f6c6e0e5a052ef974914ba142a65cc2c81da548708718b9c1706b0bd80a6b8a6

Analysis

max time kernel
148s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
04/09/2024, 11:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

f6c6e0e5a052ef974914ba142a65cc2c81da548708718b9c1706b0bd80a6b8a6.exe
Size

468KB
MD5

9da6d12e66cd1a2fb720e3228522a227
SHA1

6e03e17b7d3d7b2aacd654a11bb90a1c4c513bc7
SHA256

f6c6e0e5a052ef974914ba142a65cc2c81da548708718b9c1706b0bd80a6b8a6
SHA512

b41867606c012bc27a6b968c7261ce9581ea08290bd867a9747f2fe38ff851ded99b81404bc0f225522e803ed0bc8c4571fb032be93d676d2ed3933e1170e378
SSDEEP

3072:1G3HogISIE5TtbY2HzcOcf8/zCcaP0pkJVHeTVPyQ65Lq7ggkflL:1G3obMTtxH4OcfVY10Q6VIggk

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2108	Unicorn-34256.exe
2060	Unicorn-51827.exe
2924	Unicorn-27877.exe
2852	Unicorn-40582.exe
2896	Unicorn-28330.exe
2724	Unicorn-12548.exe
2648	Unicorn-18115.exe
3064	Unicorn-58153.exe
1700	Unicorn-39631.exe
2420	Unicorn-26633.exe
1092	Unicorn-63067.exe
2000	Unicorn-15157.exe
1516	Unicorn-29840.exe
2012	Unicorn-21022.exe
332	Unicorn-54199.exe
900	Unicorn-17997.exe
3012	Unicorn-47375.exe
2304	Unicorn-53113.exe
2460	Unicorn-18211.exe
2828	Unicorn-63327.exe
1664	Unicorn-54397.exe
604	Unicorn-40669.exe
1320	Unicorn-46799.exe
308	Unicorn-34547.exe
1048	Unicorn-10597.exe
768	Unicorn-23374.exe
1028	Unicorn-19555.exe
1552	Unicorn-44806.exe
1640	Unicorn-61054.exe
352	Unicorn-48610.exe
2100	Unicorn-28744.exe
1604	Unicorn-26143.exe
2400	Unicorn-15746.exe
2864	Unicorn-45081.exe
2856	Unicorn-35974.exe
2732	Unicorn-15096.exe
2632	Unicorn-56394.exe
2608	Unicorn-20000.exe
2744	Unicorn-31698.exe
2616	Unicorn-50125.exe
1912	Unicorn-56477.exe
1388	Unicorn-28003.exe
2364	Unicorn-17068.exe
1788	Unicorn-55516.exe
2804	Unicorn-63476.exe
1896	Unicorn-56285.exe
2812	Unicorn-49741.exe
1580	Unicorn-23421.exe
2960	Unicorn-14987.exe
2368	Unicorn-40311.exe
3020	Unicorn-60177.exe
1072	Unicorn-29542.exe
1612	Unicorn-33509.exe
1532	Unicorn-46316.exe
1764	Unicorn-21065.exe
896	Unicorn-8812.exe
1852	Unicorn-41485.exe
676	Unicorn-44043.exe
3060	Unicorn-24442.exe
652	Unicorn-13673.exe
1840	Unicorn-65475.exe
2016	Unicorn-33364.exe
2324	Unicorn-45616.exe
2868	Unicorn-45616.exe

Loads dropped DLL 64 IoCs

pid	Process
1916	f6c6e0e5a052ef974914ba142a65cc2c81da548708718b9c1706b0bd80a6b8a6.exe
1916	f6c6e0e5a052ef974914ba142a65cc2c81da548708718b9c1706b0bd80a6b8a6.exe
1916	f6c6e0e5a052ef974914ba142a65cc2c81da548708718b9c1706b0bd80a6b8a6.exe
2108	Unicorn-34256.exe
1916	f6c6e0e5a052ef974914ba142a65cc2c81da548708718b9c1706b0bd80a6b8a6.exe
2108	Unicorn-34256.exe
2060	Unicorn-51827.exe
2060	Unicorn-51827.exe
2108	Unicorn-34256.exe
2924	Unicorn-27877.exe
2924	Unicorn-27877.exe
2108	Unicorn-34256.exe
1916	f6c6e0e5a052ef974914ba142a65cc2c81da548708718b9c1706b0bd80a6b8a6.exe
1916	f6c6e0e5a052ef974914ba142a65cc2c81da548708718b9c1706b0bd80a6b8a6.exe
2852	Unicorn-40582.exe
2852	Unicorn-40582.exe
2060	Unicorn-51827.exe
2060	Unicorn-51827.exe
2924	Unicorn-27877.exe
2924	Unicorn-27877.exe
2648	Unicorn-18115.exe
2648	Unicorn-18115.exe
2724	Unicorn-12548.exe
2724	Unicorn-12548.exe
2108	Unicorn-34256.exe
2108	Unicorn-34256.exe
1916	f6c6e0e5a052ef974914ba142a65cc2c81da548708718b9c1706b0bd80a6b8a6.exe
1916	f6c6e0e5a052ef974914ba142a65cc2c81da548708718b9c1706b0bd80a6b8a6.exe
1308	WerFault.exe
1308	WerFault.exe
1308	WerFault.exe
1308	WerFault.exe
1308	WerFault.exe
3064	Unicorn-58153.exe
3064	Unicorn-58153.exe
2852	Unicorn-40582.exe
2852	Unicorn-40582.exe
1700	Unicorn-39631.exe
1700	Unicorn-39631.exe
2060	Unicorn-51827.exe
2060	Unicorn-51827.exe
2012	Unicorn-21022.exe
2012	Unicorn-21022.exe
1916	f6c6e0e5a052ef974914ba142a65cc2c81da548708718b9c1706b0bd80a6b8a6.exe
1092	Unicorn-63067.exe
1916	f6c6e0e5a052ef974914ba142a65cc2c81da548708718b9c1706b0bd80a6b8a6.exe
1092	Unicorn-63067.exe
2924	Unicorn-27877.exe
2924	Unicorn-27877.exe
1516	Unicorn-29840.exe
1516	Unicorn-29840.exe
2000	Unicorn-15157.exe
2000	Unicorn-15157.exe
2724	Unicorn-12548.exe
2724	Unicorn-12548.exe
2108	Unicorn-34256.exe
2108	Unicorn-34256.exe
2420	Unicorn-26633.exe
2420	Unicorn-26633.exe
2648	Unicorn-18115.exe
2648	Unicorn-18115.exe
332	Unicorn-54199.exe
332	Unicorn-54199.exe
900	Unicorn-17997.exe

Program crash 64 IoCs

pid	pid_target	Process	procid_target
1308	2896	WerFault.exe	35
1964	1320	WerFault.exe	53
984	1028	WerFault.exe	57
316	1048	WerFault.exe	55
2652	1664	WerFault.exe	50
1548	1604	WerFault.exe	63
3048	1896	WerFault.exe	80
1496	2368	WerFault.exe	85
1924	1092	WerFault.exe	40
2312	2420	WerFault.exe	41
2900	1516	WerFault.exe	42
2932	2748	WerFault.exe	124
692	1472	WerFault.exe	111
2948	2012	WerFault.exe	44
3080	1544	WerFault.exe	149
3088	2084	WerFault.exe	116
3108	1076	WerFault.exe	112
3492	1764	WerFault.exe	91
3552	2176	WerFault.exe	130
3544	2956	WerFault.exe	110
4092	676	WerFault.exe	95
3204	2796	WerFault.exe	108
3184	768	WerFault.exe	56
3164	3020	WerFault.exe	86
3096	1580	WerFault.exe	83
3368	1532	WerFault.exe	89
3404	2400	WerFault.exe	64
3424	896	WerFault.exe	92
3416	1612	WerFault.exe	88
3764	3060	WerFault.exe	94
3484	2016	WerFault.exe	98
3616	2868	WerFault.exe	100
3620	2824	WerFault.exe	106
3780	2608	WerFault.exe	69
3580	3068	WerFault.exe	105
3896	2744	WerFault.exe	70
3916	3064	WerFault.exe	37
4032	1072	WerFault.exe	87
3972	2856	WerFault.exe	66
3364	2996	WerFault.exe	102
2500	2204	WerFault.exe	104
3456	1120	WerFault.exe	109
4396	2320	WerFault.exe	121
4376	2812	WerFault.exe	82
5080	2304	WerFault.exe	48
4632	2732	WerFault.exe	67
4904	2924	WerFault.exe	32
4696	572	WerFault.exe	135
4980	628	WerFault.exe	134
5068	872	WerFault.exe	113
5044	2772	WerFault.exe	103
4760	1372	WerFault.exe	136
4972	2804	WerFault.exe	81
4060	960	WerFault.exe	157
5180	1552	WerFault.exe	58
5208	1300	WerFault.exe	139
5304	2836	WerFault.exe	159
5600	1268	WerFault.exe	163
5908	1388	WerFault.exe	77
5944	2624	WerFault.exe	143
5936	2188	WerFault.exe	146
5960	2564	WerFault.exe	144
6004	3024	WerFault.exe	114
6028	2364	WerFault.exe	78

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65360.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50112.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15120.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2963.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21897.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20103.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3813.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9082.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52409.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29057.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47389.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52940.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63875.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29840.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20633.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2562.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62608.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33116.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51827.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20633.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1333.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9766.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20842.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22903.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60462.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40519.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25412.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12914.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43715.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7830.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16206.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44043.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61382.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7747.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23089.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27315.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3629.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32594.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60179.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15746.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17068.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21065.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57154.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44419.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31869.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22688.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32513.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51207.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56394.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63106.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17922.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12094.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4536.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15360.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10760.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1138.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1768.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16406.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27474.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64455.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54255.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14457.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35723.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61005.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
1916	f6c6e0e5a052ef974914ba142a65cc2c81da548708718b9c1706b0bd80a6b8a6.exe
2108	Unicorn-34256.exe
2060	Unicorn-51827.exe
2924	Unicorn-27877.exe
2852	Unicorn-40582.exe
2724	Unicorn-12548.exe
2896	Unicorn-28330.exe
2648	Unicorn-18115.exe
3064	Unicorn-58153.exe
1700	Unicorn-39631.exe
2012	Unicorn-21022.exe
2420	Unicorn-26633.exe
2000	Unicorn-15157.exe
1092	Unicorn-63067.exe
1516	Unicorn-29840.exe
332	Unicorn-54199.exe
900	Unicorn-17997.exe
3012	Unicorn-47375.exe
2304	Unicorn-53113.exe
2460	Unicorn-18211.exe
2828	Unicorn-63327.exe
604	Unicorn-40669.exe
1664	Unicorn-54397.exe
1048	Unicorn-10597.exe
1320	Unicorn-46799.exe
768	Unicorn-23374.exe
308	Unicorn-34547.exe
1028	Unicorn-19555.exe
1552	Unicorn-44806.exe
1640	Unicorn-61054.exe
352	Unicorn-48610.exe
2100	Unicorn-28744.exe
1604	Unicorn-26143.exe
2400	Unicorn-15746.exe
2864	Unicorn-45081.exe
2732	Unicorn-15096.exe
2856	Unicorn-35974.exe
2632	Unicorn-56394.exe
2608	Unicorn-20000.exe
2744	Unicorn-31698.exe
2616	Unicorn-50125.exe
1912	Unicorn-56477.exe
1388	Unicorn-28003.exe
2364	Unicorn-17068.exe
1788	Unicorn-55516.exe
2804	Unicorn-63476.exe
1896	Unicorn-56285.exe
2812	Unicorn-49741.exe
1580	Unicorn-23421.exe
2960	Unicorn-14987.exe
3020	Unicorn-60177.exe
1072	Unicorn-29542.exe
2368	Unicorn-40311.exe
1612	Unicorn-33509.exe
1532	Unicorn-46316.exe
1764	Unicorn-21065.exe
896	Unicorn-8812.exe
1852	Unicorn-41485.exe
652	Unicorn-13673.exe
676	Unicorn-44043.exe
1840	Unicorn-65475.exe
3060	Unicorn-24442.exe
2016	Unicorn-33364.exe
2324	Unicorn-45616.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1916 wrote to memory of 2108	1916	f6c6e0e5a052ef974914ba142a65cc2c81da548708718b9c1706b0bd80a6b8a6.exe	30
PID 1916 wrote to memory of 2108	1916	f6c6e0e5a052ef974914ba142a65cc2c81da548708718b9c1706b0bd80a6b8a6.exe	30
PID 1916 wrote to memory of 2108	1916	f6c6e0e5a052ef974914ba142a65cc2c81da548708718b9c1706b0bd80a6b8a6.exe	30
PID 1916 wrote to memory of 2108	1916	f6c6e0e5a052ef974914ba142a65cc2c81da548708718b9c1706b0bd80a6b8a6.exe	30
PID 1916 wrote to memory of 2924	1916	f6c6e0e5a052ef974914ba142a65cc2c81da548708718b9c1706b0bd80a6b8a6.exe	32
PID 1916 wrote to memory of 2924	1916	f6c6e0e5a052ef974914ba142a65cc2c81da548708718b9c1706b0bd80a6b8a6.exe	32
PID 1916 wrote to memory of 2924	1916	f6c6e0e5a052ef974914ba142a65cc2c81da548708718b9c1706b0bd80a6b8a6.exe	32
PID 1916 wrote to memory of 2924	1916	f6c6e0e5a052ef974914ba142a65cc2c81da548708718b9c1706b0bd80a6b8a6.exe	32
PID 2108 wrote to memory of 2060	2108	Unicorn-34256.exe	31
PID 2108 wrote to memory of 2060	2108	Unicorn-34256.exe	31
PID 2108 wrote to memory of 2060	2108	Unicorn-34256.exe	31
PID 2108 wrote to memory of 2060	2108	Unicorn-34256.exe	31
PID 2060 wrote to memory of 2852	2060	Unicorn-51827.exe	33
PID 2060 wrote to memory of 2852	2060	Unicorn-51827.exe	33
PID 2060 wrote to memory of 2852	2060	Unicorn-51827.exe	33
PID 2060 wrote to memory of 2852	2060	Unicorn-51827.exe	33
PID 2924 wrote to memory of 2896	2924	Unicorn-27877.exe	35
PID 2924 wrote to memory of 2896	2924	Unicorn-27877.exe	35
PID 2924 wrote to memory of 2896	2924	Unicorn-27877.exe	35
PID 2924 wrote to memory of 2896	2924	Unicorn-27877.exe	35
PID 2108 wrote to memory of 2724	2108	Unicorn-34256.exe	34
PID 2108 wrote to memory of 2724	2108	Unicorn-34256.exe	34
PID 2108 wrote to memory of 2724	2108	Unicorn-34256.exe	34
PID 2108 wrote to memory of 2724	2108	Unicorn-34256.exe	34
PID 1916 wrote to memory of 2648	1916	f6c6e0e5a052ef974914ba142a65cc2c81da548708718b9c1706b0bd80a6b8a6.exe	36
PID 1916 wrote to memory of 2648	1916	f6c6e0e5a052ef974914ba142a65cc2c81da548708718b9c1706b0bd80a6b8a6.exe	36
PID 1916 wrote to memory of 2648	1916	f6c6e0e5a052ef974914ba142a65cc2c81da548708718b9c1706b0bd80a6b8a6.exe	36
PID 1916 wrote to memory of 2648	1916	f6c6e0e5a052ef974914ba142a65cc2c81da548708718b9c1706b0bd80a6b8a6.exe	36
PID 2852 wrote to memory of 3064	2852	Unicorn-40582.exe	37
PID 2852 wrote to memory of 3064	2852	Unicorn-40582.exe	37
PID 2852 wrote to memory of 3064	2852	Unicorn-40582.exe	37
PID 2852 wrote to memory of 3064	2852	Unicorn-40582.exe	37
PID 2060 wrote to memory of 1700	2060	Unicorn-51827.exe	38
PID 2060 wrote to memory of 1700	2060	Unicorn-51827.exe	38
PID 2060 wrote to memory of 1700	2060	Unicorn-51827.exe	38
PID 2060 wrote to memory of 1700	2060	Unicorn-51827.exe	38
PID 2896 wrote to memory of 1308	2896	Unicorn-28330.exe	39
PID 2896 wrote to memory of 1308	2896	Unicorn-28330.exe	39
PID 2896 wrote to memory of 1308	2896	Unicorn-28330.exe	39
PID 2896 wrote to memory of 1308	2896	Unicorn-28330.exe	39
PID 2924 wrote to memory of 1092	2924	Unicorn-27877.exe	40
PID 2924 wrote to memory of 1092	2924	Unicorn-27877.exe	40
PID 2924 wrote to memory of 1092	2924	Unicorn-27877.exe	40
PID 2924 wrote to memory of 1092	2924	Unicorn-27877.exe	40
PID 2648 wrote to memory of 2420	2648	Unicorn-18115.exe	41
PID 2648 wrote to memory of 2420	2648	Unicorn-18115.exe	41
PID 2648 wrote to memory of 2420	2648	Unicorn-18115.exe	41
PID 2648 wrote to memory of 2420	2648	Unicorn-18115.exe	41
PID 2724 wrote to memory of 1516	2724	Unicorn-12548.exe	42
PID 2724 wrote to memory of 1516	2724	Unicorn-12548.exe	42
PID 2724 wrote to memory of 1516	2724	Unicorn-12548.exe	42
PID 2724 wrote to memory of 1516	2724	Unicorn-12548.exe	42
PID 2108 wrote to memory of 2000	2108	Unicorn-34256.exe	43
PID 2108 wrote to memory of 2000	2108	Unicorn-34256.exe	43
PID 2108 wrote to memory of 2000	2108	Unicorn-34256.exe	43
PID 2108 wrote to memory of 2000	2108	Unicorn-34256.exe	43
PID 1916 wrote to memory of 2012	1916	f6c6e0e5a052ef974914ba142a65cc2c81da548708718b9c1706b0bd80a6b8a6.exe	44
PID 1916 wrote to memory of 2012	1916	f6c6e0e5a052ef974914ba142a65cc2c81da548708718b9c1706b0bd80a6b8a6.exe	44
PID 1916 wrote to memory of 2012	1916	f6c6e0e5a052ef974914ba142a65cc2c81da548708718b9c1706b0bd80a6b8a6.exe	44
PID 1916 wrote to memory of 2012	1916	f6c6e0e5a052ef974914ba142a65cc2c81da548708718b9c1706b0bd80a6b8a6.exe	44
PID 3064 wrote to memory of 332	3064	Unicorn-58153.exe	45
PID 3064 wrote to memory of 332	3064	Unicorn-58153.exe	45
PID 3064 wrote to memory of 332	3064	Unicorn-58153.exe	45
PID 3064 wrote to memory of 332	3064	Unicorn-58153.exe	45

C:\Users\Admin\AppData\Local\Temp\f6c6e0e5a052ef974914ba142a65cc2c81da548708718b9c1706b0bd80a6b8a6.exe
"C:\Users\Admin\AppData\Local\Temp\f6c6e0e5a052ef974914ba142a65cc2c81da548708718b9c1706b0bd80a6b8a6.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1916
- C:\Users\Admin\AppData\Local\Temp\Unicorn-34256.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-34256.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2108
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51827.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51827.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40582.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40582.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58153.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54199.exe
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61054.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33509.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55870.exe
        9⤵
        
        PID:2188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44654.exe
        10⤵
        
        PID:4968
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2188 -s 248
        10⤵
        Program crash
        
        PID:5936
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1612 -s 248
        9⤵
        Program crash
        
        PID:3416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12652.exe
        8⤵
        
        PID:2636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29470.exe
        9⤵
        
        PID:4220
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2636 -s 248
        9⤵
        
        PID:5252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34916.exe
        8⤵
        
        PID:3688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4015.exe
        8⤵
        
        PID:4492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54354.exe
        8⤵
        
        PID:5504
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1640 -s 248
        8⤵
        
        PID:6468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46316.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31174.exe
        8⤵
        
        PID:2700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4965.exe
        9⤵
        
        PID:1560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63071.exe
        9⤵
        
        PID:5196
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2700 -s 244
        9⤵
        
        PID:6520
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1532 -s 236
        8⤵
        Program crash
        
        PID:3368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49823.exe
        7⤵
        
        PID:1544
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1544 -s 244
        8⤵
        Program crash
        
        PID:3080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16622.exe
        7⤵
        
        PID:584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7425.exe
        8⤵
        
        PID:5296
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 584 -s 224
        8⤵
        
        PID:6900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29231.exe
        7⤵
        
        PID:4328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17922.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4116.exe
        7⤵
        
        PID:1740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37204.exe
        7⤵
        
        PID:6828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44949.exe
        7⤵
        
        PID:8140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41739.exe
        7⤵
        
        PID:8940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58207.exe
        7⤵
        
        PID:4204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28744.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8812.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59762.exe
        8⤵
        
        PID:300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22869.exe
        9⤵
        
        PID:4864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15136.exe
        9⤵
        
        PID:5232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63262.exe
        9⤵
        
        PID:6512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13201.exe
        9⤵
        
        PID:6612
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 300 -s 244
        9⤵
        
        PID:6388
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 896 -s 248
        8⤵
        Program crash
        
        PID:3424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51765.exe
        7⤵
        
        PID:2908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36787.exe
        8⤵
        
        PID:4748
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2908 -s 248
        8⤵
        
        PID:5976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9177.exe
        7⤵
        
        PID:3444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44389.exe
        7⤵
        
        PID:5004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61178.exe
        7⤵
        
        PID:5876
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2100 -s 228
        7⤵
        
        PID:6640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13673.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29057.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1268
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1268 -s 240
        8⤵
        Program crash
        
        PID:5600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55546.exe
        7⤵
        
        PID:3976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64455.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4200
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 652 -s 228
        7⤵
        
        PID:6076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2834.exe
        6⤵
        
        PID:2800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47389.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47270.exe
        7⤵
        
        PID:6952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8548.exe
        7⤵
        
        PID:7188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7003.exe
        7⤵
        
        PID:9012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42542.exe
        7⤵
        
        PID:8900
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3064 -s 244
        6⤵
        Program crash
        
        PID:3916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17997.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48610.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41485.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52409.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43388.exe
        9⤵
        
        PID:4232
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 960 -s 236
        9⤵
        Program crash
        
        PID:4060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33625.exe
        8⤵
        
        PID:3596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39951.exe
        8⤵
        
        PID:5088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2884.exe
        8⤵
        
        PID:5872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14629.exe
        8⤵
        
        PID:6700
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1852 -s 236
        8⤵
        
        PID:7992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40519.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29413.exe
        8⤵
        
        PID:5804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51914.exe
        8⤵
        
        PID:6872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57663.exe
        8⤵
        
        PID:7212
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1596 -s 228
        8⤵
        
        PID:7476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47361.exe
        7⤵
        
        PID:3892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29288.exe
        7⤵
        
        PID:1592
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 352 -s 244
        7⤵
        
        PID:5904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65475.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27474.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3813.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4860
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2564 -s 228
        8⤵
        Program crash
        
        PID:5960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60979.exe
        7⤵
        
        PID:3388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38524.exe
        7⤵
        
        PID:4984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4306.exe
        7⤵
        
        PID:5888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19097.exe
        7⤵
        
        PID:6604
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1840 -s 248
        7⤵
        
        PID:8092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-539.exe
        6⤵
        
        PID:1348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32594.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59288.exe
        7⤵
        
        PID:5928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21897.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14413.exe
        7⤵
        
        PID:8180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63875.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26006.exe
        7⤵
        
        PID:4292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15042.exe
        6⤵
        
        PID:3448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35723.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53688.exe
        6⤵
        
        PID:5952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19627.exe
        6⤵
        
        PID:6476
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 900 -s 248
        6⤵
        
        PID:8048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26143.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1604
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1604 -s 240
        6⤵
        Program crash
        
        PID:1548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44043.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13493.exe
        6⤵
        
        PID:776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39288.exe
        7⤵
        
        PID:4152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61021.exe
        7⤵
        
        PID:5612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43885.exe
        7⤵
        
        PID:6820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22688.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5338.exe
        7⤵
        
        PID:7488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32513.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41977.exe
        7⤵
        
        PID:8328
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 676 -s 236
        6⤵
        Program crash
        
        PID:4092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63084.exe
        5⤵
        
        PID:1300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12777.exe
        6⤵
        
        PID:3748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44824.exe
        7⤵
        
        PID:8908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23423.exe
        6⤵
        
        PID:4944
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1300 -s 224
        6⤵
        Program crash
        
        PID:5208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25412.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44757.exe
        6⤵
        
        PID:5596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18168.exe
        5⤵
        
        PID:5092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35003.exe
        5⤵
        
        PID:5364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31002.exe
        5⤵
        
        PID:6704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57424.exe
        5⤵
        
        PID:6528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21004.exe
        5⤵
        
        PID:8080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46514.exe
        5⤵
        
        PID:8508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54312.exe
        5⤵
        
        PID:8264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39631.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39631.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:1700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47375.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15746.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21065.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59762.exe
        8⤵
        
        PID:2572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8610.exe
        9⤵
        
        PID:3428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19505.exe
        10⤵
        
        PID:7784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38113.exe
        10⤵
        
        PID:8440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44247.exe
        10⤵
        
        PID:8296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25888.exe
        9⤵
        
        PID:4596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37258.exe
        9⤵
        
        PID:5024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8167.exe
        9⤵
        
        PID:6284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58205.exe
        9⤵
        
        PID:7008
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2572 -s 248
        9⤵
        
        PID:8084
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1764 -s 236
        8⤵
        Program crash
        
        PID:3492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14816.exe
        7⤵
        
        PID:2624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14674.exe
        8⤵
        
        PID:4464
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2624 -s 228
        8⤵
        Program crash
        
        PID:5944
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2400 -s 240
        7⤵
        Program crash
        
        PID:3404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24442.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56493.exe
        7⤵
        
        PID:1736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15541.exe
        8⤵
        
        PID:5536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46403.exe
        8⤵
        
        PID:6740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16822.exe
        8⤵
        
        PID:6216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14003.exe
        8⤵
        
        PID:7472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49049.exe
        8⤵
        
        PID:4532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24911.exe
        8⤵
        
        PID:8384
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3060 -s 228
        7⤵
        Program crash
        
        PID:3764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54255.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35002.exe
        7⤵
        
        PID:5256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49527.exe
        7⤵
        
        PID:6540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7336.exe
        7⤵
        
        PID:6484
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1824 -s 248
        7⤵
        
        PID:7180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53226.exe
        6⤵
        
        PID:3572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37150.exe
        6⤵
        
        PID:5056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43220.exe
        6⤵
        
        PID:5736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15159.exe
        6⤵
        
        PID:6672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50284.exe
        6⤵
        
        PID:8024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29755.exe
        6⤵
        
        PID:8840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20406.exe
        6⤵
        
        PID:8724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45081.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20920.exe
        6⤵
        
        PID:2996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4059.exe
        7⤵
        
        PID:2072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57576.exe
        8⤵
        
        PID:7100
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2072 -s 216
        8⤵
        
        PID:8072
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2996 -s 248
        7⤵
        Program crash
        
        PID:3364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12590.exe
        6⤵
        
        PID:1052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6097.exe
        7⤵
        
        PID:6380
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1052 -s 228
        7⤵
        
        PID:7304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22903.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22271.exe
        6⤵
        
        PID:4892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55672.exe
        6⤵
        
        PID:5924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18514.exe
        6⤵
        
        PID:6932
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2864 -s 224
        6⤵
        
        PID:8132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14405.exe
        5⤵
        
        PID:2824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37225.exe
        6⤵
        
        PID:2992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43388.exe
        7⤵
        
        PID:4504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54104.exe
        7⤵
        
        PID:6272
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2992 -s 244
        7⤵
        
        PID:7028
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2824 -s 228
        6⤵
        Program crash
        
        PID:3620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27339.exe
        5⤵
        
        PID:2468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59143.exe
        6⤵
        
        PID:6968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10871.exe
        6⤵
        
        PID:7272
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2468 -s 224
        6⤵
        
        PID:7428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20103.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62608.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56202.exe
        5⤵
        
        PID:6048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59165.exe
        5⤵
        
        PID:6752
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1700 -s 244
        5⤵
        
        PID:8148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53113.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53113.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35974.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4391.exe
        6⤵
        
        PID:2204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3099.exe
        7⤵
        
        PID:2344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44950.exe
        8⤵
        
        PID:5856
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2344 -s 228
        8⤵
        
        PID:6884
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2204 -s 228
        7⤵
        Program crash
        
        PID:2500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52663.exe
        6⤵
        
        PID:752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58842.exe
        7⤵
        
        PID:5408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15915.exe
        7⤵
        
        PID:7388
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 752 -s 224
        7⤵
        
        PID:7460
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2856 -s 244
        6⤵
        Program crash
        
        PID:3972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41510.exe
        5⤵
        
        PID:1780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23089.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21577.exe
        7⤵
        
        PID:5016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19381.exe
        7⤵
        
        PID:5764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59806.exe
        7⤵
        
        PID:7076
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2592 -s 228
        7⤵
        
        PID:7256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33433.exe
        6⤵
        
        PID:4052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63495.exe
        6⤵
        
        PID:4660
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1780 -s 228
        6⤵
        
        PID:5772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42579.exe
        5⤵
        
        PID:2816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43388.exe
        6⤵
        
        PID:4352
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2816 -s 248
        6⤵
        
        PID:6200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16469.exe
        5⤵
        
        PID:3476
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2304 -s 244
        5⤵
        Program crash
        
        PID:5080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15096.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15096.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45616.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14920.exe
        6⤵
        
        PID:1240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9516.exe
        7⤵
        
        PID:4772
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1240 -s 216
        7⤵
        
        PID:5648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62022.exe
        6⤵
        
        PID:3176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44419.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38982.exe
        6⤵
        
        PID:5728
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2324 -s 240
        6⤵
        
        PID:6584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24759.exe
        5⤵
        
        PID:2620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46081.exe
        6⤵
        
        PID:4164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44737.exe
        6⤵
        
        PID:5900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63205.exe
        6⤵
        
        PID:6340
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2620 -s 248
        6⤵
        
        PID:5412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47361.exe
        5⤵
        
        PID:3908
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2732 -s 228
        5⤵
        Program crash
        
        PID:4632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3629.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3629.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39856.exe
        5⤵
        
        PID:1880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36829.exe
        6⤵
        
        PID:6396
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1880 -s 228
        6⤵
        
        PID:6696
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3068 -s 236
        5⤵
        Program crash
        
        PID:3580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52491.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52491.exe
      4⤵
      PID:1856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64042.exe
        5⤵
        
        PID:6260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7830.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8138.exe
        5⤵
        
        PID:7384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57714.exe
        5⤵
        
        PID:8444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41447.exe
        5⤵
        
        PID:8324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20633.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20633.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58142.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58142.exe
      4⤵
      PID:4920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29336.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29336.exe
      4⤵
      PID:6084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12914.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12914.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21414.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21414.exe
      4⤵
      PID:8188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61340.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61340.exe
      4⤵
      PID:9020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55407.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55407.exe
      4⤵
      PID:9068
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12548.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12548.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29840.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29840.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46799.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1320
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1320 -s 220
        6⤵
        Program crash
        
        PID:1964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17068.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50743.exe
        6⤵
        
        PID:2256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34542.exe
        7⤵
        
        PID:3788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9639.exe
        8⤵
        
        PID:7740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40692.exe
        8⤵
        
        PID:8424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38310.exe
        8⤵
        
        PID:9060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47736.exe
        7⤵
        
        PID:4988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22047.exe
        7⤵
        
        PID:5352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-466.exe
        7⤵
        
        PID:6732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14022.exe
        7⤵
        
        PID:6196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54340.exe
        7⤵
        
        PID:7224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49579.exe
        7⤵
        
        PID:8460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20446.exe
        7⤵
        
        PID:8364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15120.exe
        6⤵
        
        PID:4008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45727.exe
        7⤵
        
        PID:8760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17164.exe
        7⤵
        
        PID:9096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16904.exe
        6⤵
        
        PID:4360
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2364 -s 248
        6⤵
        Program crash
        
        PID:6028
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1516 -s 244
        5⤵
        Program crash
        
        PID:2900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10597.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10597.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1048
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1048 -s 244
        5⤵
        Program crash
        
        PID:316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63476.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63476.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-691.exe
        5⤵
        
        PID:2084
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2084 -s 244
        6⤵
        Program crash
        
        PID:3088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9082.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63819.exe
        6⤵
        
        PID:7116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51964.exe
        6⤵
        
        PID:7972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51849.exe
        6⤵
        
        PID:8480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50112.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48176.exe
        5⤵
        
        PID:4420
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2804 -s 248
        5⤵
        Program crash
        
        PID:4972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5854.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5854.exe
      4⤵
      PID:2244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4399.exe
        5⤵
        
        PID:3592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24596.exe
        5⤵
        
        PID:4116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19437.exe
        5⤵
        
        PID:6132
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2244 -s 228
        5⤵
        
        PID:6624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26055.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26055.exe
      4⤵
      PID:3980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1176.exe
        5⤵
        
        PID:4180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63106.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63106.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5216.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5216.exe
      4⤵
      PID:6040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63634.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63634.exe
      4⤵
      PID:5840
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2724 -s 244
      4⤵
      PID:7348
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15157.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15157.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34547.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34547.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23421.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54635.exe
        6⤵
        
        PID:1900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57383.exe
        7⤵
        
        PID:4064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49760.exe
        7⤵
        
        PID:4588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33116.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5776
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1900 -s 216
        7⤵
        
        PID:6556
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1580 -s 236
        6⤵
        Program crash
        
        PID:3096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14157.exe
        5⤵
        
        PID:2692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33691.exe
        6⤵
        
        PID:3524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5960.exe
        7⤵
        
        PID:8768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6012.exe
        7⤵
        
        PID:8392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3003.exe
        6⤵
        
        PID:4844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28871.exe
        6⤵
        
        PID:5200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3590.exe
        6⤵
        
        PID:6488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4536.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54750.exe
        6⤵
        
        PID:8056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56621.exe
        6⤵
        
        PID:8856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21541.exe
        6⤵
        
        PID:9084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27560.exe
        5⤵
        
        PID:3532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10205.exe
        6⤵
        
        PID:8396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24766.exe
        6⤵
        
        PID:8984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22604.exe
        5⤵
        
        PID:4836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26071.exe
        5⤵
        
        PID:5224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43926.exe
        5⤵
        
        PID:6532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5066.exe
        5⤵
        
        PID:2968
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 308 -s 248
        5⤵
        
        PID:8156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40311.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40311.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2368
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2368 -s 224
        5⤵
        Program crash
        
        PID:1496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44613.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44613.exe
      4⤵
      PID:2284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46631.exe
        5⤵
        
        PID:3252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5411.exe
        5⤵
        
        PID:4496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58472.exe
        5⤵
        
        PID:6092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43715.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1728
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2284 -s 244
        5⤵
        
        PID:7228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65120.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65120.exe
      4⤵
      PID:3168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27856.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27856.exe
      4⤵
      PID:4680
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2000 -s 248
      4⤵
      PID:5968
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23374.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23374.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56477.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56477.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21963.exe
        5⤵
        
        PID:2176
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2176 -s 244
        6⤵
        Program crash
        
        PID:3552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13825.exe
        5⤵
        
        PID:3512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15945.exe
        6⤵
        
        PID:7836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42337.exe
        6⤵
        
        PID:8536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20842.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16738.exe
        5⤵
        
        PID:4824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34737.exe
        5⤵
        
        PID:5216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60462.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53538.exe
        5⤵
        
        PID:6416
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1912 -s 244
        5⤵
        
        PID:8164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18433.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18433.exe
      4⤵
      PID:1432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28411.exe
        5⤵
        
        PID:3260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51104.exe
        5⤵
        
        PID:4880
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1432 -s 244
        5⤵
        
        PID:5784
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 768 -s 224
      4⤵
      Program crash
      PID:3184
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28003.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28003.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6778.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6778.exe
      4⤵
      PID:628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9573.exe
        5⤵
        
        PID:4208
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 628 -s 248
        5⤵
        Program crash
        
        PID:4980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45520.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45520.exe
      4⤵
      PID:3128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30656.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30656.exe
      4⤵
      PID:4624
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1388 -s 236
      4⤵
      Program crash
      PID:5908
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54826.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54826.exe
    3⤵
    PID:572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34376.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34376.exe
      4⤵
      PID:3372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34907.exe
        5⤵
        
        PID:7444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52940.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45342.exe
        5⤵
        
        PID:8912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26080.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26080.exe
      4⤵
      PID:4556
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 572 -s 240
      4⤵
      Program crash
      PID:4696
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57387.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57387.exe
    3⤵
    PID:3460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-745.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-745.exe
      4⤵
      PID:8236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46464.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46464.exe
      4⤵
      PID:9100
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62284.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62284.exe
    3⤵
    PID:4648
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8122.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8122.exe
    3⤵
    PID:5116
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46987.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46987.exe
    3⤵
    PID:6164
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8333.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8333.exe
    3⤵
    PID:6816
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3213.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3213.exe
    3⤵
    PID:7240
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11203.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11203.exe
    3⤵
    PID:8968
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14806.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14806.exe
    3⤵
    PID:9000
- C:\Users\Admin\AppData\Local\Temp\Unicorn-27877.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-27877.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2924
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28330.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28330.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2896
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2896 -s 240
      4⤵
      Loads dropped DLL
      Program crash
      PID:1308
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63067.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63067.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63327.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63327.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31698.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21688.exe
        6⤵
        
        PID:1120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36924.exe
        7⤵
        
        PID:2904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54883.exe
        8⤵
        
        PID:6508
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2904 -s 228
        8⤵
        
        PID:7300
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1120 -s 248
        7⤵
        Program crash
        
        PID:3456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37286.exe
        6⤵
        
        PID:2356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15745.exe
        7⤵
        
        PID:7360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59940.exe
        7⤵
        
        PID:7604
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2356 -s 224
        7⤵
        
        PID:8516
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2744 -s 244
        6⤵
        Program crash
        
        PID:3896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34302.exe
        5⤵
        
        PID:872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61812.exe
        6⤵
        
        PID:3148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30636.exe
        7⤵
        
        PID:7664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19312.exe
        7⤵
        
        PID:8336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38502.exe
        7⤵
        
        PID:8952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1768.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4388
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 872 -s 244
        6⤵
        Program crash
        
        PID:5068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35069.exe
        5⤵
        
        PID:3336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30252.exe
        6⤵
        
        PID:7708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10760.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8368
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3336 -s 220
        6⤵
        
        PID:8992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62209.exe
        5⤵
        
        PID:4524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34457.exe
        5⤵
        
        PID:4940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52588.exe
        5⤵
        
        PID:5836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58735.exe
        5⤵
        
        PID:6864
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2828 -s 248
        5⤵
        
        PID:8040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50125.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50125.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51236.exe
        5⤵
        
        PID:3056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11223.exe
        6⤵
        
        PID:3508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16620.exe
        6⤵
        
        PID:5100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7486.exe
        6⤵
        
        PID:5996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27763.exe
        6⤵
        
        PID:6592
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3056 -s 224
        6⤵
        
        PID:7372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15120.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16904.exe
        5⤵
        
        PID:4368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13351.exe
        5⤵
        
        PID:6012
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2616 -s 224
        5⤵
        
        PID:6632
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1092 -s 240
      4⤵
      Program crash
      PID:1924
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40669.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40669.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56285.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56285.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1896
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1896 -s 224
        5⤵
        Program crash
        
        PID:3048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30877.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30877.exe
      4⤵
      PID:2848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15198.exe
        5⤵
        
        PID:3888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41783.exe
        5⤵
        
        PID:4336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57154.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5496
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2848 -s 248
        5⤵
        
        PID:6616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59255.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59255.exe
      4⤵
      PID:3140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36522.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36522.exe
      4⤵
      PID:4612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4686.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4686.exe
      4⤵
      PID:6020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2562.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2562.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6444
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 604 -s 244
      4⤵
      PID:8124
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14987.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14987.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50084.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50084.exe
      4⤵
      PID:3024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65385.exe
        5⤵
        
        PID:3240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16921.exe
        5⤵
        
        PID:4656
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3024 -s 224
        5⤵
        Program crash
        
        PID:6004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51433.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51433.exe
      4⤵
      PID:3880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42738.exe
        5⤵
        
        PID:4192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5431.exe
        5⤵
        
        PID:9044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36967.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36967.exe
      4⤵
      PID:5060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44249.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44249.exe
      4⤵
      PID:5316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23513.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23513.exe
      4⤵
      PID:6648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21031.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21031.exe
      4⤵
      PID:6268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5868.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5868.exe
      4⤵
      PID:7404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28048.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28048.exe
      4⤵
      PID:8524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15111.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15111.exe
      4⤵
      PID:6100
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61382.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61382.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16613.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16613.exe
      4⤵
      PID:1148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13315.exe
        5⤵
        
        PID:5272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8162.exe
        5⤵
        
        PID:6548
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1148 -s 224
        5⤵
        
        PID:7356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47186.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47186.exe
      4⤵
      PID:4036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60179.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60179.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3776
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1368 -s 248
      4⤵
      PID:6064
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34810.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34810.exe
    3⤵
    PID:2200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22387.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22387.exe
      4⤵
      PID:6940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27399.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27399.exe
      4⤵
      PID:7244
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2200 -s 220
      4⤵
      PID:8064
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20633.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20633.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3276
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2924 -s 248
    3⤵
    - Program crash
    PID:4904
- C:\Users\Admin\AppData\Local\Temp\Unicorn-18115.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-18115.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2648
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26633.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26633.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19555.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19555.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1028
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1028 -s 224
        5⤵
        Program crash
        
        PID:984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49741.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49741.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37915.exe
        5⤵
        
        PID:3036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26374.exe
        6⤵
        
        PID:3828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12473.exe
        7⤵
        
        PID:4608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27315.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9411.exe
        6⤵
        
        PID:5476
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3036 -s 248
        6⤵
        
        PID:6724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15120.exe
        5⤵
        
        PID:4016
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2812 -s 224
        5⤵
        Program crash
        
        PID:4376
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2420 -s 244
      4⤵
      Program crash
      PID:2312
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44806.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44806.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60177.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60177.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50468.exe
        5⤵
        
        PID:2796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22731.exe
        6⤵
        
        PID:1372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26678.exe
        7⤵
        
        PID:4664
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1372 -s 228
        7⤵
        Program crash
        
        PID:4760
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2796 -s 248
        6⤵
        Program crash
        
        PID:3204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14048.exe
        5⤵
        
        PID:2432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55074.exe
        6⤵
        
        PID:4720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23522.exe
        6⤵
        
        PID:4764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58856.exe
        6⤵
        
        PID:824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1333.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5748.exe
        6⤵
        
        PID:7196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47339.exe
        6⤵
        
        PID:9004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43072.exe
        6⤵
        
        PID:9048
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3020 -s 244
        5⤵
        Program crash
        
        PID:3164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55107.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55107.exe
      4⤵
      PID:2956
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2956 -s 244
        5⤵
        Program crash
        
        PID:3544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6647.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6647.exe
      4⤵
      PID:3732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49946.exe
        5⤵
        
        PID:9188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62992.exe
        5⤵
        
        PID:5156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43024.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43024.exe
      4⤵
      PID:4932
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1552 -s 240
      4⤵
      Program crash
      PID:5180
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29542.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29542.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1072
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42108.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42108.exe
      4⤵
      PID:1472
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1472 -s 244
        5⤵
        Program crash
        
        PID:692
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27966.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27966.exe
      4⤵
      PID:2548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11094.exe
        5⤵
        
        PID:7040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61416.exe
        5⤵
        
        PID:7332
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2548 -s 220
        5⤵
        
        PID:6440
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1072 -s 244
      4⤵
      Program crash
      PID:4032
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53903.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53903.exe
    3⤵
    PID:1076
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1076 -s 224
      4⤵
      Program crash
      PID:3108
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7957.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7957.exe
    3⤵
    PID:1792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15360.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15360.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7416
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1792 -s 216
      4⤵
      PID:7440
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12696.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12696.exe
    3⤵
    PID:4300
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34988.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34988.exe
    3⤵
    PID:1812
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48122.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48122.exe
    3⤵
    PID:6156
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31869.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31869.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6928
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49149.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49149.exe
    3⤵
    PID:7172
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2648 -s 244
    3⤵
    PID:8892
- C:\Users\Admin\AppData\Local\Temp\Unicorn-21022.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-21022.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:2012
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18211.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18211.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56394.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56394.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33364.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56301.exe
        6⤵
        
        PID:2836
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2836 -s 224
        7⤵
        Program crash
        
        PID:5304
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2016 -s 248
        6⤵
        Program crash
        
        PID:3484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28350.exe
        5⤵
        
        PID:1184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4955.exe
        6⤵
        
        PID:5332
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1184 -s 248
        6⤵
        
        PID:6576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51684.exe
        5⤵
        
        PID:3384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63304.exe
        5⤵
        
        PID:4620
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2632 -s 244
        5⤵
        
        PID:5988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25750.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25750.exe
      4⤵
      PID:2496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60276.exe
        5⤵
        
        PID:660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43388.exe
        6⤵
        
        PID:4436
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 660 -s 248
        6⤵
        
        PID:6208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9168.exe
        5⤵
        
        PID:3344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16406.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64337.exe
        5⤵
        
        PID:6052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35049.exe
        5⤵
        
        PID:6984
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2496 -s 228
        5⤵
        
        PID:8100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14457.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14457.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65360.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7156
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1080 -s 228
        5⤵
        
        PID:7328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28769.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28769.exe
      4⤵
      PID:3136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13606.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13606.exe
      4⤵
      PID:4820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39136.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39136.exe
      4⤵
      PID:5884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2907.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2907.exe
      4⤵
      PID:6792
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2460 -s 248
      4⤵
      PID:8032
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20000.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20000.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45616.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45616.exe
      4⤵
      Executes dropped EXE
      PID:2868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64853.exe
        5⤵
        
        PID:1280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46273.exe
        6⤵
        
        PID:4908
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1280 -s 248
        6⤵
        
        PID:5800
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2868 -s 248
        5⤵
        Program crash
        
        PID:3616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20291.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20291.exe
      4⤵
      PID:1872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43388.exe
        5⤵
        
        PID:4460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58188.exe
        5⤵
        
        PID:6184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61005.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7020
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1872 -s 228
        5⤵
        
        PID:7204
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2608 -s 240
      4⤵
      Program crash
      PID:3780
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63798.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63798.exe
    3⤵
    PID:2772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16888.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16888.exe
      4⤵
      PID:1996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1105.exe
        5⤵
        
        PID:908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27459.exe
        5⤵
        
        PID:7872
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1996 -s 228
        5⤵
        
        PID:8488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18296.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18296.exe
      4⤵
      PID:4308
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2772 -s 244
      4⤵
      Program crash
      PID:5044
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2012 -s 248
    3⤵
    - Program crash
    PID:2948
- C:\Users\Admin\AppData\Local\Temp\Unicorn-54397.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-54397.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1664
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1664 -s 244
    3⤵
    - Program crash
    PID:2652
- C:\Users\Admin\AppData\Local\Temp\Unicorn-55516.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-55516.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1788
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26540.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26540.exe
    3⤵
    PID:2320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-359.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-359.exe
      4⤵
      PID:3120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9766.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60350.exe
        5⤵
        
        PID:7268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1138.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51207.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9072
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2320 -s 248
      4⤵
      Program crash
      PID:4396
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45839.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45839.exe
    3⤵
    PID:3264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24113.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24113.exe
      4⤵
      PID:7808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4621.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4621.exe
      4⤵
      PID:8472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11714.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11714.exe
      4⤵
      PID:9140
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64512.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64512.exe
    3⤵
    PID:4484
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43123.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43123.exe
    3⤵
    PID:4744
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2963.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2963.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5300
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41669.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41669.exe
    3⤵
    PID:6844
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6278.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6278.exe
    3⤵
    PID:8108
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42874.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42874.exe
    3⤵
    PID:8884
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16206.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16206.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:8836
- C:\Users\Admin\AppData\Local\Temp\Unicorn-42343.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-42343.exe
  2⤵
  PID:2748
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2748 -s 220
    3⤵
    - Program crash
    PID:2932
- C:\Users\Admin\AppData\Local\Temp\Unicorn-38705.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-38705.exe
  2⤵
  PID:2776
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7747.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7747.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6756
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3087.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3087.exe
    3⤵
    PID:280
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2776 -s 224
    3⤵
    PID:7412
- C:\Users\Admin\AppData\Local\Temp\Unicorn-59304.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-59304.exe
  2⤵
  PID:4048
- C:\Users\Admin\AppData\Local\Temp\Unicorn-57008.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-57008.exe
  2⤵
  PID:4852
- C:\Users\Admin\AppData\Local\Temp\Unicorn-5800.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-5800.exe
  2⤵
  PID:5896
- C:\Users\Admin\AppData\Local\Temp\Unicorn-12094.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-12094.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6768
- C:\Users\Admin\AppData\Local\Temp\Unicorn-18614.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-18614.exe
  2⤵
  PID:8172
- C:\Users\Admin\AppData\Local\Temp\Unicorn-36139.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-36139.exe
  2⤵
  PID:8932
- C:\Users\Admin\AppData\Local\Temp\Unicorn-7806.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-7806.exe
  2⤵
  PID:5152

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-18115.exe

Filesize
468KB

MD5
a38dc6d93fa1e51fe989e060921584e6

SHA1
422084ec7f4a64f7b792430eb85c8468dc033625

SHA256
12316002d42536893b82e971c914d0b148438c14468b317fa31d466add199ca6

SHA512
1c124e44dbd0d3678c426b3ef4cbafe68aefa124f161d1fc4cc1373f886a112b39dfc73fd6f4b5ee0e11f1ba3a5ed629e1025ca227dec3bf46a3634cdd060899

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-21022.exe

Filesize
468KB

MD5
4708062cb7022e6b90e68e7e7ba82f1a

SHA1
d173325a57db73325cdd15a69f20a8594e2d09d1

SHA256
fe69f4bfb99e14f8b08f2460a67c07ef7e30940572a0ee8bea481fc9d5d8ce88

SHA512
a4cfae8ba730a9c7631b33d54d1d53d448aed922324d005de6d2e95eb60e32ba9c3a5764eb4187cb35d391bcf0dce99d5d2170f6865d64fb152e6de9b6c04ef8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-28330.exe

Filesize
468KB

MD5
6469809186ef8f0f7b79b657ba9fcde3

SHA1
44504105608dba8dccffb2af910f79166fcb274d

SHA256
2c2edfb430204e0a2d1de2eaa2b021c63777a491af2f120eca52268cebf88a6f

SHA512
e2b7b7d1b2209ac97c5f9b2d6bac4f09a6ec73fc86ef4b621930a27fc17da80ede646b7b129beb49579adee2a6482aeffabfdd55f18408aab260f3c644256db0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-34256.exe

Filesize
468KB

MD5
847cc2cbf969295b51a11912b1d276bd

SHA1
e5e25deddb2928eff8281896ab907b2943baf72a

SHA256
3763e3985e5c18709185b88de55c507f985c72911ba921baa9aac22b1cf57806

SHA512
100911dd5c67ecf3b1f4b41bdd821ff42e00f3ca5eb6a973fc77d725bf65e0de1b69a9362b28b273ab2c50c34b8a53f725f4ed746e60babf8cffbfde0d03ee38

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-58153.exe

Filesize
468KB

MD5
5f8ce8b8d36fe59601bd7aafe1805ab4

SHA1
236462ff931489364b9d829245d068969883c6dc

SHA256
4550ec9447b1e4ccff3bb67d216869050aab43ed68f1b5c17b285234d3f91a32

SHA512
93473801afa727bbaf92ab6f12bc1417985aa97ccae6bb65c726c9e8da3f3fbc7261a1c47e0cde898fd70bd1a3c900f389a355a1f4d9031255329a2918c8d1bb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-63067.exe

Filesize
468KB

MD5
8153c0eeb3d0d0ad6c8af2ef88f919cf

SHA1
20234d82357e58b3caaf326950276fd9ec096488

SHA256
83aa2be763141b622cf6917425bd0195ed787a351ab30cac72d98aaca4732100

SHA512
2a3525921e9f2e8089670e9754507a0c67502bb91f68abf05ef76a9bce19973c5e4acd39f62b94346a43e238a613ed1e40e98720b394701b71bad8193701e3a7

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-12548.exe

Filesize
468KB

MD5
e5e3058d69cd283c262529f9a00f5ff7

SHA1
148471210dd2f439bb24b93cf32ebc0a0c32f316

SHA256
4afae4f7c74b5b5bd2ab79a3760a6a525ce21d83d5211e55470d18f307db9a8c

SHA512
03fcc7ce4d63931a8c39f4350958855620c635d536638149d7dd3fde8fdb431baa2c3749835eae8f76ad350733032079056d207521899491a3462c036be0f166

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-15157.exe

Filesize
468KB

MD5
422e5df1f999c74efe901ee3bcb0f68e

SHA1
3401f8f46b70ecb8c3baf26a1c61d855d4454b55

SHA256
92abef530ebdd1f07f0825b31549da5be74dcb0de04cd248bd6a8005cdf1083e

SHA512
b5f7aeadb975ae5e6f2bead950810835fa5c14b58e1de3c621a0ac62cd9e5aaff1191a3970ffcc0e4caa5743db9c6943299f278f96ef8c51e93e77e486faef09

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-17997.exe

Filesize
468KB

MD5
bc7f16a8bce4d0df01d84cf6ab9331f8

SHA1
5591da7194b07aae658db0a3bb21d0fdb8b431f7

SHA256
3820bfd93ad0630b4a8acfbb5e22cbcbe4ea94be083d867f897e4a48b3ec430c

SHA512
035eddb957f29bc393345cb08a1418ee2cd17dd60cf44b967de4670754ec40ab395498ebb3b80858dbb27d40cd288ed416faa12813d52c495f87680d448c72e0

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-26633.exe

Filesize
468KB

MD5
536a1e9a014005f45807f362a4c06614

SHA1
1e282a6f09d1a16e7b83ca522b4b6b293e649a9b

SHA256
7a84e479438422b9197c178748a7238573c9b2f4782d2218a728e3aee2e06b97

SHA512
d6c5a3f8c969ed0f75fd4661df4d22080734f73d468017cac0f7af604ad7874f37021b2fb37ee86b65b6ea5ebe7baf4e55f2136e8862d0eb3977811865d6d0d1

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-27877.exe

Filesize
468KB

MD5
1190e01b3b33ae1fca9a4851d8ca44b8

SHA1
0992d6e0643b89adc41455389463913f0cd589d3

SHA256
63a9cd435eb3377a76a065ae438493095202715d8a03915b6468b0f0fe5d4b05

SHA512
0e730589e00f0e1ea1d50475316189098ab302c0dd64b1b53ea657d500bbf16f2253bef04c51ec7568196ad5a47946f26207b746392e3ca30fe96b31a3fce4b1

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-29840.exe

Filesize
468KB

MD5
f1d4179d21f5a5a581b41f88ea7ea45e

SHA1
06cee131e7a929479b80e062b6bbabc4c03534dd

SHA256
acd65a39b23b3da0756ac6ad3702d61ec6115fe75e47ec277fc0e83e3608b710

SHA512
bac65b5926f346e2746afb5048b16560e05345c4de90a2c2126cef813e0aa40ecdb1dd208751879da1be2a8de84a4edfcd38228767b6db169b8071d5e8b6bda9

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-39631.exe

Filesize
468KB

MD5
f273fc4a6bdf0982b6039d61e9f78648

SHA1
7c342fb249df9d653ab80d1b684d169dab131181

SHA256
e9067c7746a7030326877fb883481d41e5a3c19827d75c8a03f1e935a219f3f4

SHA512
f50edf390c0c4afb29ec3452c5dec8574a9d8ed6e9fb6810eb850607e06e858f56e2ab56a686d8b801a48fb5e441eedcd6afb1cbdaa0ab0f16c1da65129feac7

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-40582.exe

Filesize
468KB

MD5
9efa4506362c6c091500a8b56c5f500a

SHA1
871b2721e08b21c2c58d475e9ab47c8b416cf92c

SHA256
d999b637378f6801bf632313507e4f1de50dba182d22a9ad23be2c4e922145ce

SHA512
fc6758e690d6075f56b18574cfef19353192d434ef43f084577e210984e06cb95934a338b32f1e55fcfceae1f7136c812ab1e5fe697c50185c585d2128f89724

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-47375.exe

Filesize
468KB

MD5
f2afde1f5cdb9e7f616640ac7d5aced7

SHA1
0a89b685cd4daeb38dd2c69086b7990b223bc949

SHA256
415a89cc1134a18c9134b9a76add61b2715e5d61e157c1c99cc1365b44b18473

SHA512
46355cca3018825307d6d4d79b3ee90499a22bb264932cb9c3f21e000a3e5f591729044f24236ff75934fcec4fb5c6e9f7c55478fe9e379d432dd8a4a45ac84e

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-51827.exe

Filesize
468KB

MD5
7e5deb64ac19b98adb52e79ddbedaf72

SHA1
5ba9e38058302ec82e06352294f8087e71e5848a

SHA256
627ac0d75db68612b71ffa7284f2f6ce9ed925e953b9478dd8af88bfed6ee204

SHA512
a33153fe85d6987ef344730720b88e91fadfe5f3ae50a40486ccdb388b494dcd9d21855f368bc06473fd207bccf76fed4329449a69ab25ff3be6c63543001425

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-54199.exe

Filesize
468KB

MD5
114f23419d36da5facec578c02e6f10d

SHA1
9cfce68104f2c3697d71df01fd92847dd011569b

SHA256
32c99e4106ca3fa94b10a6409fb98fb224ede882e1f7d1efb11c19a0c3df1b21

SHA512
1d6ed9862556c4a5b1517d11ef3b981eae13fb3c4bf6b12b40e1495a1b9dd8fd320d1a1f8dd09f13c1752afe1309dfe7516b79e360de7a13e6c6e2017e0f3aa4

Download Submit