ee8da0e0409cb6faf587d27229ba929351eb91eae81213e
SSDEEP 3072:R/+aqCoEk55NdyPaZHSTJSJ9lvnqnveuR:R/Lo1byPfTQJ9lPqnveu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-42526.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-42526.exe
Size 184KB
SHA256 ad851b01565da09897913422786dbf14bbaf51b9f69ff4a33497cac6c24e1117
MD5 e2c32b0b770d0370938753030bc2c9df
SHA1 4dbd2d8f23e52a579d41bc55996dd8ea1d505ca8
SHA512 597e2a6665a52c3b3db8710800ffc5f3229aed806c6e65a057b0323273c14a88bb9a3e3950e2451d1e82cd2bc02ae1ae7887141067812eab0c18ed6b4a2b93eb
SSDEEP 3072:R/+aqCoEk55NdymaZHSTJS0JlvnqnveuR:R/Lo1bymfTQ0JlPqnveu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-42838.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-42838.exe
Size 184KB
SHA256 264d04a323b3c373ae8d8173fac9d244b1f0a0aefac7f1845c08dabb6f0dda5c
MD5 7e0773b421c6b9ab9750457af01e9e8e
SHA1 522e900a58f4c8f762fb14feacb1825ed6ce92a3
SHA512 f449d870b138e5db0826ed394802b60d21fc81c59e47b4034ee9a8dd4b9bd67aa01b572e24f8eaef5cf274722870a4ea5493c03468c46917ff535437203d2cda
SSDEEP 3072:RJ+aqCoEk55NdyPaZHSTJS0PlvnqnveuR:RJLo1byPfTQ0PlPqnveu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-42993.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-42993.exe
Size 184KB
SHA256 aabd57519f64738a09859867efca7283981af7b4e1e80f2811ea62be339687e7
MD5 77ad94fd30c416d0a4d4be46225a64d7
SHA1 c47fd88ec8b67ee21585b796aa0a71b7bba789cc
SHA512 25ef1b9cd0a6af3898771f4bd5b68f79130bd841a0a3af1373696305b591fed410fb95114e27eeaf04477e5f445e0d3984861b46a77172f53d4a9cc82999c4e0
SSDEEP 3072:R/+aqCoEk55NdymaZHSTJS0zlvnqnveuR:R/Lo1bymfTQ0zlPqnveu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-43943.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-43943.exe
Size 184KB
SHA256 2de4d96d22a86f09f6ef5e8b19f7c777d70eff00874f844798f89fa23ef31b79
MD5 2261beca2c5c529610927d68eb1bb272
SHA1 bc07d9346418501e6bf619cdfc51d277680988d3
SHA512 e29b647db23165029b83bae1a3af2b033fd898f65efec5b329c914718ce9e7921d87197c21f2182e9951359b6c6e005d2cc28ada6ba37ff53c80485be3f18a8d
SSDEEP 3072:08+aqCoEk55NdymaZwSTJS0elvnqnveuR:08Lo1bymaTQ0elPqnveu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-44935.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-44935.exe
Size 184KB
SHA256 63105172826fed2cc377680d3fd46492c6b351f8db6c3f93a2393c99a3f20bab
MD5 9d8c71391c5238b21a1cef1c8f6a2931
SHA1 5785c0c6408d603b238e8f1e3d21ff8ab78de268
SHA512 c68baa06d3c5e7a86d44f6a5c6c7b9c6ba61b4630c6d84e3651f4968ca30ead2ea691114bd0255098fcbfc35d84ce3156d2cc9aa7aa99901c58153e242dc2598
SSDEEP 3072:R/WaqCoEk55NdymaZHSTJS0hlvnqnveuR:R/To1bymfTQ0hlPqnveu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-47626.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-47626.exe
Size 184KB
SHA256 c8f2f4917a22f25e8d9280bb4d0f7f3547111a7d254b85e39bc7d1f18c9e4186
MD5 08b7e166b71ee2624ebbfc616d0551bf
SHA1 9777458596309170d01eb4a342c977f2abd5fe22
SHA512 3cac4f0c981268c8074b17e0bc1c2ffcd603e6c0119c3408374a76e65ea44623dcd265ba12b2cb3dfecca6591bf14a3958aedf37a6ac97a0ba9a616dcd183166
SSDEEP 3072:R/+aGCoEk55NdymaZ5STJSK2lvnqnveuR:R/Po1bym9TQK2lPqnveu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-48656.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-48656.exe
Size 184KB
SHA256 903f76a865cc46215af4934969fff7c49feeecb4cf96f04a241385c4bdab6f65
MD5 8a0b948133e25077fe2250d8c5f5c59e
SHA1 749c3094ec254da6b729caa90305a58ba921eb9d
SHA512 73a3c7d3d88cda50c3de3a4b66dc058d7c5c6c5f0e1c5ef808d6467292528be3a630a2283e5b6268009503472ae044dae08b525e122f56fd71d00ae3cfc72f53
SSDEEP 3072:R/+aqCoEk55NdymaZHSTJSc0lvnqnveuR:R/Lo1bymfTQc0lPqnveu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-58938.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-58938.exe
Size 184KB
SHA256 92d5eb0fbdfd95a740f9e95cc10ede4120b93356868dc64a036037f299983fa9
MD5 e9d202b1f82bc8c9044c347976af515e
SHA1 fb1c2d53c59d2f718e9d8743edbb57e76c3a59f3
SHA512 1094d77814d6bb1841c784e8f92bee4753d8148881f091c9ab645c30ef06f9c7ebcad4ea727993473d8b7b18a03535637c7f34e9663c3b955468f23bdc8b39c4
SSDEEP 3072:R/+aqCoEk55NdyPaZHSTJS09lvnqnveuR:R/Lo1byPfTQ09lPqnveu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-61875.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-61875.exe
Size 184KB
SHA256 483c82064a3896f1b43b26cd91741a3a6ad19649ff0d2cacfa64ce056fddd336
MD5 c060ac7d99ff5725deb1fc477dc30e40
SHA1 861892a656b58b30890fda86362535d3fe506952
SHA512 d0193a2ae2e44d1016016b225227439f585506c801c1b931ac3e68e6a242b5db777e1125764c510147fa85d19ece7c0827e9b6368113dc26c9b85dbbd59d379b
SSDEEP 3072:R/+aqCoEk55NdymaZHSTJS0QlvnqnveuR:R/Lo1bymfTQ0QlPqnveu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-62138.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-62138.exe
Size 184KB
SHA256 7f44d39e5266d904d6cbbe97a1959fad176d2a3da8d2611602e938f528cdccba
MD5 97419b54cd158668b13ded27713e56de
SHA1 c7c3b341e28b35480d1391e19782593bd029fee8
SHA512 cefad78ec44d536b2fa06dfc8d569deef94161a4ddcdc8a70ef2c60e6858e77c71b9fe5f72b859c0f1e5ff39af4a6c669a10fcf7cd46f4299db91a6726691a1e
SSDEEP 3072:R/+aqCoEk55NdymaZwSTJS0elvnqnveuR:R/Lo1bymaTQ0elPqnveu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-62334.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-62334.exe
Size 184KB
SHA256 33d3c7a1f89a6dfb73cf2d589bbb746ee8eb7e4b80325f6f69f35969ea260039
MD5 e8dfeee33c45a0871e5ab880c97f43d6
SHA1 db582434cc4bf050e37ecffffc66f88ce4cc35ae
SHA512 69648b495daa240b06856948532ebc1529f1e44fb49cb3c0e1a1f352cf8fcdd33ea74f3044a5e5023db6da4154c20668a3a12e485613065059b388f0b697591e
SSDEEP 3072:R/+aqCoEk55NdymaZHSTJS0KlvnqnveuR:R/Lo1bymfTQ0KlPqnveu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-63344.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-63344.exe
Size 184KB
SHA256 03fd41ac09198f3c838fdf55dd701e3e9bf79174f05d5048efe9e60483921b68
MD5 05c055fd329c44813b66f3fe0f38be0e
SHA1 860db5b5f3da580a39381cb5ac0d38c3539a76b5
SHA512 0dd36ec39221c1143609390f0fe5d105770b0d742464a48ea28c616311bf7198136c8f608189ad2cbe53a68df7a0576ca192282de4b293285a79dde30e60db72
SSDEEP 3072:R/+aqCoEk55NdymaZHSTJS0hlvnqnveuR:R/Lo1bymfTQ0hlPqnveu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-64830.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-64830.exe
Size 184KB
SHA256 c5c12f1e7b9d19cfe6d9492a5c056bb41438b6788fa496123b71deade795b094
MD5 18f5db3000ed7b9aa9e046ac0e593dc0
SHA1 1c234a306ca2bd2a7230ec65861445cb245a32d1
SHA512 5539f5060d4a20013ed321bbf1bee624d133a1c4a3ef4bbc72b3b1a320dd979b33e0ce390403f6130029ac63ab799769f4fc036b0a9fd8544dae214f57e23532
SSDEEP 3072:j7+arCoEk55NdyPaZHSTJS0PlvnqnveuR:j7mo1byPfTQ0PlPqnveu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-65127.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-65127.exe
Size 184KB
SHA256 49c9c9e7773b4194dcfc0df6dc40587d7c8c50b919ef57ad328d65914534bcbe
MD5 f5e9183c07e94300e74cd56d1b5ec672
SHA1 f77abcbf3a08b4dd311bf0e195a9cfc3039dfc09
SHA512 42c13585696b5391b87cff400fd0a3c933d105cbe590c427c8ae57a4cdc1318f3b99a1211e0687373f81ab83540b5eca7d25d2d227e0bde098dc5e0bff6cccb3
SSDEEP 3072:R/+aqCoEk55NdymaZHKTJSchlvnqnveuR:R/Lo1bymHTQchlPqnveu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-65184.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-65184.exe
Size 184KB
SHA256 b4d0a4efd247f0cd214f2fbc6cf5edd750cd3cbd3dc73540497e9a8e69b377b0
MD5 bb5fce5b9f282fdd42545527de247cb6
SHA1 00f02c08157c039826b203dad29fa7077ef167ec
SHA512 c8783008e2d97c44ab5258310e5b70ea8526d6cef02489477ab7a9c176291cc7557658aead929c68f90f6db5651a8bfa1bb53502d67bb934c383342fe0e41fba
SSDEEP 3072:R/+aqCoEk55NdymaZHSTJS0elv+qnveuR:R/Lo1bymfTQ0elmqnveu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-850.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-850.exe
Size 184KB
SHA256 2642b5bc6c61be4afdb31d20bf4acb792bb73683412f656e5f8031dc0a9efc50
MD5 10031984b206de2c6ebd0e71f86b0cd1
SHA1 7c64c2889cebeb4465105c5c3183fb223ac4442f
SHA512 b49e8c8f473b17b47b574b3369b936d90a6dc6c07c6a79b493e9543b6fad65911ef8df8accf9f4d8ff67fe05784451d2f035a07701888524e5f6bf6e839a36ab
SSDEEP 3072:R/+aqCoEka5NdymaZHSTJO00lvnqnveuR:R/LoqbymfTM00lPqnveu
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/404-321-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/548-30-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/548-27-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/744-364-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/780-322-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/820-43-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/1008-81-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/1016-281-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/1036-296-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/1172-173-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/1208-54-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/1396-533-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/1556-175-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/1752-212-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/2000-213-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/2044-252-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/2140-282-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/2208-317-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/2268-262-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/2364-0-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/2364-469-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/2380-103-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/2496-253-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/2516-76-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/2728-6-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/2728-478-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/2772-180-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/2784-318-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/2808-263-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/2896-363-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/2952-35-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/2960-21-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/3020-117-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/3032-245-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/3096-181-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/3204-369-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/3236-272-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/3476-148-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/3732-271-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/3856-536-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/3864-215-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/3884-232-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/3996-44-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/4000-214-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/4020-2979-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/4032-227-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/4052-62-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/4128-293-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/4136-237-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/4176-297-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/4192-159-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/4236-365-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/4308-518-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/4308-13-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/4368-174-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/4380-379-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/4416-371-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/4476-125-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/4532-93-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/4552-367-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/4628-149-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/4648-360-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/4804-374-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/4852-90-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/4856-521-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/4888-242-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/4952-135-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/4984-298-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/5008-109-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/5116-75-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/5152-378-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/5172-382-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/5212-388-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/5244-389-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/5264-391-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/5340-406-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/5352-407-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/5424-413-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/5496-424-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/5516-440-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/5544-437-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/5568-441-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/5600-443-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/5644-442-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/5696-451-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/5764-461-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/5816-468-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/5832-474-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/5848-475-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/5880-479-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/5900-480-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/5936-481-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/5992-495-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/6040-503-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/6052-504-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/6092-519-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/6120-520-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/16220-2913-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/16976-2943-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/17052-2958-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/17280-2959-0x0000000000400000-0x000000000042E000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads