ceaf3360966ffa376999370b7c26acebc3cfa4d4f2fa88a22f83892c831b2b9c

Analysis

max time kernel
120s
max time network
16s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
15/09/2024, 01:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

64a179787c8c30c3f4f902b15ad6abd0N.exe
Size

468KB
MD5

64a179787c8c30c3f4f902b15ad6abd0
SHA1

a36ee81380f8aeb73b5c3e136f8d2cbb18e05d2b
SHA256

ceaf3360966ffa376999370b7c26acebc3cfa4d4f2fa88a22f83892c831b2b9c
SHA512

27ab73c8347bdd1e413db9c611d263cbb9c4e90c63670c9e388a4a9109b572c741090960ef9e91be01c127d843d99d22363f5fc636961f145b5296bf0b0ed8ce
SSDEEP

3072:1G3HogISIw5TtbY2HzcOcf8/zthaP0pkJVHexVPyQ6WLK7ngEslL:1G3obgTtxH4Ocf7Y1mQ64ongE

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2904	Unicorn-7549.exe
2724	Unicorn-31276.exe
2644	Unicorn-26677.exe
2640	Unicorn-54706.exe
2608	Unicorn-60674.exe
2172	Unicorn-28386.exe
608	Unicorn-32888.exe
2000	Unicorn-30797.exe
1816	Unicorn-44978.exe
2084	Unicorn-34087.exe
2504	Unicorn-22794.exe
1740	Unicorn-25374.exe
2136	Unicorn-42660.exe
2888	Unicorn-5773.exe
2592	Unicorn-10117.exe
2572	Unicorn-3765.exe
2436	Unicorn-15182.exe
1836	Unicorn-17439.exe
1660	Unicorn-3231.exe
1952	Unicorn-15824.exe
2260	Unicorn-7263.exe
1452	Unicorn-35913.exe
1708	Unicorn-40320.exe
1260	Unicorn-64638.exe
2884	Unicorn-53475.exe
1588	Unicorn-41306.exe
932	Unicorn-21440.exe
2376	Unicorn-2119.exe
1636	Unicorn-34856.exe
2324	Unicorn-19575.exe
2700	Unicorn-59176.exe
1228	Unicorn-36025.exe
1540	Unicorn-7370.exe
2764	Unicorn-20561.exe
2852	Unicorn-7178.exe
2948	Unicorn-49286.exe
2776	Unicorn-11786.exe
2924	Unicorn-25169.exe
2180	Unicorn-45803.exe
264	Unicorn-46021.exe
1656	Unicorn-26155.exe
484	Unicorn-32435.exe
1436	Unicorn-13540.exe
2292	Unicorn-5092.exe
2164	Unicorn-64499.exe
2176	Unicorn-25020.exe
2080	Unicorn-50956.exe
2508	Unicorn-38210.exe
2872	Unicorn-45573.exe
1584	Unicorn-32620.exe
1700	Unicorn-62134.exe
2264	Unicorn-27132.exe
2500	Unicorn-7266.exe
1688	Unicorn-62637.exe
1092	Unicorn-31315.exe
1252	Unicorn-12793.exe
1340	Unicorn-64589.exe
1840	Unicorn-63089.exe
2192	Unicorn-49898.exe
560	Unicorn-30778.exe
2108	Unicorn-56260.exe
2092	Unicorn-21210.exe
1428	Unicorn-21476.exe
916	Unicorn-64821.exe

Loads dropped DLL 64 IoCs

pid	Process
2736	64a179787c8c30c3f4f902b15ad6abd0N.exe
2736	64a179787c8c30c3f4f902b15ad6abd0N.exe
2904	Unicorn-7549.exe
2736	64a179787c8c30c3f4f902b15ad6abd0N.exe
2904	Unicorn-7549.exe
2736	64a179787c8c30c3f4f902b15ad6abd0N.exe
2724	Unicorn-31276.exe
2724	Unicorn-31276.exe
2904	Unicorn-7549.exe
2904	Unicorn-7549.exe
2644	Unicorn-26677.exe
2644	Unicorn-26677.exe
2736	64a179787c8c30c3f4f902b15ad6abd0N.exe
2736	64a179787c8c30c3f4f902b15ad6abd0N.exe
2640	Unicorn-54706.exe
2640	Unicorn-54706.exe
2904	Unicorn-7549.exe
2904	Unicorn-7549.exe
2172	Unicorn-28386.exe
2172	Unicorn-28386.exe
2644	Unicorn-26677.exe
2608	Unicorn-60674.exe
2644	Unicorn-26677.exe
2608	Unicorn-60674.exe
2724	Unicorn-31276.exe
2724	Unicorn-31276.exe
2736	64a179787c8c30c3f4f902b15ad6abd0N.exe
2736	64a179787c8c30c3f4f902b15ad6abd0N.exe
2856	WerFault.exe
2856	WerFault.exe
2856	WerFault.exe
2856	WerFault.exe
2856	WerFault.exe
2000	Unicorn-30797.exe
2000	Unicorn-30797.exe
2640	Unicorn-54706.exe
2640	Unicorn-54706.exe
1816	Unicorn-44978.exe
1816	Unicorn-44978.exe
2904	Unicorn-7549.exe
2904	Unicorn-7549.exe
2504	Unicorn-22794.exe
2504	Unicorn-22794.exe
2644	Unicorn-26677.exe
2136	Unicorn-42660.exe
2644	Unicorn-26677.exe
2136	Unicorn-42660.exe
2608	Unicorn-60674.exe
2608	Unicorn-60674.exe
1740	Unicorn-25374.exe
1740	Unicorn-25374.exe
2736	64a179787c8c30c3f4f902b15ad6abd0N.exe
2736	64a179787c8c30c3f4f902b15ad6abd0N.exe
2084	Unicorn-34087.exe
2084	Unicorn-34087.exe
2888	Unicorn-5773.exe
2172	Unicorn-28386.exe
2888	Unicorn-5773.exe
2172	Unicorn-28386.exe
2724	Unicorn-31276.exe
2724	Unicorn-31276.exe
2592	Unicorn-10117.exe
2592	Unicorn-10117.exe
2000	Unicorn-30797.exe

Program crash 64 IoCs

pid	pid_target	Process	procid_target
2856	608	WerFault.exe	36
968	2884	WerFault.exe	55
2972	932	WerFault.exe	57
2676	2292	WerFault.exe	76
2156	2508	WerFault.exe	79
2876	2080	WerFault.exe	78
376	2260	WerFault.exe	51
2244	2084	WerFault.exe	39
2944	1656	WerFault.exe	70
2968	1340	WerFault.exe	89
2052	2092	WerFault.exe	94
2216	2192	WerFault.exe	91
2808	1112	WerFault.exe	123
1928	2832	WerFault.exe	103
2660	2764	WerFault.exe	64
3200	1176	WerFault.exe	118
4036	2136	WerFault.exe	41
4076	1688	WerFault.exe	86
3076	264	WerFault.exe	71
3084	2256	WerFault.exe	116
4084	2776	WerFault.exe	67
3112	1320	WerFault.exe	122
3148	2176	WerFault.exe	77
3220	1428	WerFault.exe	95
3264	2408	WerFault.exe	131
3244	2412	WerFault.exe	119
3236	2804	WerFault.exe	128
3216	1488	WerFault.exe	141
3168	2980	WerFault.exe	112
3160	792	WerFault.exe	132
4020	2924	WerFault.exe	68
4156	2852	WerFault.exe	65
4508	652	WerFault.exe	108
4668	1432	WerFault.exe	106
4292	2380	WerFault.exe	154
4532	2860	WerFault.exe	169
4544	1512	WerFault.exe	165
4760	484	WerFault.exe	72
4892	1020	WerFault.exe	167
4444	1452	WerFault.exe	52
4324	2636	WerFault.exe	102
4756	560	WerFault.exe	92
4716	1436	WerFault.exe	73
5032	2908	WerFault.exe	99
3444	2652	WerFault.exe	156
4312	2848	WerFault.exe	137
4140	1920	WerFault.exe	143
4952	1952	WerFault.exe	50
4856	2108	WerFault.exe	93
5008	2028	WerFault.exe	133
5048	1092	WerFault.exe	87
4208	1572	WerFault.exe	136
5100	2400	WerFault.exe	97
4124	1808	WerFault.exe	149
4416	1636	WerFault.exe	59
4472	1252	WerFault.exe	88
5160	2976	WerFault.exe	181
5152	1484	WerFault.exe	182
5144	2544	WerFault.exe	142
5752	3716	WerFault.exe	206
5764	2964	WerFault.exe	101
5972	3012	WerFault.exe	100
5964	1836	WerFault.exe	48
5956	1520	WerFault.exe	150

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29456.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21136.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62722.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62702.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23534.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49507.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42702.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24125.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24834.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	64a179787c8c30c3f4f902b15ad6abd0N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20033.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56646.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32867.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3231.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40320.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48521.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63064.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51509.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47124.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1636.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52426.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33943.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44984.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58198.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34938.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63204.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63472.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37244.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47302.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53432.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51941.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28099.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19367.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54459.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16896.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32374.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32534.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21210.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37417.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62523.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44322.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8237.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44202.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40883.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34088.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31256.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58099.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32071.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9678.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25524.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26147.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43200.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15993.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10943.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64638.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11786.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29231.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45992.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53949.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45681.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5748.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36025.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50176.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10049.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2736	64a179787c8c30c3f4f902b15ad6abd0N.exe
2904	Unicorn-7549.exe
2724	Unicorn-31276.exe
2644	Unicorn-26677.exe
2640	Unicorn-54706.exe
608	Unicorn-32888.exe
2172	Unicorn-28386.exe
2608	Unicorn-60674.exe
2000	Unicorn-30797.exe
1816	Unicorn-44978.exe
2504	Unicorn-22794.exe
2084	Unicorn-34087.exe
1740	Unicorn-25374.exe
2888	Unicorn-5773.exe
2136	Unicorn-42660.exe
2592	Unicorn-10117.exe
2572	Unicorn-3765.exe
2436	Unicorn-15182.exe
1836	Unicorn-17439.exe
1660	Unicorn-3231.exe
1952	Unicorn-15824.exe
2260	Unicorn-7263.exe
1452	Unicorn-35913.exe
1708	Unicorn-40320.exe
1260	Unicorn-64638.exe
2884	Unicorn-53475.exe
932	Unicorn-21440.exe
1588	Unicorn-41306.exe
2376	Unicorn-2119.exe
1636	Unicorn-34856.exe
2324	Unicorn-19575.exe
2700	Unicorn-59176.exe
1228	Unicorn-36025.exe
1540	Unicorn-7370.exe
2852	Unicorn-7178.exe
2764	Unicorn-20561.exe
2948	Unicorn-49286.exe
2776	Unicorn-11786.exe
2924	Unicorn-25169.exe
2180	Unicorn-45803.exe
264	Unicorn-46021.exe
1436	Unicorn-13540.exe
484	Unicorn-32435.exe
1656	Unicorn-26155.exe
2292	Unicorn-5092.exe
2164	Unicorn-64499.exe
2080	Unicorn-50956.exe
2176	Unicorn-25020.exe
2508	Unicorn-38210.exe
2872	Unicorn-45573.exe
1584	Unicorn-32620.exe
1700	Unicorn-62134.exe
2264	Unicorn-27132.exe
2500	Unicorn-7266.exe
1688	Unicorn-62637.exe
1252	Unicorn-12793.exe
1092	Unicorn-31315.exe
1340	Unicorn-64589.exe
1840	Unicorn-63089.exe
2192	Unicorn-49898.exe
2108	Unicorn-56260.exe
1428	Unicorn-21476.exe
560	Unicorn-30778.exe
2092	Unicorn-21210.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2736 wrote to memory of 2904	2736	64a179787c8c30c3f4f902b15ad6abd0N.exe	30
PID 2736 wrote to memory of 2904	2736	64a179787c8c30c3f4f902b15ad6abd0N.exe	30
PID 2736 wrote to memory of 2904	2736	64a179787c8c30c3f4f902b15ad6abd0N.exe	30
PID 2736 wrote to memory of 2904	2736	64a179787c8c30c3f4f902b15ad6abd0N.exe	30
PID 2904 wrote to memory of 2724	2904	Unicorn-7549.exe	31
PID 2904 wrote to memory of 2724	2904	Unicorn-7549.exe	31
PID 2904 wrote to memory of 2724	2904	Unicorn-7549.exe	31
PID 2904 wrote to memory of 2724	2904	Unicorn-7549.exe	31
PID 2736 wrote to memory of 2644	2736	64a179787c8c30c3f4f902b15ad6abd0N.exe	32
PID 2736 wrote to memory of 2644	2736	64a179787c8c30c3f4f902b15ad6abd0N.exe	32
PID 2736 wrote to memory of 2644	2736	64a179787c8c30c3f4f902b15ad6abd0N.exe	32
PID 2736 wrote to memory of 2644	2736	64a179787c8c30c3f4f902b15ad6abd0N.exe	32
PID 2724 wrote to memory of 2608	2724	Unicorn-31276.exe	33
PID 2724 wrote to memory of 2608	2724	Unicorn-31276.exe	33
PID 2724 wrote to memory of 2608	2724	Unicorn-31276.exe	33
PID 2724 wrote to memory of 2608	2724	Unicorn-31276.exe	33
PID 2904 wrote to memory of 2640	2904	Unicorn-7549.exe	34
PID 2904 wrote to memory of 2640	2904	Unicorn-7549.exe	34
PID 2904 wrote to memory of 2640	2904	Unicorn-7549.exe	34
PID 2904 wrote to memory of 2640	2904	Unicorn-7549.exe	34
PID 2644 wrote to memory of 2172	2644	Unicorn-26677.exe	35
PID 2644 wrote to memory of 2172	2644	Unicorn-26677.exe	35
PID 2644 wrote to memory of 2172	2644	Unicorn-26677.exe	35
PID 2644 wrote to memory of 2172	2644	Unicorn-26677.exe	35
PID 2736 wrote to memory of 608	2736	64a179787c8c30c3f4f902b15ad6abd0N.exe	36
PID 2736 wrote to memory of 608	2736	64a179787c8c30c3f4f902b15ad6abd0N.exe	36
PID 2736 wrote to memory of 608	2736	64a179787c8c30c3f4f902b15ad6abd0N.exe	36
PID 2736 wrote to memory of 608	2736	64a179787c8c30c3f4f902b15ad6abd0N.exe	36
PID 2640 wrote to memory of 2000	2640	Unicorn-54706.exe	37
PID 2640 wrote to memory of 2000	2640	Unicorn-54706.exe	37
PID 2640 wrote to memory of 2000	2640	Unicorn-54706.exe	37
PID 2640 wrote to memory of 2000	2640	Unicorn-54706.exe	37
PID 2904 wrote to memory of 1816	2904	Unicorn-7549.exe	38
PID 2904 wrote to memory of 1816	2904	Unicorn-7549.exe	38
PID 2904 wrote to memory of 1816	2904	Unicorn-7549.exe	38
PID 2904 wrote to memory of 1816	2904	Unicorn-7549.exe	38
PID 2172 wrote to memory of 2084	2172	Unicorn-28386.exe	39
PID 2172 wrote to memory of 2084	2172	Unicorn-28386.exe	39
PID 2172 wrote to memory of 2084	2172	Unicorn-28386.exe	39
PID 2172 wrote to memory of 2084	2172	Unicorn-28386.exe	39
PID 2644 wrote to memory of 2504	2644	Unicorn-26677.exe	40
PID 2644 wrote to memory of 2504	2644	Unicorn-26677.exe	40
PID 2644 wrote to memory of 2504	2644	Unicorn-26677.exe	40
PID 2644 wrote to memory of 2504	2644	Unicorn-26677.exe	40
PID 2608 wrote to memory of 2136	2608	Unicorn-60674.exe	41
PID 2608 wrote to memory of 2136	2608	Unicorn-60674.exe	41
PID 2608 wrote to memory of 2136	2608	Unicorn-60674.exe	41
PID 2608 wrote to memory of 2136	2608	Unicorn-60674.exe	41
PID 608 wrote to memory of 2856	608	Unicorn-32888.exe	42
PID 608 wrote to memory of 2856	608	Unicorn-32888.exe	42
PID 608 wrote to memory of 2856	608	Unicorn-32888.exe	42
PID 608 wrote to memory of 2856	608	Unicorn-32888.exe	42
PID 2724 wrote to memory of 2888	2724	Unicorn-31276.exe	43
PID 2724 wrote to memory of 2888	2724	Unicorn-31276.exe	43
PID 2724 wrote to memory of 2888	2724	Unicorn-31276.exe	43
PID 2724 wrote to memory of 2888	2724	Unicorn-31276.exe	43
PID 2736 wrote to memory of 1740	2736	64a179787c8c30c3f4f902b15ad6abd0N.exe	44
PID 2736 wrote to memory of 1740	2736	64a179787c8c30c3f4f902b15ad6abd0N.exe	44
PID 2736 wrote to memory of 1740	2736	64a179787c8c30c3f4f902b15ad6abd0N.exe	44
PID 2736 wrote to memory of 1740	2736	64a179787c8c30c3f4f902b15ad6abd0N.exe	44
PID 2000 wrote to memory of 2592	2000	Unicorn-30797.exe	45
PID 2000 wrote to memory of 2592	2000	Unicorn-30797.exe	45
PID 2000 wrote to memory of 2592	2000	Unicorn-30797.exe	45
PID 2000 wrote to memory of 2592	2000	Unicorn-30797.exe	45

C:\Users\Admin\AppData\Local\Temp\64a179787c8c30c3f4f902b15ad6abd0N.exe
"C:\Users\Admin\AppData\Local\Temp\64a179787c8c30c3f4f902b15ad6abd0N.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2736
- C:\Users\Admin\AppData\Local\Temp\Unicorn-7549.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-7549.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2904
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31276.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31276.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60674.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60674.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42660.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:2136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7263.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45803.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-308.exe
        8⤵
        
        PID:1884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7162.exe
        9⤵
        
        PID:2284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61376.exe
        10⤵
        
        PID:5808
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2284 -s 216
        10⤵
        
        PID:6596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41725.exe
        9⤵
        
        PID:4880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17596.exe
        9⤵
        
        PID:5936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53168.exe
        9⤵
        
        PID:6440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55170.exe
        9⤵
        
        PID:7928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35284.exe
        9⤵
        
        PID:8416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12481.exe
        8⤵
        
        PID:3016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5212.exe
        9⤵
        
        PID:4320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9729.exe
        9⤵
        
        PID:6620
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3016 -s 224
        9⤵
        
        PID:6772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11771.exe
        8⤵
        
        PID:5104
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2180 -s 228
        8⤵
        
        PID:4420
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2260 -s 236
        7⤵
        Program crash
        
        PID:376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26155.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1656
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1656 -s 244
        7⤵
        Program crash
        
        PID:2944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51153.exe
        6⤵
        
        PID:2408
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2408 -s 224
        7⤵
        Program crash
        
        PID:3264
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2136 -s 248
        6⤵
        Program crash
        
        PID:4036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35913.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13540.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12190.exe
        7⤵
        
        PID:2456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35665.exe
        8⤵
        
        PID:5052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3861.exe
        8⤵
        
        PID:5988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47303.exe
        8⤵
        
        PID:6416
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2456 -s 236
        8⤵
        
        PID:7900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7838.exe
        7⤵
        
        PID:3636
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1436 -s 244
        7⤵
        Program crash
        
        PID:4716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57862.exe
        6⤵
        
        PID:1808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19718.exe
        7⤵
        
        PID:3384
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1808 -s 248
        7⤵
        Program crash
        
        PID:4124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36841.exe
        6⤵
        
        PID:3640
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1452 -s 236
        6⤵
        Program crash
        
        PID:4444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64499.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42548.exe
        6⤵
        
        PID:3028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62523.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54651.exe
        8⤵
        
        PID:4112
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3092 -s 248
        8⤵
        
        PID:5828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13303.exe
        7⤵
        
        PID:3816
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3028 -s 224
        7⤵
        
        PID:6016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45756.exe
        6⤵
        
        PID:3172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48944.exe
        7⤵
        
        PID:6400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56568.exe
        7⤵
        
        PID:7984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9701.exe
        7⤵
        
        PID:8340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54361.exe
        6⤵
        
        PID:4244
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2164 -s 248
        6⤵
        
        PID:6140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23534.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46751.exe
        6⤵
        
        PID:3832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62722.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33065.exe
        7⤵
        
        PID:8088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33943.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20681.exe
        6⤵
        
        PID:4692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8197.exe
        6⤵
        
        PID:6600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46748.exe
        6⤵
        
        PID:7236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20015.exe
        6⤵
        
        PID:8592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42667.exe
        6⤵
        
        PID:9000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17857.exe
        5⤵
        
        PID:3292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53732.exe
        5⤵
        
        PID:5076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21002.exe
        5⤵
        
        PID:6676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17082.exe
        5⤵
        
        PID:8188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59216.exe
        5⤵
        
        PID:8544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37067.exe
        5⤵
        
        PID:8408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5773.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5773.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41306.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62134.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53432.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36685.exe
        8⤵
        
        PID:1020
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1020 -s 220
        9⤵
        Program crash
        
        PID:4892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28710.exe
        8⤵
        
        PID:4336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44612.exe
        8⤵
        
        PID:5188
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2168 -s 248
        8⤵
        
        PID:6716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56238.exe
        7⤵
        
        PID:1620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25524.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1089.exe
        8⤵
        
        PID:6816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40883.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28681.exe
        8⤵
        
        PID:8552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59203.exe
        8⤵
        
        PID:8876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8237.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17996.exe
        7⤵
        
        PID:5268
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1700 -s 244
        7⤵
        
        PID:6472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40577.exe
        6⤵
        
        PID:1432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1568.exe
        7⤵
        
        PID:2288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41526.exe
        8⤵
        
        PID:5436
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2288 -s 236
        8⤵
        
        PID:6564
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1432 -s 248
        7⤵
        Program crash
        
        PID:4668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46.exe
        6⤵
        
        PID:1448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50332.exe
        7⤵
        
        PID:5136
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1448 -s 216
        7⤵
        
        PID:6608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47595.exe
        6⤵
        
        PID:4720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32071.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38003.exe
        6⤵
        
        PID:6636
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1588 -s 244
        6⤵
        
        PID:7912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7266.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2169.exe
        6⤵
        
        PID:2056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12436.exe
        7⤵
        
        PID:3580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30466.exe
        7⤵
        
        PID:4968
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2056 -s 244
        7⤵
        
        PID:6484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6922.exe
        6⤵
        
        PID:3288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52738.exe
        7⤵
        
        PID:6812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5748.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10469.exe
        7⤵
        
        PID:8588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7530.exe
        6⤵
        
        PID:5116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29138.exe
        6⤵
        
        PID:6692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38082.exe
        6⤵
        
        PID:8176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3480.exe
        6⤵
        
        PID:8560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59733.exe
        6⤵
        
        PID:8836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36226.exe
        5⤵
        
        PID:2848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16428.exe
        6⤵
        
        PID:3572
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2848 -s 248
        6⤵
        Program crash
        
        PID:4312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26523.exe
        5⤵
        
        PID:4012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4730.exe
        5⤵
        
        PID:3380
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2888 -s 248
        5⤵
        
        PID:6668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2119.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2119.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27132.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39328.exe
        6⤵
        
        PID:2804
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2804 -s 244
        7⤵
        Program crash
        
        PID:3236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25006.exe
        6⤵
        
        PID:4056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43200.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:9036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9678.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58841.exe
        6⤵
        
        PID:5784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58710.exe
        6⤵
        
        PID:7820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51280.exe
        6⤵
        
        PID:8272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24398.exe
        6⤵
        
        PID:8916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37417.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35637.exe
        6⤵
        
        PID:3404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37581.exe
        7⤵
        
        PID:6452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16996.exe
        7⤵
        
        PID:7960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5078.exe
        7⤵
        
        PID:8032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32534.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:9048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10449.exe
        6⤵
        
        PID:4524
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2728 -s 224
        6⤵
        
        PID:6040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45716.exe
        5⤵
        
        PID:3660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57545.exe
        6⤵
        
        PID:7084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27147.exe
        6⤵
        
        PID:7280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22815.exe
        6⤵
        
        PID:8512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2331.exe
        6⤵
        
        PID:9004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23164.exe
        5⤵
        
        PID:4920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14796.exe
        5⤵
        
        PID:5920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27967.exe
        5⤵
        
        PID:6376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55700.exe
        5⤵
        
        PID:7904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30819.exe
        5⤵
        
        PID:8396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62637.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62637.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47831.exe
        5⤵
        
        PID:1488
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1488 -s 244
        6⤵
        Program crash
        
        PID:3216
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1688 -s 248
        5⤵
        Program crash
        
        PID:4076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37416.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37416.exe
      4⤵
      PID:1920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12986.exe
        5⤵
        
        PID:3416
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1920 -s 228
        5⤵
        Program crash
        
        PID:4140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32196.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32196.exe
      4⤵
      PID:3612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28706.exe
        5⤵
        
        PID:6780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60891.exe
        5⤵
        
        PID:7684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29527.exe
        5⤵
        
        PID:9016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35271.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35271.exe
      4⤵
      PID:4864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65009.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65009.exe
      4⤵
      PID:6700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11747.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11747.exe
      4⤵
      PID:8168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63417.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63417.exe
      4⤵
      PID:8568
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2724 -s 244
      4⤵
      PID:8616
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54706.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54706.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30797.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30797.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10117.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:2592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34856.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31315.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27676.exe
        8⤵
        
        PID:2928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42702.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:4168
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2928 -s 248
        9⤵
        
        PID:5196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26587.exe
        8⤵
        
        PID:3828
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1092 -s 244
        8⤵
        Program crash
        
        PID:5048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45117.exe
        7⤵
        
        PID:2380
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2380 -s 224
        8⤵
        Program crash
        
        PID:4292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63203.exe
        7⤵
        
        PID:3308
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1636 -s 248
        7⤵
        Program crash
        
        PID:4416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12793.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8339.exe
        7⤵
        
        PID:2772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29456.exe
        8⤵
        
        PID:3044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19386.exe
        9⤵
        
        PID:4604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21136.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:5736
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3044 -s 244
        9⤵
        
        PID:6528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3500.exe
        8⤵
        
        PID:3440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44202.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4808
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2772 -s 228
        8⤵
        
        PID:6724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43632.exe
        7⤵
        
        PID:408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43408.exe
        8⤵
        
        PID:4348
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 408 -s 216
        8⤵
        
        PID:5696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48180.exe
        7⤵
        
        PID:4172
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1252 -s 228
        7⤵
        Program crash
        
        PID:4472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59184.exe
        6⤵
        
        PID:2544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22598.exe
        7⤵
        
        PID:4264
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2544 -s 248
        7⤵
        Program crash
        
        PID:5144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57397.exe
        6⤵
        
        PID:3584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34740.exe
        6⤵
        
        PID:4784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3937.exe
        6⤵
        
        PID:6656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38613.exe
        6⤵
        
        PID:8132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64552.exe
        6⤵
        
        PID:8492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32867.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19575.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49898.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2192
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2192 -s 240
        7⤵
        Program crash
        
        PID:2216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19367.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43095.exe
        7⤵
        
        PID:4696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59999.exe
        7⤵
        
        PID:6580
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 896 -s 224
        7⤵
        
        PID:7208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41730.exe
        6⤵
        
        PID:4732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40737.exe
        6⤵
        
        PID:5720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54539.exe
        6⤵
        
        PID:6428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38634.exe
        6⤵
        
        PID:7948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52350.exe
        6⤵
        
        PID:8448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30778.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40089.exe
        6⤵
        
        PID:2652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63064.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1956
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2652 -s 228
        7⤵
        Program crash
        
        PID:3444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49468.exe
        6⤵
        
        PID:2296
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 560 -s 244
        6⤵
        Program crash
        
        PID:4756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40592.exe
        5⤵
        
        PID:2236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49588.exe
        6⤵
        
        PID:4956
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2236 -s 248
        6⤵
        
        PID:5124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10019.exe
        5⤵
        
        PID:3804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24866.exe
        5⤵
        
        PID:4136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55069.exe
        5⤵
        
        PID:6748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1497.exe
        5⤵
        
        PID:7992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25484.exe
        5⤵
        
        PID:8508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3765.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3765.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59176.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64589.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1340
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1340 -s 224
        7⤵
        Program crash
        
        PID:2968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22490.exe
        6⤵
        
        PID:1572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6344.exe
        7⤵
        
        PID:3852
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1572 -s 228
        7⤵
        Program crash
        
        PID:4208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20657.exe
        6⤵
        
        PID:3328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13395.exe
        6⤵
        
        PID:5088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20664.exe
        6⤵
        
        PID:6628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21547.exe
        6⤵
        
        PID:7296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20545.exe
        6⤵
        
        PID:8604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38202.exe
        6⤵
        
        PID:9104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63089.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61910.exe
        6⤵
        
        PID:1520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24428.exe
        7⤵
        
        PID:3272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13966.exe
        8⤵
        
        PID:4612
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3272 -s 216
        8⤵
        
        PID:6492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23054.exe
        7⤵
        
        PID:3520
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1520 -s 244
        7⤵
        Program crash
        
        PID:5956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9365.exe
        6⤵
        
        PID:3468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7797.exe
        7⤵
        
        PID:6228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57582.exe
        7⤵
        
        PID:8160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25595.exe
        7⤵
        
        PID:8628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9685.exe
        6⤵
        
        PID:4620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23462.exe
        6⤵
        
        PID:6084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37082.exe
        6⤵
        
        PID:7200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23194.exe
        6⤵
        
        PID:8128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18422.exe
        6⤵
        
        PID:8668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28099.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54373.exe
        6⤵
        
        PID:5004
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 876 -s 248
        6⤵
        
        PID:6056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38316.exe
        5⤵
        
        PID:3564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41402.exe
        5⤵
        
        PID:4548
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2572 -s 248
        5⤵
        
        PID:6644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36025.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36025.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56260.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51941.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50958.exe
        7⤵
        
        PID:3396
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1224 -s 248
        7⤵
        
        PID:6032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25409.exe
        6⤵
        
        PID:4000
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2108 -s 224
        6⤵
        Program crash
        
        PID:4856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49507.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60491.exe
        6⤵
        
        PID:4276
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1912 -s 248
        6⤵
        
        PID:6064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39145.exe
        5⤵
        
        PID:4052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50067.exe
        5⤵
        
        PID:4888
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1228 -s 244
        5⤵
        
        PID:6544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21210.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21210.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36685.exe
        5⤵
        
        PID:604
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2092 -s 236
        5⤵
        Program crash
        
        PID:2052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1636.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1636.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2860
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2860 -s 224
        5⤵
        Program crash
        
        PID:4532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54439.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54439.exe
      4⤵
      PID:4396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9861.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9861.exe
      4⤵
      PID:5260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33538.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33538.exe
      4⤵
      PID:6572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28834.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28834.exe
      4⤵
      PID:7920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29684.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29684.exe
      4⤵
      PID:8660
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44978.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44978.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15182.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15182.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7370.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16318.exe
        6⤵
        
        PID:2908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14494.exe
        7⤵
        
        PID:284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45992.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4820
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 284 -s 248
        8⤵
        
        PID:6008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35928.exe
        7⤵
        
        PID:3448
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2908 -s 244
        7⤵
        Program crash
        
        PID:5032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37244.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14731.exe
        7⤵
        
        PID:3548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3819.exe
        8⤵
        
        PID:6892
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3548 -s 216
        8⤵
        
        PID:8152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58991.exe
        7⤵
        
        PID:4708
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1552 -s 224
        7⤵
        
        PID:5248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27734.exe
        6⤵
        
        PID:3772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12910.exe
        7⤵
        
        PID:8476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48268.exe
        7⤵
        
        PID:8268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12914.exe
        6⤵
        
        PID:5092
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1540 -s 224
        6⤵
        
        PID:5180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65061.exe
        5⤵
        
        PID:2964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6176.exe
        6⤵
        
        PID:332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54554.exe
        7⤵
        
        PID:4552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21660.exe
        7⤵
        
        PID:5348
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 332 -s 244
        7⤵
        
        PID:6552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60475.exe
        6⤵
        
        PID:4660
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2964 -s 244
        6⤵
        Program crash
        
        PID:5764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34088.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63156.exe
        6⤵
        
        PID:5904
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3068 -s 216
        6⤵
        
        PID:6616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49323.exe
        5⤵
        
        PID:4940
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2436 -s 244
        5⤵
        
        PID:5204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20561.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20561.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54968.exe
        5⤵
        
        PID:2832
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2832 -s 224
        6⤵
        Program crash
        
        PID:1928
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2764 -s 228
        5⤵
        Program crash
        
        PID:2660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47302.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47302.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28574.exe
        5⤵
        
        PID:1256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55909.exe
        6⤵
        
        PID:4872
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1256 -s 248
        6⤵
        
        PID:6120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1632.exe
        5⤵
        
        PID:4488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35396.exe
        5⤵
        
        PID:5364
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2440 -s 228
        5⤵
        
        PID:6684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42014.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42014.exe
      4⤵
      PID:1280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14822.exe
        5⤵
        
        PID:4596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39240.exe
        5⤵
        
        PID:5288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61510.exe
        5⤵
        
        PID:7828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10943.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23868.exe
        5⤵
        
        PID:8924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12567.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12567.exe
      4⤵
      PID:4476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16060.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16060.exe
      4⤵
      PID:5324
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1816 -s 240
      4⤵
      PID:6448
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17439.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17439.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7178.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7178.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55492.exe
        5⤵
        
        PID:2400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31402.exe
        6⤵
        
        PID:2952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34864.exe
        7⤵
        
        PID:4424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2074.exe
        7⤵
        
        PID:5996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1974.exe
        7⤵
        
        PID:7552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62702.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62306.exe
        7⤵
        
        PID:8980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52016.exe
        6⤵
        
        PID:4016
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2400 -s 244
        6⤵
        Program crash
        
        PID:5100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59284.exe
        5⤵
        
        PID:872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13966.exe
        6⤵
        
        PID:4624
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 872 -s 228
        6⤵
        
        PID:6508
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2852 -s 240
        5⤵
        Program crash
        
        PID:4156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28164.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28164.exe
      4⤵
      PID:3012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-84.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-84.exe
        5⤵
        
        PID:3188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59430.exe
        6⤵
        
        PID:5792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26147.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10049.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26558.exe
        6⤵
        
        PID:8716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40625.exe
        5⤵
        
        PID:4232
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3012 -s 224
        5⤵
        Program crash
        
        PID:5972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64099.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64099.exe
      4⤵
      PID:3320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40959.exe
        5⤵
        
        PID:6352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47775.exe
        5⤵
        
        PID:7780
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3320 -s 228
        5⤵
        
        PID:8244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58498.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58498.exe
      4⤵
      PID:4428
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1836 -s 244
      4⤵
      Program crash
      PID:5964
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49286.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49286.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16318.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16318.exe
      4⤵
      PID:1652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31106.exe
        5⤵
        
        PID:1668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64829.exe
        6⤵
        
        PID:4448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53949.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57339.exe
        6⤵
        
        PID:6520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63835.exe
        6⤵
        
        PID:7936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51820.exe
        6⤵
        
        PID:8464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20033.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57977.exe
        5⤵
        
        PID:4224
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1652 -s 248
        5⤵
        
        PID:6708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48521.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48521.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32757.exe
        5⤵
        
        PID:3140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5117.exe
        6⤵
        
        PID:5876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20796.exe
        6⤵
        
        PID:6192
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3140 -s 224
        6⤵
        
        PID:8048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14263.exe
        5⤵
        
        PID:4116
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2916 -s 244
        5⤵
        
        PID:6076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30274.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30274.exe
      4⤵
      PID:3228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44607.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44607.exe
      4⤵
      PID:4004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15526.exe
        5⤵
        
        PID:8940
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4004 -s 224
        5⤵
        
        PID:8388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6878.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6878.exe
      4⤵
      PID:4772
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2948 -s 236
      4⤵
      PID:5636
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59461.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59461.exe
    3⤵
    PID:2636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5740.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5740.exe
      4⤵
      PID:2556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31844.exe
        5⤵
        
        PID:5044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56646.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6148
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2556 -s 220
        5⤵
        
        PID:7736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52426.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52426.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4212
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2636 -s 240
      4⤵
      Program crash
      PID:4324
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28285.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28285.exe
    3⤵
    PID:1512
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1512 -s 244
      4⤵
      Program crash
      PID:4544
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51509.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51509.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4304
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15476.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15476.exe
    3⤵
    PID:5172
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32403.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32403.exe
    3⤵
    PID:6732
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5298.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5298.exe
    3⤵
    PID:7956
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49285.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49285.exe
    3⤵
    PID:8472
- C:\Users\Admin\AppData\Local\Temp\Unicorn-26677.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-26677.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2644
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28386.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28386.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34087.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34087.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53475.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2884
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2884 -s 240
        6⤵
        Program crash
        
        PID:968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50956.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2080
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2080 -s 220
        6⤵
        Program crash
        
        PID:2876
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2084 -s 244
        5⤵
        Program crash
        
        PID:2244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21440.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21440.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:932
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 932 -s 240
        5⤵
        Program crash
        
        PID:2972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32620.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32620.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29167.exe
        5⤵
        
        PID:1112
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1112 -s 240
        6⤵
        Program crash
        
        PID:2808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6622.exe
        5⤵
        
        PID:1484
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1484 -s 224
        6⤵
        Program crash
        
        PID:5152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6177.exe
        5⤵
        
        PID:4796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41505.exe
        5⤵
        
        PID:5820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45681.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5962.exe
        5⤵
        
        PID:8012
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1584 -s 244
        5⤵
        
        PID:8456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38077.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38077.exe
      4⤵
      PID:716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22892.exe
        5⤵
        
        PID:3432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49661.exe
        6⤵
        
        PID:7404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12733.exe
        6⤵
        
        PID:7988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20692.exe
        6⤵
        
        PID:8636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27662.exe
        5⤵
        
        PID:4568
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 716 -s 224
        5⤵
        
        PID:5212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42916.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42916.exe
      4⤵
      PID:3672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54459.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40818.exe
        5⤵
        
        PID:8400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59533.exe
        5⤵
        
        PID:8536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30635.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30635.exe
      4⤵
      PID:4924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15326.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15326.exe
      4⤵
      PID:6104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16082.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16082.exe
      4⤵
      PID:7192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63472.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63472.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64008.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64008.exe
      4⤵
      PID:8520
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22794.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22794.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3231.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3231.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11786.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31061.exe
        6⤵
        
        PID:2256
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2256 -s 224
        7⤵
        Program crash
        
        PID:3084
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2776 -s 248
        6⤵
        Program crash
        
        PID:4084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61133.exe
        5⤵
        
        PID:1176
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1176 -s 244
        6⤵
        Program crash
        
        PID:3200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15993.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38538.exe
        6⤵
        
        PID:4564
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3368 -s 228
        6⤵
        
        PID:6132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43999.exe
        5⤵
        
        PID:4460
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1660 -s 244
        5⤵
        
        PID:5228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25169.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25169.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21476.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38342.exe
        6⤵
        
        PID:1180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25635.exe
        7⤵
        
        PID:3840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51700.exe
        8⤵
        
        PID:8896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24834.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4104
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1180 -s 244
        7⤵
        
        PID:6000
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1428 -s 248
        6⤵
        Program crash
        
        PID:3220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32591.exe
        5⤵
        
        PID:2732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51141.exe
        6⤵
        
        PID:3624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21093.exe
        7⤵
        
        PID:8228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59394.exe
        6⤵
        
        PID:4260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52976.exe
        6⤵
        
        PID:2496
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2732 -s 236
        6⤵
        
        PID:7744
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2924 -s 240
        5⤵
        Program crash
        
        PID:4020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64821.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64821.exe
      4⤵
      Executes dropped EXE
      PID:916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58776.exe
        5⤵
        
        PID:2976
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2976 -s 224
        6⤵
        Program crash
        
        PID:5160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27994.exe
        5⤵
        
        PID:4744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34871.exe
        5⤵
        
        PID:5712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63204.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22497.exe
        5⤵
        
        PID:8040
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 916 -s 248
        5⤵
        
        PID:8676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50857.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50857.exe
      4⤵
      PID:2144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50742.exe
        5⤵
        
        PID:5216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43603.exe
        5⤵
        
        PID:6756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25297.exe
        5⤵
        
        PID:8064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60485.exe
        5⤵
        
        PID:8704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8753.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8753.exe
      4⤵
      PID:5012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63798.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63798.exe
      4⤵
      PID:6048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37613.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37613.exe
      4⤵
      PID:6740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18729.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18729.exe
      4⤵
      PID:8116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46102.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46102.exe
      4⤵
      PID:8352
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15824.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15824.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46021.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46021.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57859.exe
        5⤵
        
        PID:792
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 792 -s 244
        6⤵
        Program crash
        
        PID:3160
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 264 -s 248
        5⤵
        Program crash
        
        PID:3076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16896.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16896.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29456.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22503.exe
        6⤵
        
        PID:4516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34938.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32176.exe
        6⤵
        
        PID:7476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33512.exe
        6⤵
        
        PID:8184
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2040 -s 224
        6⤵
        
        PID:8684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36940.exe
        5⤵
        
        PID:3560
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2028 -s 224
        5⤵
        Program crash
        
        PID:5008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57368.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57368.exe
      4⤵
      PID:1944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21945.exe
        5⤵
        
        PID:4204
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1944 -s 248
        5⤵
        
        PID:6024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54045.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54045.exe
      4⤵
      PID:4148
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1952 -s 244
      4⤵
      Program crash
      PID:4952
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32435.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32435.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63323.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63323.exe
      4⤵
      PID:2980
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2980 -s 224
        5⤵
        Program crash
        
        PID:3168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25006.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25006.exe
      4⤵
      PID:3104
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3104 -s 224
        5⤵
        
        PID:8952
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 484 -s 220
      4⤵
      Program crash
      PID:4760
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6531.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6531.exe
    3⤵
    PID:2412
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2412 -s 224
      4⤵
      Program crash
      PID:3244
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19406.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19406.exe
    3⤵
    PID:4044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17063.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17063.exe
      4⤵
      PID:8880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48149.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48149.exe
      4⤵
      PID:8376
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7408.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7408.exe
    3⤵
    PID:4848
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29175.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29175.exe
    3⤵
    PID:5872
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32374.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32374.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:7836
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45679.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45679.exe
    3⤵
    PID:8260
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8397.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8397.exe
    3⤵
    PID:8696
- C:\Users\Admin\AppData\Local\Temp\Unicorn-32888.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-32888.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:608
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 608 -s 244
    3⤵
    - Loads dropped DLL
    - Program crash
    PID:2856
- C:\Users\Admin\AppData\Local\Temp\Unicorn-25374.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-25374.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:1740
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40320.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40320.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5092.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5092.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2292
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2292 -s 244
        5⤵
        Program crash
        
        PID:2676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59353.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59353.exe
      4⤵
      PID:2704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29231.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64736.exe
        6⤵
        
        PID:7388
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3476 -s 228
        6⤵
        
        PID:7980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61487.exe
        5⤵
        
        PID:4632
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2704 -s 244
        5⤵
        
        PID:6112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61751.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61751.exe
      4⤵
      PID:3716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14803.exe
        5⤵
        
        PID:4680
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3716 -s 228
        5⤵
        Program crash
        
        PID:5752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16842.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16842.exe
      4⤵
      PID:4908
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1708 -s 244
      4⤵
      PID:5236
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38210.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38210.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2508
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2508 -s 224
      4⤵
      Program crash
      PID:2156
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9331.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9331.exe
    3⤵
    PID:2212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44322.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44322.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19943.exe
        5⤵
        
        PID:8972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58948.exe
        5⤵
        
        PID:4184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11978.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11978.exe
      4⤵
      PID:4988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2706.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2706.exe
      4⤵
      PID:5280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1838.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1838.exe
      4⤵
      PID:7788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2278.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2278.exe
      4⤵
      PID:8196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7333.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7333.exe
      4⤵
      PID:9092
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37145.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37145.exe
    3⤵
    PID:3568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30471.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30471.exe
      4⤵
      PID:8892
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45721.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45721.exe
    3⤵
    PID:3376
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33640.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33640.exe
    3⤵
    PID:2116
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59240.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59240.exe
    3⤵
    PID:7772
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46814.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46814.exe
    3⤵
    PID:8284
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63070.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63070.exe
    3⤵
    PID:8992
- C:\Users\Admin\AppData\Local\Temp\Unicorn-64638.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-64638.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1260
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25020.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25020.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15461.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15461.exe
      4⤵
      PID:1320
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1320 -s 244
        5⤵
        Program crash
        
        PID:3112
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2176 -s 248
      4⤵
      Program crash
      PID:3148
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9327.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9327.exe
    3⤵
    PID:1628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44872.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44872.exe
      4⤵
      PID:3128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60230.exe
        5⤵
        
        PID:4904
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3128 -s 228
        5⤵
        
        PID:6588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61480.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61480.exe
      4⤵
      PID:4764
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1628 -s 224
      4⤵
      PID:5944
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38742.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38742.exe
    3⤵
    PID:4064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28991.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28991.exe
      4⤵
      PID:9084
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15543.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15543.exe
    3⤵
    PID:4792
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50176.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50176.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5932
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42174.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42174.exe
    3⤵
    PID:7796
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2808.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2808.exe
    3⤵
    PID:8252
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37268.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37268.exe
    3⤵
    PID:8688
- C:\Users\Admin\AppData\Local\Temp\Unicorn-45573.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-45573.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2872
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44984.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44984.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28574.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28574.exe
      4⤵
      PID:2044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13966.exe
        5⤵
        
        PID:4588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-144.exe
        5⤵
        
        PID:6500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30731.exe
        5⤵
        
        PID:7968
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2044 -s 228
        5⤵
        
        PID:8304
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 652 -s 248
      4⤵
      Program crash
      PID:4508
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41764.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41764.exe
    3⤵
    PID:2248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58099.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58099.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57546.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57546.exe
      4⤵
      PID:5772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39883.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39883.exe
      4⤵
      PID:7184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31566.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31566.exe
      4⤵
      PID:6744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17892.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17892.exe
      4⤵
      PID:8652
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15367.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15367.exe
    3⤵
    PID:4496
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41261.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41261.exe
    3⤵
    PID:5336
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2872 -s 244
    3⤵
    PID:6480
- C:\Users\Admin\AppData\Local\Temp\Unicorn-51275.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-51275.exe
  2⤵
  PID:1980
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47788.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47788.exe
    3⤵
    PID:3588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28559.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28559.exe
      4⤵
      PID:7656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56880.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56880.exe
      4⤵
      PID:8204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26668.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26668.exe
      4⤵
      PID:9068
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26126.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26126.exe
    3⤵
    PID:4788
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1980 -s 244
    3⤵
    PID:5948
- C:\Users\Admin\AppData\Local\Temp\Unicorn-31256.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-31256.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3808
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47124.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47124.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1968
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15792.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15792.exe
    3⤵
    PID:9028
- C:\Users\Admin\AppData\Local\Temp\Unicorn-24125.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-24125.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3848
- C:\Users\Admin\AppData\Local\Temp\Unicorn-58198.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-58198.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6092
- C:\Users\Admin\AppData\Local\Temp\Unicorn-52748.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-52748.exe
  2⤵
  PID:7176
- C:\Users\Admin\AppData\Local\Temp\Unicorn-37195.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-37195.exe
  2⤵
  PID:2060
- C:\Users\Admin\AppData\Local\Temp\Unicorn-19767.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-19767.exe
  2⤵
  PID:9032

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-11771.exe

Filesize
468KB

MD5
478cc3a9b1c42f6c8984e29a1a3b99b9

SHA1
3c5f92755e6af506574752edd66328bc52d884df

SHA256
1af39dc158780a511ba73dbc6651028feb60930ef42da3b9531a342c863240f7

SHA512
2878eb85e62d9a813939efe1a2a059dbb8ced1c9e5cc554bdb07c144859a14bda60807c40470e6c917f73067a32267c407a846768526b3efc6322ed142be6f1c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-30797.exe

Filesize
468KB

MD5
a9e843c3f757c15f87d9b7abaabd9abe

SHA1
a9d5b9789b4ac8216fec916ebed2be7024bc599e

SHA256
0a29a8103bcc79e828984691c53c1b1ef58e5b670cfc109421e915c3213f7b43

SHA512
04cb7f75676505d1a780fcb250f25143caea08f7c7b7100480b11388ae68b7339bc0748f20b9f6951fcd7f58e2971eaad8803eb74701c74f2e8587158f22f042

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-34087.exe

Filesize
468KB

MD5
889fa5a47bc7de1c48e728e4aa38f112

SHA1
72ec503a32e87c5ba93e2b4e14020a3fa46c28f0

SHA256
7cf6b94c0202369d34db9fd045ddb94359ec09b4626fe007ff27fb00e2bdd10f

SHA512
a3bb3f26a6d3cebcbb18d19c4f75c1bab0ea34708c95201c27ef5c56926b301e6afb89497ec1dd6c874c0e76350dafc210ad842160f2819a378ee42321eb634a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-44612.exe

Filesize
468KB

MD5
8c574f26faedefc07646f970e8b0c673

SHA1
fc254c71951c470ba27165806b21bb6c35ef7525

SHA256
48e89a2ad27e1c1bbe6de0f8f157c057c6a25dc49635e214fbb520318e3669ae

SHA512
6e9617b3db7088839b1f37dda393af84765ee311a56b4254770410d9bf0271e79ac8204061ad776b03f9897910da564d631cb5ef7c90012dedc29003711984cd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-44978.exe

Filesize
468KB

MD5
68c94e259b38c5eef5ae23a1f7c4db3e

SHA1
80f71190fc32e88e661041c4549c80655171307a

SHA256
5d70c6ab73e2993f1d1a0e8e7914a6aaccec15a14d9449632a6dc59a0032f465

SHA512
ebf92fb505d45eab53274a07c3dde159ebf423fa3a509e5fa0e0283b9b28b896aa9ecf5cf353c7ab10e7da5a2f5a028bb9cf7a8b65a8f4252a130cb8a463681a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-54706.exe

Filesize
468KB

MD5
7e32035cc4cece001842987d8cfe6f7e

SHA1
a02a56bda09a1f6534246721df3c311236be8f8e

SHA256
b00e0e390fcfc51908600281b86c1fc109e015e596a119fc8da206149da728cc

SHA512
b09e75a1cdf907888e2a7552b2c5d8d838ec339d45d237f31d7e9dd9f217dc26cbeeae54c6f5c9889191f20b9dc00fc91423fb0c4a11446ad2936c940de0901b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-55909.exe

Filesize
468KB

MD5
33a31c09e85609c0f5c9552e6587b139

SHA1
d03e3f635c16ca16964a20c4b3b78260dff1cd2b

SHA256
eaa840099ff7400de994a7be50e2892ac2c85201d87119f91ba4baca1dc0bc47

SHA512
d22757eb3d89b649160e4545d24e7e2cb76a4c33dbc868a463eeff422de8610331d152650d945291d693b96e0a020137cf8aeb77bcb8a5471709b9fbf4ee4e53

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5740.exe

Filesize
468KB

MD5
7351306547775defa8bb869068e55c52

SHA1
b7969d3cb6534e79a53d42ec277fd29bda6858a1

SHA256
304ee2388b29dea9381a395bd9c802df18b06f3256362d0d7624b11a2d66d618

SHA512
f96f5a245865c279ab5fada1d447b8ad9567f7a216fd2cb244ba5097b2160a629242d5648af2676a9c4f84c4e5ab2efc6e20f70600fdc8aef55e4efa23170e74

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5773.exe

Filesize
468KB

MD5
8588c18f26cf0a9708476a3d84ce60a0

SHA1
286dfdb120f947cb498144df81a872da9028a4bc

SHA256
872c475e1e20b77f79fc742f690b4795fbae60abe27760e3c492cecd715b6bc6

SHA512
0a9fbabf476cf8371852e5141c19e48f206e8a02dc2d1de80627a2288a7d2033785dd7227ffbd661834c7932ecf153be556da82c1a1fe25d7de2074643dfd4e1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-59353.exe

Filesize
468KB

MD5
4b05d989d075b2fa86b1e4ac18fbcda4

SHA1
3d13104470752296483b39ad7ffe79a639393fae

SHA256
e12167f7f0cba5531cdf6fd307b654546189ec9a0f1e98a65a85286ef89d0ecf

SHA512
a50973a0dc1eca75103679e4b30bcc8e677deb9f3622070c85300914316a50bc37dce95d446a11279f99c0f1b8e18a397402f0adb5c21b3af5f6f8ac64800ccd

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-10117.exe

Filesize
468KB

MD5
93a089f6f167b9d97daac41174c14995

SHA1
50152c6e76882d23e1a592745ee6b6711cb0b13f

SHA256
14bb0470b714b1ff4511ff1aa10420b8bff227ce54c9d0c674301ac4970d2211

SHA512
d710caf1a65786966811dbfacdcadaac23b5a291e2806b519f2df97ffa556bab834e2b361c7228ee6af58f3166c3b76672c538a5219dff7635dcca453e483c64

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-15182.exe

Filesize
468KB

MD5
4b15a93a0fe5d421b68e8b761143e03d

SHA1
b141342c40d32f9b469b34e04525f46afe5dd70e

SHA256
d617c0421a99c9777ec1efed00a43e0fdbecfc5640a96d07a672e89c4eb87ce1

SHA512
7a6b54737e07ebc648ab561ae9055e2eb74c9a019910a66bb4586828015cbc3cee586167fbf522b58ab532bcbad8ea7864200ba15b47fe47c054ff42ecb28611

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-22794.exe

Filesize
468KB

MD5
9897543f885bce0a8fdbb0b86452bd93

SHA1
c6307534cfa56e48d6cd136d2939c0d3190ca9db

SHA256
3fdf6a55c3cbbcba21726db0a8417716d955d66a8ab506b276ddd0f7dbccfb76

SHA512
7ca7e3b058075087e78e89b21fd59159c9a6c817c1fcf5fe03c4fa49c67869cd986703058ff00717bcecdeeb0a2c7e089b40f59f87bdc4a76f1ea00b6e84bfe1

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-25374.exe

Filesize
468KB

MD5
800e7c43b3875c45971c2b8a1e1666d4

SHA1
e0910265734f19a20aacbdfd961012f2216d64bc

SHA256
1cca2d64a013cb43ee5ef33b20ebde66cb131e9379fe9b95f246933aec4fd117

SHA512
acc1310e7e4730fa77566726f29100eaecf89425217bee647a779e2a5ab5aa3a539d3be09433947d5f16fe84f83059e2efdfc771fb1be553bde5c1aab0f14e09

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-26677.exe

Filesize
468KB

MD5
645a354504075fd9cd7b239e19964787

SHA1
33f15101ff0959db300b762b32b57b38c9852647

SHA256
16037e55495da8cac1a38b115344220524ced670e9464405683e114032f42c2a

SHA512
0a07ebf7dbe7d65296fb421dc11d27c4560f314904d63c764d1f697d6491dc8ab8f67c96f02745617b89626f17ca62e4889fe7dee7e7146eab29a68a325f2c12

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-28386.exe

Filesize
468KB

MD5
414a34ea0db153f7a424453492ae2e5b

SHA1
e0e892db7e802ad3d4d9b10d157c5093a808c714

SHA256
ec75d65dbb4b883073dbcc21493bbb3c5a6b016a3927f0161fd5176632cc6689

SHA512
40f065b633fc1f741c99e18ee857519b3482c3500b1e2d5d32386e6115a6eaf699f453625e8a3d0bb9d2558acb6d25e74401a43b506ddec311654f4e2d4f307c

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-31276.exe

Filesize
468KB

MD5
84d121bd97f070395ea1028b08b1141b

SHA1
6e6cbd5f057d9620dff4c2371199da0c83f32bf3

SHA256
dedbb588ee7bc81849988a05e829a7e7e611558d678a41d45e6218f84605f883

SHA512
057ff685fb6edf1caa0a50cf757e2164ca339e50a147aed05b537c4274233fa5c31560ce50d71380391ddf72d504704bf9b52ad8ffe7ab493d1732c5af64dd39

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-32888.exe

Filesize
468KB

MD5
45e6fc3bff3e38b42a754cfd7900ec7f

SHA1
0828c9ee7fb1b0dfd033278ddb507ea78cf229a8

SHA256
69fe3c2d8028875f504e8678afd05c42caf73e683fac06df427420719cd025ea

SHA512
b6c0322364ad7a37f3c8566e709fd7615ab723126428d1728bfd1c1bb2a3faad9cfdd00f6538d35e7d5d86e750f6b4bd7a7e81307123120c6f29f57bcc3cde32

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-3765.exe

Filesize
468KB

MD5
febd0f618fb849910f74ef9b46fb15d0

SHA1
f44551c5ec7d42b71e3d2696f2a74aecdfcef211

SHA256
4b0a643ad116e9b5342c27d9d95599e229ccc1bf753c03fdece12135d2ab9129

SHA512
69216dc8a72ef7079076b3f89724946750c07a13889e25916725617d43a0124ab1896ad7ec37b57fa0a184d5df31a9784a889dded0a14a53ae2be29a66dde716

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-42660.exe

Filesize
468KB

MD5
9c50c7efdf182f3eb59fd87c9b5a3754

SHA1
3fceb22894de8c575991fd61e4bd3b7dadaf7042

SHA256
aa7b79a730c7eb2a5a4f2eadd62fd1c3102525a0fa591a6337dae754bd6cb2f6

SHA512
6d1380f05bfc21fa519cbff03ccb12eebda1a19b565c704647a867cd476232256679907382105130d50fb7c31370926c160f4f127de7763006b99a68626449a1

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-60674.exe

Filesize
468KB

MD5
31a620cf0a41ae4b0100151cca60ade4

SHA1
b4d97018353d69777b48809a1da40c220881a55b

SHA256
7dda23239db5afe0bffc3194f4b861e6dd0b16a59a554a70e1eb573d843e90a8

SHA512
d5b871db6d6df7d82ef0fc7040fd5e6d04aae1bf9d0094e57b15beac730befd3c74c21bbcb40200849ad06b560434246fea6804d328da09320fa404aab296cbe

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-7549.exe

Filesize
468KB

MD5
021468ffbada44dc64cd0bc7c71247fd

SHA1
860dc7b352c58ba724bfa7e8d58f217446be09da

SHA256
0ee03f46768c7248d01cae8b674d3f3e02ba914be355462d1f77e34f30b030d7

SHA512
9d47fa812a869273383ef7f1ec651d21f212e0efc4f9a4535c346fd13ba0325bd01479140fcdd9646a2b32cf5a2f9814cdcf23a8a1e14c049f36cc7237fc43e0

Download Submit