cdab4eaee38a7ed60f57b1c7df0854df8b0a7dea18f66b1b0f247dd35846c168

Analysis

max time kernel
150s
max time network
121s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
19/09/2024, 02:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cdab4eaee38a7ed60f57b1c7df0854df8b0a7dea18f66b1b0f247dd35846c168.exe
Size

468KB
MD5

d93eb30259714ab924f348f654c699bb
SHA1

cdf3a69e60c2b1e04305803313316674f3c906b0
SHA256

cdab4eaee38a7ed60f57b1c7df0854df8b0a7dea18f66b1b0f247dd35846c168
SHA512

9b6934e70c12e2c886d24fa634a21a05ae191150361f09a52857624835c8f6879375e612a01c19f14a77e3f6bf7d63b8f680fd69eaea1cfadce79ace1193373c
SSDEEP

3072:1G3HoggSI45TtbY2HzcOcf8/zDcaP0pkJVHeTVPyQjCLv7gKEslL:1G3oz4TtxH4OcfaY10QjEzgKE

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2672	Unicorn-52168.exe
2704	Unicorn-42729.exe
2108	Unicorn-23055.exe
2728	Unicorn-14950.exe
1844	Unicorn-43408.exe
2780	Unicorn-21591.exe
1856	Unicorn-48007.exe
448	Unicorn-47403.exe
2964	Unicorn-52338.exe
2096	Unicorn-24456.exe
2140	Unicorn-24648.exe
2384	Unicorn-4782.exe
2928	Unicorn-51574.exe
2892	Unicorn-57704.exe
2376	Unicorn-24959.exe
380	Unicorn-52297.exe
2204	Unicorn-65488.exe
1256	Unicorn-9806.exe
2164	Unicorn-22997.exe
1360	Unicorn-27046.exe
1944	Unicorn-7502.exe
1644	Unicorn-39229.exe
2320	Unicorn-56826.exe
2992	Unicorn-63148.exe
1696	Unicorn-43055.exe
1532	Unicorn-23189.exe
2276	Unicorn-40978.exe
2472	Unicorn-60844.exe
2388	Unicorn-8939.exe
1660	Unicorn-52682.exe
2396	Unicorn-131.exe
2292	Unicorn-46379.exe
1564	Unicorn-707.exe
2764	Unicorn-57810.exe
2700	Unicorn-12108.exe
2812	Unicorn-11978.exe
2584	Unicorn-64900.exe
2784	Unicorn-29331.exe
2596	Unicorn-49197.exe
3028	Unicorn-47121.exe
1012	Unicorn-1449.exe
2004	Unicorn-58744.exe
1504	Unicorn-46099.exe
1952	Unicorn-37136.exe
1960	Unicorn-24714.exe
2860	Unicorn-36342.exe
2228	Unicorn-16249.exe
2284	Unicorn-36115.exe
2868	Unicorn-21158.exe
1520	Unicorn-26006.exe
1836	Unicorn-61055.exe
2352	Unicorn-61055.exe
2092	Unicorn-421.exe
2120	Unicorn-12949.exe
3000	Unicorn-6819.exe
944	Unicorn-14578.exe
2000	Unicorn-8713.exe
1540	Unicorn-53707.exe
1732	Unicorn-33841.exe
3060	Unicorn-51439.exe
1812	Unicorn-65174.exe
2464	Unicorn-64594.exe
1528	Unicorn-4231.exe
1036	Unicorn-26318.exe

Loads dropped DLL 64 IoCs

pid	Process
2640	cdab4eaee38a7ed60f57b1c7df0854df8b0a7dea18f66b1b0f247dd35846c168.exe
2640	cdab4eaee38a7ed60f57b1c7df0854df8b0a7dea18f66b1b0f247dd35846c168.exe
2672	Unicorn-52168.exe
2672	Unicorn-52168.exe
2640	cdab4eaee38a7ed60f57b1c7df0854df8b0a7dea18f66b1b0f247dd35846c168.exe
2640	cdab4eaee38a7ed60f57b1c7df0854df8b0a7dea18f66b1b0f247dd35846c168.exe
2704	Unicorn-42729.exe
2704	Unicorn-42729.exe
2672	Unicorn-52168.exe
2672	Unicorn-52168.exe
2108	Unicorn-23055.exe
2640	cdab4eaee38a7ed60f57b1c7df0854df8b0a7dea18f66b1b0f247dd35846c168.exe
2108	Unicorn-23055.exe
2640	cdab4eaee38a7ed60f57b1c7df0854df8b0a7dea18f66b1b0f247dd35846c168.exe
2728	Unicorn-14950.exe
2728	Unicorn-14950.exe
2704	Unicorn-42729.exe
2704	Unicorn-42729.exe
1856	Unicorn-48007.exe
1856	Unicorn-48007.exe
2108	Unicorn-23055.exe
2108	Unicorn-23055.exe
1844	Unicorn-43408.exe
1844	Unicorn-43408.exe
2780	Unicorn-21591.exe
2672	Unicorn-52168.exe
2672	Unicorn-52168.exe
2640	cdab4eaee38a7ed60f57b1c7df0854df8b0a7dea18f66b1b0f247dd35846c168.exe
2640	cdab4eaee38a7ed60f57b1c7df0854df8b0a7dea18f66b1b0f247dd35846c168.exe
2780	Unicorn-21591.exe
448	Unicorn-47403.exe
448	Unicorn-47403.exe
2728	Unicorn-14950.exe
2728	Unicorn-14950.exe
2140	Unicorn-24648.exe
2140	Unicorn-24648.exe
1844	Unicorn-43408.exe
1844	Unicorn-43408.exe
2964	Unicorn-52338.exe
2964	Unicorn-52338.exe
2384	Unicorn-4782.exe
2384	Unicorn-4782.exe
2108	Unicorn-23055.exe
2108	Unicorn-23055.exe
2704	Unicorn-42729.exe
2704	Unicorn-42729.exe
2096	Unicorn-24456.exe
2096	Unicorn-24456.exe
1856	Unicorn-48007.exe
1856	Unicorn-48007.exe
2892	Unicorn-57704.exe
2892	Unicorn-57704.exe
2780	Unicorn-21591.exe
2376	Unicorn-24959.exe
2780	Unicorn-21591.exe
2376	Unicorn-24959.exe
976	WerFault.exe
976	WerFault.exe
976	WerFault.exe
976	WerFault.exe
2672	Unicorn-52168.exe
2672	Unicorn-52168.exe
2640	cdab4eaee38a7ed60f57b1c7df0854df8b0a7dea18f66b1b0f247dd35846c168.exe
2640	cdab4eaee38a7ed60f57b1c7df0854df8b0a7dea18f66b1b0f247dd35846c168.exe

Program crash 64 IoCs

pid	pid_target	Process	procid_target
976	2928	WerFault.exe	43
2356	2472	WerFault.exe	58
2172	2388	WerFault.exe	59
2232	2276	WerFault.exe	57
1092	2584	WerFault.exe	67
2192	1564	WerFault.exe	63
1864	2292	WerFault.exe	62
2664	2228	WerFault.exe	79
1076	2092	WerFault.exe	85
2620	1504	WerFault.exe	73
2932	2352	WerFault.exe	84
2632	1528	WerFault.exe	99
1876	1236	WerFault.exe	101
2180	2132	WerFault.exe	116
1320	2464	WerFault.exe	98
1676	1360	WerFault.exe	49
2912	2596	WerFault.exe	69
3132	2732	WerFault.exe	131
3300	628	WerFault.exe	137
3632	2504	WerFault.exe	146
3272	1784	WerFault.exe	140
3296	2200	WerFault.exe	141
3568	2436	WerFault.exe	118
3180	2796	WerFault.exe	103
3212	1812	WerFault.exe	97
3492	2700	WerFault.exe	65
3728	2612	WerFault.exe	155
3700	2720	WerFault.exe	157
3744	2324	WerFault.exe	148
3772	1368	WerFault.exe	152
3852	3060	WerFault.exe	96
4016	1732	WerFault.exe	94
3144	2008	WerFault.exe	112
3548	3028	WerFault.exe	70
3808	3224	WerFault.exe	188
3100	544	WerFault.exe	161
4112	2896	WerFault.exe	163
4104	2576	WerFault.exe	104
4200	3024	WerFault.exe	156
4192	580	WerFault.exe	178
4184	3392	WerFault.exe	192
4176	1808	WerFault.exe	158
4480	1560	WerFault.exe	125
4988	2724	WerFault.exe	110
4972	2272	WerFault.exe	121
5096	2680	WerFault.exe	126
920	2860	WerFault.exe	77
4292	2764	WerFault.exe	64
4288	1696	WerFault.exe	55
4432	2148	WerFault.exe	135
4436	2420	WerFault.exe	133
4612	2836	WerFault.exe	132
4632	3068	WerFault.exe	105
5380	1736	WerFault.exe	159
5360	572	WerFault.exe	160
5396	1532	WerFault.exe	54
5388	1520	WerFault.exe	82
5416	2920	WerFault.exe	107
5440	2312	WerFault.exe	145
6088	2164	WerFault.exe	48
6128	2376	WerFault.exe	44
6112	2004	WerFault.exe	72
6104	3000	WerFault.exe	86
6136	1256	WerFault.exe	47

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49197.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7996.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18115.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6595.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57436.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9119.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52338.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25325.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29916.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58555.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44330.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29817.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15534.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11100.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64440.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52168.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56826.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1417.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49086.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45585.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49268.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4599.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8320.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64400.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59702.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53235.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49391.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12108.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30832.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58570.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17645.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37462.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21663.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22429.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22688.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63455.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56825.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21591.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5324.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37840.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15696.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65182.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58840.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13875.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39219.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64442.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31104.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4094.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52448.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55059.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1708.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52197.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65096.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33024.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24482.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4442.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56621.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56934.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4589.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40608.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15166.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6819.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6761.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47744.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2640	cdab4eaee38a7ed60f57b1c7df0854df8b0a7dea18f66b1b0f247dd35846c168.exe
2672	Unicorn-52168.exe
2704	Unicorn-42729.exe
2108	Unicorn-23055.exe
2728	Unicorn-14950.exe
1844	Unicorn-43408.exe
1856	Unicorn-48007.exe
2780	Unicorn-21591.exe
448	Unicorn-47403.exe
2140	Unicorn-24648.exe
2384	Unicorn-4782.exe
2964	Unicorn-52338.exe
2928	Unicorn-51574.exe
2096	Unicorn-24456.exe
2892	Unicorn-57704.exe
2376	Unicorn-24959.exe
380	Unicorn-52297.exe
2204	Unicorn-65488.exe
1256	Unicorn-9806.exe
2164	Unicorn-22997.exe
1360	Unicorn-27046.exe
1944	Unicorn-7502.exe
2320	Unicorn-56826.exe
2992	Unicorn-63148.exe
1644	Unicorn-39229.exe
1696	Unicorn-43055.exe
1532	Unicorn-23189.exe
2472	Unicorn-60844.exe
2276	Unicorn-40978.exe
1660	Unicorn-52682.exe
2388	Unicorn-8939.exe
2396	Unicorn-131.exe
1564	Unicorn-707.exe
2764	Unicorn-57810.exe
2700	Unicorn-12108.exe
2812	Unicorn-11978.exe
2584	Unicorn-64900.exe
2596	Unicorn-49197.exe
2784	Unicorn-29331.exe
1012	Unicorn-1449.exe
3028	Unicorn-47121.exe
2004	Unicorn-58744.exe
1504	Unicorn-46099.exe
1952	Unicorn-37136.exe
2860	Unicorn-36342.exe
1960	Unicorn-24714.exe
2284	Unicorn-36115.exe
2228	Unicorn-16249.exe
2868	Unicorn-21158.exe
1520	Unicorn-26006.exe
1836	Unicorn-61055.exe
2352	Unicorn-61055.exe
2092	Unicorn-421.exe
2120	Unicorn-12949.exe
3000	Unicorn-6819.exe
2000	Unicorn-8713.exe
944	Unicorn-14578.exe
1732	Unicorn-33841.exe
3060	Unicorn-51439.exe
1812	Unicorn-65174.exe
1540	Unicorn-53707.exe
2464	Unicorn-64594.exe
1528	Unicorn-4231.exe
1236	Unicorn-26318.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2640 wrote to memory of 2672	2640	cdab4eaee38a7ed60f57b1c7df0854df8b0a7dea18f66b1b0f247dd35846c168.exe	30
PID 2640 wrote to memory of 2672	2640	cdab4eaee38a7ed60f57b1c7df0854df8b0a7dea18f66b1b0f247dd35846c168.exe	30
PID 2640 wrote to memory of 2672	2640	cdab4eaee38a7ed60f57b1c7df0854df8b0a7dea18f66b1b0f247dd35846c168.exe	30
PID 2640 wrote to memory of 2672	2640	cdab4eaee38a7ed60f57b1c7df0854df8b0a7dea18f66b1b0f247dd35846c168.exe	30
PID 2672 wrote to memory of 2704	2672	Unicorn-52168.exe	31
PID 2672 wrote to memory of 2704	2672	Unicorn-52168.exe	31
PID 2672 wrote to memory of 2704	2672	Unicorn-52168.exe	31
PID 2672 wrote to memory of 2704	2672	Unicorn-52168.exe	31
PID 2640 wrote to memory of 2108	2640	cdab4eaee38a7ed60f57b1c7df0854df8b0a7dea18f66b1b0f247dd35846c168.exe	32
PID 2640 wrote to memory of 2108	2640	cdab4eaee38a7ed60f57b1c7df0854df8b0a7dea18f66b1b0f247dd35846c168.exe	32
PID 2640 wrote to memory of 2108	2640	cdab4eaee38a7ed60f57b1c7df0854df8b0a7dea18f66b1b0f247dd35846c168.exe	32
PID 2640 wrote to memory of 2108	2640	cdab4eaee38a7ed60f57b1c7df0854df8b0a7dea18f66b1b0f247dd35846c168.exe	32
PID 2704 wrote to memory of 2728	2704	Unicorn-42729.exe	33
PID 2704 wrote to memory of 2728	2704	Unicorn-42729.exe	33
PID 2704 wrote to memory of 2728	2704	Unicorn-42729.exe	33
PID 2704 wrote to memory of 2728	2704	Unicorn-42729.exe	33
PID 2672 wrote to memory of 1844	2672	Unicorn-52168.exe	34
PID 2672 wrote to memory of 1844	2672	Unicorn-52168.exe	34
PID 2672 wrote to memory of 1844	2672	Unicorn-52168.exe	34
PID 2672 wrote to memory of 1844	2672	Unicorn-52168.exe	34
PID 2108 wrote to memory of 1856	2108	Unicorn-23055.exe	35
PID 2108 wrote to memory of 1856	2108	Unicorn-23055.exe	35
PID 2108 wrote to memory of 1856	2108	Unicorn-23055.exe	35
PID 2108 wrote to memory of 1856	2108	Unicorn-23055.exe	35
PID 2640 wrote to memory of 2780	2640	cdab4eaee38a7ed60f57b1c7df0854df8b0a7dea18f66b1b0f247dd35846c168.exe	36
PID 2640 wrote to memory of 2780	2640	cdab4eaee38a7ed60f57b1c7df0854df8b0a7dea18f66b1b0f247dd35846c168.exe	36
PID 2640 wrote to memory of 2780	2640	cdab4eaee38a7ed60f57b1c7df0854df8b0a7dea18f66b1b0f247dd35846c168.exe	36
PID 2640 wrote to memory of 2780	2640	cdab4eaee38a7ed60f57b1c7df0854df8b0a7dea18f66b1b0f247dd35846c168.exe	36
PID 2728 wrote to memory of 448	2728	Unicorn-14950.exe	37
PID 2728 wrote to memory of 448	2728	Unicorn-14950.exe	37
PID 2728 wrote to memory of 448	2728	Unicorn-14950.exe	37
PID 2728 wrote to memory of 448	2728	Unicorn-14950.exe	37
PID 2704 wrote to memory of 2964	2704	Unicorn-42729.exe	38
PID 2704 wrote to memory of 2964	2704	Unicorn-42729.exe	38
PID 2704 wrote to memory of 2964	2704	Unicorn-42729.exe	38
PID 2704 wrote to memory of 2964	2704	Unicorn-42729.exe	38
PID 1856 wrote to memory of 2096	1856	Unicorn-48007.exe	39
PID 1856 wrote to memory of 2096	1856	Unicorn-48007.exe	39
PID 1856 wrote to memory of 2096	1856	Unicorn-48007.exe	39
PID 1856 wrote to memory of 2096	1856	Unicorn-48007.exe	39
PID 2108 wrote to memory of 2384	2108	Unicorn-23055.exe	40
PID 2108 wrote to memory of 2384	2108	Unicorn-23055.exe	40
PID 2108 wrote to memory of 2384	2108	Unicorn-23055.exe	40
PID 2108 wrote to memory of 2384	2108	Unicorn-23055.exe	40
PID 1844 wrote to memory of 2140	1844	Unicorn-43408.exe	41
PID 1844 wrote to memory of 2140	1844	Unicorn-43408.exe	41
PID 1844 wrote to memory of 2140	1844	Unicorn-43408.exe	41
PID 1844 wrote to memory of 2140	1844	Unicorn-43408.exe	41
PID 2672 wrote to memory of 2928	2672	Unicorn-52168.exe	43
PID 2672 wrote to memory of 2928	2672	Unicorn-52168.exe	43
PID 2672 wrote to memory of 2928	2672	Unicorn-52168.exe	43
PID 2672 wrote to memory of 2928	2672	Unicorn-52168.exe	43
PID 2640 wrote to memory of 2376	2640	cdab4eaee38a7ed60f57b1c7df0854df8b0a7dea18f66b1b0f247dd35846c168.exe	44
PID 2640 wrote to memory of 2376	2640	cdab4eaee38a7ed60f57b1c7df0854df8b0a7dea18f66b1b0f247dd35846c168.exe	44
PID 2640 wrote to memory of 2376	2640	cdab4eaee38a7ed60f57b1c7df0854df8b0a7dea18f66b1b0f247dd35846c168.exe	44
PID 2640 wrote to memory of 2376	2640	cdab4eaee38a7ed60f57b1c7df0854df8b0a7dea18f66b1b0f247dd35846c168.exe	44
PID 2780 wrote to memory of 2892	2780	Unicorn-21591.exe	42
PID 2780 wrote to memory of 2892	2780	Unicorn-21591.exe	42
PID 2780 wrote to memory of 2892	2780	Unicorn-21591.exe	42
PID 2780 wrote to memory of 2892	2780	Unicorn-21591.exe	42
PID 448 wrote to memory of 380	448	Unicorn-47403.exe	45
PID 448 wrote to memory of 380	448	Unicorn-47403.exe	45
PID 448 wrote to memory of 380	448	Unicorn-47403.exe	45
PID 448 wrote to memory of 380	448	Unicorn-47403.exe	45

C:\Users\Admin\AppData\Local\Temp\cdab4eaee38a7ed60f57b1c7df0854df8b0a7dea18f66b1b0f247dd35846c168.exe
"C:\Users\Admin\AppData\Local\Temp\cdab4eaee38a7ed60f57b1c7df0854df8b0a7dea18f66b1b0f247dd35846c168.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2640
- C:\Users\Admin\AppData\Local\Temp\Unicorn-52168.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-52168.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2672
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42729.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42729.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14950.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14950.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47403.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52297.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-131.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53707.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35024.exe
        9⤵
        
        PID:1940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60143.exe
        10⤵
        
        PID:3660
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1940 -s 232
        10⤵
        
        PID:5528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18004.exe
        9⤵
        
        PID:3956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62308.exe
        9⤵
        
        PID:5508
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1540 -s 244
        9⤵
        
        PID:6316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3420.exe
        8⤵
        
        PID:2612
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2612 -s 220
        9⤵
        Program crash
        
        PID:3728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54013.exe
        8⤵
        
        PID:3280
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2396 -s 232
        8⤵
        
        PID:5476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51439.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63519.exe
        8⤵
        
        PID:1124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25380.exe
        9⤵
        
        PID:4644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22688.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:5596
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1124 -s 220
        9⤵
        
        PID:6908
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3060 -s 212
        8⤵
        Program crash
        
        PID:3852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57555.exe
        7⤵
        
        PID:2460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-374.exe
        8⤵
        
        PID:5880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60961.exe
        8⤵
        
        PID:6540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18238.exe
        8⤵
        
        PID:1920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22700.exe
        8⤵
        
        PID:8756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36963.exe
        8⤵
        
        PID:9192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42145.exe
        8⤵
        
        PID:6456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-558.exe
        7⤵
        
        PID:3364
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 380 -s 240
        7⤵
        
        PID:5124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46379.exe
        6⤵
        Executes dropped EXE
        
        PID:2292
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2292 -s 220
        7⤵
        Program crash
        
        PID:1864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65174.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6238.exe
        7⤵
        
        PID:572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48529.exe
        8⤵
        
        PID:3824
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 572 -s 232
        8⤵
        Program crash
        
        PID:5360
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1812 -s 244
        7⤵
        Program crash
        
        PID:3212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63254.exe
        6⤵
        
        PID:2864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45844.exe
        7⤵
        
        PID:5824
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2864 -s 212
        7⤵
        
        PID:6524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12998.exe
        6⤵
        
        PID:3916
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 448 -s 232
        6⤵
        
        PID:5576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65488.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-707.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1564
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1564 -s 240
        7⤵
        Program crash
        
        PID:2192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33841.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40546.exe
        7⤵
        
        PID:2804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12078.exe
        8⤵
        
        PID:6848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31091.exe
        8⤵
        
        PID:7460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24045.exe
        8⤵
        
        PID:7664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15154.exe
        8⤵
        
        PID:8968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49391.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4068
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1732 -s 244
        7⤵
        Program crash
        
        PID:4016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16958.exe
        6⤵
        
        PID:580
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 580 -s 240
        7⤵
        Program crash
        
        PID:4192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16017.exe
        6⤵
        
        PID:3944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33623.exe
        6⤵
        
        PID:6080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47872.exe
        6⤵
        
        PID:6576
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2204 -s 240
        6⤵
        
        PID:7388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57810.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26318.exe
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:1236
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1236 -s 220
        7⤵
        Program crash
        
        PID:1876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37462.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6761.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4599.exe
        7⤵
        
        PID:4328
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2444 -s 240
        7⤵
        
        PID:6152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48929.exe
        6⤵
        
        PID:3244
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2764 -s 244
        6⤵
        Program crash
        
        PID:4292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56997.exe
        5⤵
        
        PID:2776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56005.exe
        6⤵
        
        PID:2544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63836.exe
        7⤵
        
        PID:3656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10924.exe
        7⤵
        
        PID:6076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60410.exe
        7⤵
        
        PID:6888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24104.exe
        7⤵
        
        PID:7956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14034.exe
        7⤵
        
        PID:8692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20428.exe
        7⤵
        
        PID:9024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59211.exe
        7⤵
        
        PID:8680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46495.exe
        6⤵
        
        PID:3996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36424.exe
        6⤵
        
        PID:5728
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2776 -s 232
        6⤵
        
        PID:6868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33893.exe
        5⤵
        
        PID:536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33165.exe
        6⤵
        
        PID:6376
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 536 -s 224
        6⤵
        
        PID:7132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23873.exe
        5⤵
        
        PID:4120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34154.exe
        5⤵
        
        PID:5520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52836.exe
        5⤵
        
        PID:6924
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2728 -s 240
        5⤵
        
        PID:7424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52338.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52338.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27046.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64900.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2584
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2584 -s 240
        7⤵
        Program crash
        
        PID:1092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64594.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2464
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2464 -s 220
        7⤵
        Program crash
        
        PID:1320
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1360 -s 236
        6⤵
        Program crash
        
        PID:1676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29331.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-578.exe
        6⤵
        
        PID:3044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42824.exe
        7⤵
        
        PID:928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47744.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5888
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 928 -s 244
        8⤵
        
        PID:7456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29473.exe
        7⤵
        
        PID:4148
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3044 -s 236
        7⤵
        
        PID:5636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22958.exe
        6⤵
        
        PID:604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11700.exe
        7⤵
        
        PID:4676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22688.exe
        7⤵
        
        PID:5588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11100.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6696
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 604 -s 212
        7⤵
        
        PID:7632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43209.exe
        6⤵
        
        PID:4156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42289.exe
        6⤵
        
        PID:5652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58378.exe
        6⤵
        
        PID:6488
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2784 -s 232
        6⤵
        
        PID:7528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44936.exe
        5⤵
        
        PID:2436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58189.exe
        6⤵
        
        PID:1784
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1784 -s 216
        7⤵
        Program crash
        
        PID:3272
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2436 -s 224
        6⤵
        Program crash
        
        PID:3568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4442.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23347.exe
        6⤵
        
        PID:3220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4599.exe
        6⤵
        
        PID:4388
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2708 -s 240
        6⤵
        
        PID:6176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2870.exe
        5⤵
        
        PID:3604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2720.exe
        5⤵
        
        PID:4624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1931.exe
        5⤵
        
        PID:2280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59702.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54639.exe
        5⤵
        
        PID:7332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57436.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52629.exe
        5⤵
        
        PID:9124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56146.exe
        5⤵
        
        PID:4240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56826.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56826.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36115.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63378.exe
        6⤵
        
        PID:2732
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2732 -s 240
        7⤵
        Program crash
        
        PID:3132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50897.exe
        6⤵
        
        PID:3188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18334.exe
        6⤵
        
        PID:4376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10258.exe
        6⤵
        
        PID:6204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15166.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64440.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14564.exe
        6⤵
        
        PID:8744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15963.exe
        6⤵
        
        PID:9148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32345.exe
        6⤵
        
        PID:5260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49538.exe
        5⤵
        
        PID:2420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55059.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3256
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2420 -s 224
        6⤵
        Program crash
        
        PID:4436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65182.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24200.exe
        5⤵
        
        PID:4280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1593.exe
        5⤵
        
        PID:6216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64168.exe
        5⤵
        
        PID:7256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15968.exe
        5⤵
        
        PID:7392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58570.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10628.exe
        5⤵
        
        PID:1232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36545.exe
        5⤵
        
        PID:8480
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21158.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21158.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16500.exe
        5⤵
        
        PID:2996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18650.exe
        6⤵
        
        PID:3420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20444.exe
        7⤵
        
        PID:7568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18115.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9289.exe
        7⤵
        
        PID:8984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36310.exe
        7⤵
        
        PID:8688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18882.exe
        6⤵
        
        PID:5016
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2996 -s 240
        6⤵
        
        PID:5460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54093.exe
        5⤵
        
        PID:3576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2782.exe
        6⤵
        
        PID:8824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10849.exe
        6⤵
        
        PID:2368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21434.exe
        5⤵
        
        PID:5044
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2868 -s 224
        5⤵
        
        PID:5976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25690.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25690.exe
      4⤵
      PID:1692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26576.exe
        5⤵
        
        PID:1368
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1368 -s 240
        6⤵
        Program crash
        
        PID:3772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45223.exe
        5⤵
        
        PID:3980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16646.exe
        5⤵
        
        PID:5556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11450.exe
        5⤵
        
        PID:6300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23130.exe
        5⤵
        
        PID:7908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5425.exe
        5⤵
        
        PID:8368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52197.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38359.exe
        5⤵
        
        PID:8852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46527.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46527.exe
      4⤵
      PID:3024
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3024 -s 220
        5⤵
        Program crash
        
        PID:4200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51743.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51743.exe
      4⤵
      PID:3360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12623.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12623.exe
      4⤵
      PID:5496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47501.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47501.exe
      4⤵
      PID:6700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58840.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58840.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29700.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29700.exe
      4⤵
      PID:8668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49696.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49696.exe
      4⤵
      PID:8880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6009.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6009.exe
      4⤵
      PID:4728
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43408.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43408.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24648.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24648.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9806.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12108.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4231.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1528
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1528 -s 236
        8⤵
        Program crash
        
        PID:2632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51168.exe
        7⤵
        
        PID:2756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-823.exe
        8⤵
        
        PID:3876
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2756 -s 212
        8⤵
        
        PID:5544
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2700 -s 220
        7⤵
        Program crash
        
        PID:3492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37396.exe
        6⤵
        
        PID:2796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27126.exe
        7⤵
        
        PID:1808
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1808 -s 240
        8⤵
        Program crash
        
        PID:4176
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2796 -s 224
        7⤵
        Program crash
        
        PID:3180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26444.exe
        6⤵
        
        PID:544
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 544 -s 220
        7⤵
        Program crash
        
        PID:3100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59878.exe
        6⤵
        
        PID:3336
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1256 -s 240
        6⤵
        Program crash
        
        PID:6136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11978.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31549.exe
        6⤵
        
        PID:2212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9238.exe
        7⤵
        
        PID:3164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8035.exe
        8⤵
        
        PID:6884
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3164 -s 224
        8⤵
        
        PID:7476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31969.exe
        7⤵
        
        PID:4500
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2212 -s 236
        7⤵
        
        PID:5372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44827.exe
        6⤵
        
        PID:3284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13305.exe
        7⤵
        
        PID:6772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20790.exe
        7⤵
        
        PID:7372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34491.exe
        7⤵
        
        PID:7264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65481.exe
        7⤵
        
        PID:8936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19289.exe
        7⤵
        
        PID:8484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46572.exe
        6⤵
        
        PID:4908
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2812 -s 232
        6⤵
        
        PID:5340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10369.exe
        5⤵
        
        PID:2008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16514.exe
        6⤵
        
        PID:2068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27418.exe
        7⤵
        
        PID:4520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24482.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17966.exe
        7⤵
        
        PID:7224
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2068 -s 212
        7⤵
        
        PID:7612
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2008 -s 224
        6⤵
        Program crash
        
        PID:3144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22824.exe
        5⤵
        
        PID:2588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4589.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13875.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5624
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2588 -s 220
        6⤵
        
        PID:7240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7352.exe
        5⤵
        
        PID:3976
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2140 -s 232
        5⤵
        
        PID:5552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22997.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22997.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1449.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61870.exe
        6⤵
        
        PID:3068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54354.exe
        7⤵
        
        PID:2148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7119.exe
        8⤵
        
        PID:3312
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2148 -s 244
        8⤵
        Program crash
        
        PID:4432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10518.exe
        7⤵
        
        PID:3572
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3068 -s 240
        7⤵
        Program crash
        
        PID:4632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4094.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42553.exe
        7⤵
        
        PID:3764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57412.exe
        7⤵
        
        PID:4684
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1028 -s 240
        7⤵
        
        PID:6160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39469.exe
        6⤵
        
        PID:3988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60401.exe
        6⤵
        
        PID:4692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1401.exe
        6⤵
        
        PID:2948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64168.exe
        6⤵
        
        PID:7248
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1012 -s 240
        6⤵
        
        PID:7356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23421.exe
        5⤵
        
        PID:2552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11064.exe
        6⤵
        
        PID:1736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35374.exe
        7⤵
        
        PID:3792
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1736 -s 232
        7⤵
        Program crash
        
        PID:5380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22275.exe
        6⤵
        
        PID:3096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36424.exe
        6⤵
        
        PID:5736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17157.exe
        6⤵
        
        PID:7036
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2552 -s 216
        6⤵
        
        PID:7904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56621.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2896
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2896 -s 220
        6⤵
        Program crash
        
        PID:4112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21663.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3932
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2164 -s 240
        5⤵
        Program crash
        
        PID:6088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58744.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58744.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26318.exe
        5⤵
        Executes dropped EXE
        
        PID:1036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15579.exe
        6⤵
        
        PID:2852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2063.exe
        6⤵
        
        PID:3984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36424.exe
        6⤵
        
        PID:5768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40593.exe
        6⤵
        
        PID:6992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15438.exe
        6⤵
        
        PID:8020
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1036 -s 244
        6⤵
        
        PID:8712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62185.exe
        5⤵
        
        PID:2884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63455.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6420
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2884 -s 220
        6⤵
        
        PID:6312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60230.exe
        5⤵
        
        PID:3628
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2004 -s 232
        5⤵
        Program crash
        
        PID:6112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40168.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40168.exe
      4⤵
      PID:2576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53265.exe
        5⤵
        
        PID:2548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3722.exe
        6⤵
        
        PID:3540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1708.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64442.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7120
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2548 -s 212
        6⤵
        
        PID:7644
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2576 -s 232
        5⤵
        Program crash
        
        PID:4104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21195.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21195.exe
      4⤵
      PID:3016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53842.exe
        5⤵
        
        PID:7128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4503.exe
        5⤵
        
        PID:7452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16834.exe
        5⤵
        
        PID:8728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45629.exe
        5⤵
        
        PID:9172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58681.exe
        5⤵
        
        PID:5196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27905.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27905.exe
      4⤵
      PID:4264
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1844 -s 236
      4⤵
      PID:5464
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51574.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51574.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2928
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2928 -s 236
      4⤵
      Loads dropped DLL
      Program crash
      PID:976
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8939.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8939.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2388
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2388 -s 216
      4⤵
      Program crash
      PID:2172
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26006.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26006.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10806.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10806.exe
      4⤵
      PID:2920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16685.exe
        5⤵
        
        PID:2312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54172.exe
        6⤵
        
        PID:3204
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2312 -s 244
        6⤵
        Program crash
        
        PID:5440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49548.exe
        5⤵
        
        PID:3368
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2920 -s 240
        5⤵
        Program crash
        
        PID:5416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51697.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51697.exe
      4⤵
      PID:2872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32709.exe
        5⤵
        
        PID:3308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63814.exe
        5⤵
        
        PID:5432
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2872 -s 220
        5⤵
        
        PID:7092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53587.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53587.exe
      4⤵
      PID:3588
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1520 -s 244
      4⤵
      Program crash
      PID:5388
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16093.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16093.exe
    3⤵
    PID:908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61646.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61646.exe
      4⤵
      PID:3192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36841.exe
        5⤵
        
        PID:5892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36015.exe
        5⤵
        
        PID:6616
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3192 -s 216
        5⤵
        
        PID:7604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51513.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51513.exe
      4⤵
      PID:4508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36424.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36424.exe
      4⤵
      PID:5720
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 908 -s 224
      4⤵
      PID:7112
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3910.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3910.exe
    3⤵
    PID:3316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50335.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50335.exe
      4⤵
      PID:8304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61520.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61520.exe
      4⤵
      PID:8272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62160.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62160.exe
      4⤵
      PID:8904
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22771.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22771.exe
    3⤵
    PID:4916
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7288.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7288.exe
    3⤵
    PID:5516
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51701.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51701.exe
    3⤵
    PID:6900
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31104.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31104.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:7564
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11499.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11499.exe
    3⤵
    PID:8632
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-65096.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-65096.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:8916
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27105.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27105.exe
    3⤵
    PID:5032
- C:\Users\Admin\AppData\Local\Temp\Unicorn-23055.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-23055.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2108
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48007.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48007.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24456.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24456.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63148.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46099.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1504
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1504 -s 220
        7⤵
        Program crash
        
        PID:2620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47187.exe
        6⤵
        
        PID:2736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50933.exe
        7⤵
        
        PID:3684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56934.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4216
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2736 -s 236
        7⤵
        
        PID:6028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61056.exe
        6⤵
        
        PID:3748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33613.exe
        6⤵
        
        PID:4360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21859.exe
        6⤵
        
        PID:5952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8210.exe
        6⤵
        
        PID:6780
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2992 -s 240
        6⤵
        
        PID:7432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37136.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22857.exe
        6⤵
        
        PID:1480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46901.exe
        7⤵
        
        PID:3648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11682.exe
        7⤵
        
        PID:4128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24659.exe
        7⤵
        
        PID:6064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-738.exe
        7⤵
        
        PID:6864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15438.exe
        7⤵
        
        PID:8004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63036.exe
        7⤵
        
        PID:8704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37494.exe
        7⤵
        
        PID:4696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37680.exe
        7⤵
        
        PID:8772
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8772 -s 188
        8⤵
        
        PID:9004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49625.exe
        6⤵
        
        PID:3720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39149.exe
        6⤵
        
        PID:4312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30525.exe
        6⤵
        
        PID:5960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40013.exe
        6⤵
        
        PID:6588
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1952 -s 232
        6⤵
        
        PID:7540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55546.exe
        5⤵
        
        PID:2680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49086.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3964
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2680 -s 232
        6⤵
        Program crash
        
        PID:5096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-253.exe
        5⤵
        
        PID:4092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15534.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39219.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15696.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7232
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2096 -s 232
        5⤵
        
        PID:7672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23189.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23189.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61055.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17645.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2200
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2200 -s 236
        7⤵
        Program crash
        
        PID:3296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39851.exe
        6⤵
        
        PID:3564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12012.exe
        6⤵
        
        PID:5404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14984.exe
        6⤵
        
        PID:7064
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1836 -s 240
        6⤵
        
        PID:7932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61780.exe
        5⤵
        
        PID:2568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43490.exe
        6⤵
        
        PID:3512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63814.exe
        6⤵
        
        PID:5424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9119.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31796.exe
        6⤵
        
        PID:7976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21960.exe
        6⤵
        
        PID:8400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35131.exe
        6⤵
        
        PID:8520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59890.exe
        6⤵
        
        PID:8844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34593.exe
        5⤵
        
        PID:3696
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1532 -s 244
        5⤵
        Program crash
        
        PID:5396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6819.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6819.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:3000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6456.exe
        5⤵
        
        PID:2720
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2720 -s 220
        6⤵
        Program crash
        
        PID:3700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40277.exe
        5⤵
        
        PID:4012
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3000 -s 216
        5⤵
        Program crash
        
        PID:6104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17042.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17042.exe
      4⤵
      PID:2752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56025.exe
        5⤵
        
        PID:5600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63417.exe
        5⤵
        
        PID:6308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25930.exe
        5⤵
        
        PID:7964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30626.exe
        5⤵
        
        PID:8420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51667.exe
        5⤵
        
        PID:8568
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2752 -s 224
        5⤵
        
        PID:8868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51213.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51213.exe
      4⤵
      PID:3236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17088.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17088.exe
      4⤵
      PID:4532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58908.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58908.exe
      4⤵
      PID:6592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59974.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59974.exe
      4⤵
      PID:7552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53235.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53235.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:8660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30095.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30095.exe
      4⤵
      PID:8620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8809.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8809.exe
      4⤵
      PID:8560
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4782.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4782.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7502.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7502.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49197.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59348.exe
        6⤵
        
        PID:2956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15579.exe
        7⤵
        
        PID:2856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28705.exe
        7⤵
        
        PID:3864
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2956 -s 216
        7⤵
        
        PID:5320
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2596 -s 232
        6⤵
        Program crash
        
        PID:2912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11683.exe
        5⤵
        
        PID:2724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22132.exe
        6⤵
        
        PID:3352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20290.exe
        7⤵
        
        PID:6608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57733.exe
        7⤵
        
        PID:8548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36116.exe
        7⤵
        
        PID:8884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30450.exe
        7⤵
        
        PID:5084
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2724 -s 232
        6⤵
        Program crash
        
        PID:4988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17319.exe
        5⤵
        
        PID:3468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28039.exe
        6⤵
        
        PID:8452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48425.exe
        6⤵
        
        PID:5076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38483.exe
        5⤵
        
        PID:4980
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1944 -s 236
        5⤵
        
        PID:5940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47121.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47121.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51066.exe
        5⤵
        
        PID:2176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45585.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33431.exe
        7⤵
        
        PID:5908
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3088 -s 212
        7⤵
        
        PID:6504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34273.exe
        6⤵
        
        PID:4304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36424.exe
        6⤵
        
        PID:5744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16965.exe
        6⤵
        
        PID:6876
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2176 -s 236
        6⤵
        
        PID:7624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22429.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3224
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3224 -s 216
        6⤵
        Program crash
        
        PID:3808
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3028 -s 236
        5⤵
        Program crash
        
        PID:3548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2253.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2253.exe
      4⤵
      PID:2272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52448.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44330.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37840.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4960
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2272 -s 212
        5⤵
        Program crash
        
        PID:4972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34467.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34467.exe
      4⤵
      PID:3616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4060.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4060.exe
      4⤵
      PID:5100
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2384 -s 244
      4⤵
      PID:5492
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39229.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39229.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12949.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12949.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21656.exe
        5⤵
        
        PID:628
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 628 -s 240
        6⤵
        Program crash
        
        PID:3300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18966.exe
        5⤵
        
        PID:3516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22055.exe
        5⤵
        
        PID:4592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64420.exe
        5⤵
        
        PID:5916
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2120 -s 236
        5⤵
        
        PID:7076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25604.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25604.exe
      4⤵
      PID:1740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12926.exe
        5⤵
        
        PID:4028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40800.exe
        5⤵
        
        PID:5092
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1740 -s 240
        5⤵
        
        PID:5840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62541.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62541.exe
      4⤵
      PID:3140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17877.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17877.exe
      4⤵
      PID:5344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6319.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6319.exe
      4⤵
      PID:7048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6595.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6595.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22490.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22490.exe
      4⤵
      PID:8388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30666.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30666.exe
      4⤵
      PID:8512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33024.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33024.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4716
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14578.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14578.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1417.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1417.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2504
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2504 -s 216
        5⤵
        Program crash
        
        PID:3632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40476.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40476.exe
      4⤵
      PID:3812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56072.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56072.exe
      4⤵
      PID:5116
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 944 -s 244
      4⤵
      PID:5900
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25325.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25325.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2324
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2324 -s 240
      4⤵
      Program crash
      PID:3744
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2534.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2534.exe
    3⤵
    PID:3896
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29286.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29286.exe
    3⤵
    PID:5452
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50855.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50855.exe
    3⤵
    PID:7056
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62332.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62332.exe
    3⤵
    PID:7944
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-65362.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-65362.exe
    3⤵
    PID:8380
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1795.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1795.exe
    3⤵
    PID:4424
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56825.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56825.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:8860
- C:\Users\Admin\AppData\Local\Temp\Unicorn-21591.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-21591.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2780
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57704.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57704.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43055.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43055.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24714.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10036.exe
        6⤵
        
        PID:2768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38619.exe
        7⤵
        
        PID:3800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-878.exe
        7⤵
        
        PID:4568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29916.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22368.exe
        7⤵
        
        PID:6436
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2768 -s 216
        7⤵
        
        PID:8000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21607.exe
        6⤵
        
        PID:3868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57966.exe
        6⤵
        
        PID:3248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8675.exe
        6⤵
        
        PID:5616
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1960 -s 236
        6⤵
        
        PID:6896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14130.exe
        5⤵
        
        PID:2848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24670.exe
        6⤵
        
        PID:3920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44231.exe
        6⤵
        
        PID:3264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59899.exe
        6⤵
        
        PID:5864
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2848 -s 244
        6⤵
        
        PID:7216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7569.exe
        5⤵
        
        PID:4020
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1696 -s 244
        5⤵
        Program crash
        
        PID:4288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36342.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36342.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23843.exe
        5⤵
        
        PID:2052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42459.exe
        6⤵
        
        PID:3832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22559.exe
        6⤵
        
        PID:4596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49268.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5644
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2052 -s 244
        6⤵
        
        PID:6448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4804.exe
        5⤵
        
        PID:3908
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2860 -s 220
        5⤵
        Program crash
        
        PID:920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57492.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57492.exe
      4⤵
      PID:1560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3932.exe
        5⤵
        
        PID:3392
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3392 -s 220
        6⤵
        Program crash
        
        PID:4184
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1560 -s 212
        5⤵
        Program crash
        
        PID:4480
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52375.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52375.exe
      4⤵
      PID:3528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45233.exe
        5⤵
        
        PID:9164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46886.exe
        5⤵
        
        PID:4576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29817.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29817.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5324.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5324.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40543.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40543.exe
      4⤵
      PID:6572
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2892 -s 232
      4⤵
      PID:7556
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40978.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40978.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2276
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2276 -s 220
      4⤵
      Program crash
      PID:2232
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8713.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8713.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38101.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38101.exe
      4⤵
      PID:2836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11800.exe
        5⤵
        
        PID:3664
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2836 -s 244
        5⤵
        Program crash
        
        PID:4612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7996.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7996.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20519.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20519.exe
      4⤵
      PID:4140
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2000 -s 244
      4⤵
      PID:5336
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54089.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54089.exe
    3⤵
    PID:3032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64400.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64400.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8320.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8320.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4600
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3032 -s 240
      4⤵
      PID:6168
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19123.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19123.exe
    3⤵
    PID:3880
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1184.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1184.exe
    3⤵
    PID:4168
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2780 -s 236
    3⤵
    PID:824
- C:\Users\Admin\AppData\Local\Temp\Unicorn-24959.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-24959.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:2376
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60844.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60844.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2472
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2472 -s 220
      4⤵
      Program crash
      PID:2356
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16249.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16249.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2228
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2228 -s 236
      4⤵
      Program crash
      PID:2664
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28490.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28490.exe
    3⤵
    PID:2132
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2132 -s 220
      4⤵
      Program crash
      PID:2180
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63420.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63420.exe
    3⤵
    PID:684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16857.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16857.exe
      4⤵
      PID:4464
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 684 -s 212
      4⤵
      PID:6052
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57430.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57430.exe
    3⤵
    PID:3388
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2376 -s 232
    3⤵
    - Program crash
    PID:6128
- C:\Users\Admin\AppData\Local\Temp\Unicorn-52682.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-52682.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1660
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61055.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61055.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2352
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2352 -s 236
      4⤵
      Program crash
      PID:2932
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50379.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50379.exe
    3⤵
    PID:2888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12158.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12158.exe
      4⤵
      PID:3936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40608.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40608.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58555.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58555.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2300
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2888 -s 244
      4⤵
      PID:7208
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4492.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4492.exe
    3⤵
    PID:4076
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47028.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47028.exe
    3⤵
    PID:4548
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34649.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34649.exe
    3⤵
    PID:6248
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1660 -s 232
    3⤵
    PID:6568
- C:\Users\Admin\AppData\Local\Temp\Unicorn-421.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-421.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2092
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2092 -s 236
    3⤵
    - Program crash
    PID:1076
- C:\Users\Admin\AppData\Local\Temp\Unicorn-15416.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-15416.exe
  2⤵
  PID:1596
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49828.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49828.exe
    3⤵
    PID:4048
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4599.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4599.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4352
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37450.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37450.exe
    3⤵
    PID:6256
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23832.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23832.exe
    3⤵
    PID:7192
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15438.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15438.exe
    3⤵
    PID:8032
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1596 -s 244
    3⤵
    PID:8736
- C:\Users\Admin\AppData\Local\Temp\Unicorn-42367.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-42367.exe
  2⤵
  PID:3104
- C:\Users\Admin\AppData\Local\Temp\Unicorn-54735.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-54735.exe
  2⤵
  PID:4252
- C:\Users\Admin\AppData\Local\Temp\Unicorn-44802.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-44802.exe
  2⤵
  PID:6060
- C:\Users\Admin\AppData\Local\Temp\Unicorn-30832.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-30832.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:7200
- C:\Users\Admin\AppData\Local\Temp\Unicorn-12903.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-12903.exe
  2⤵
  PID:7692
- C:\Users\Admin\AppData\Local\Temp\Unicorn-26900.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-26900.exe
  2⤵
  PID:8644
- C:\Users\Admin\AppData\Local\Temp\Unicorn-24495.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-24495.exe
  2⤵
  PID:8944
- C:\Users\Admin\AppData\Local\Temp\Unicorn-23945.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-23945.exe
  2⤵
  PID:8776

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-23055.exe

Filesize
468KB

MD5
598fece5da97d61d518a6fd6d990229c

SHA1
e1371b0321d9c58c6e53407e9adfa0ddcc873501

SHA256
e3c8cbef538befcb405e55ab1d31077f0cd24daf5e5aeb3fa979a77473c194be

SHA512
90bd42bc90f081b5bddf91bf8125cbc60d8bba3919bf032632ef2508ffaba499b4804758ed82d802f27caffc4cd4b1a6b2b48030d8019c26260691b3d38ef190

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-24648.exe

Filesize
468KB

MD5
8ae390cc718e7507d2b58e97cd905f2d

SHA1
70dbf0dae5798470b863f35f074d83a56aab8d22

SHA256
34a3ee652728bf59c0b4c1cb8d1f02c974783d18da84754478f80da2aedde392

SHA512
f499cd7c5d9e03d0f26fea00325d4d995a6bb02e5a19ac9fc46ee48670d1395890eaa607372e43f25349926d76324b59babc1b74163573b84a320045feec2ea1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-24959.exe

Filesize
468KB

MD5
0a031bdff9df36dca1dd5940e7b6b491

SHA1
d0fce7c2231ae6a7a0cba79d326a6106b2465e25

SHA256
800b67967f1cd4fb16633df2cb2496e12e5666800e8c74644f5312ccafa31521

SHA512
047670f3ce89a4dffcd2c2b1809f49f7e235451efefa68c87b2664411f4f97435af8c77d76dfd813fbf7bf247df8c82280096decb46572b7e23598757579e458

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-4782.exe

Filesize
468KB

MD5
9a879728cf0ea3bba8b09a535abed8b4

SHA1
1f871bf8fb46a0306a16ba2a8c67aca18683edbb

SHA256
deeb14143f5c566401a60bc25ce8e28563eca5cd506612df6fdfe7ddaba42dba

SHA512
68d293e61bce92ae7fa08f616c483e399e00dbbe1da329d6a851b463629d6f692401ee70a8e04623993f854399718eeaed4f7ad79e232dd97c80d66b7ac2c4c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-51574.exe

Filesize
468KB

MD5
6819fc4f89518758267a176a2612b25e

SHA1
ca9633a4cd94f2aae86a85784cac7a48cd0e1227

SHA256
7fb1e70d73ef646751c4f410bf6aaf8c91bca2c0fa2f19c9a23790b420002583

SHA512
69b020313dc29fa291b5146530b8a35382ac1b62683a92649e1b91ec2336d17f3878fd07fa3ae0ca9474f8822ef2210bfcbd658fc5511adb16e6f3fe615d2258

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-57704.exe

Filesize
468KB

MD5
7a009c88b39a6aa817f5b49d0950253d

SHA1
4aff3cd967d529b1586d7f156701e6fb9cdf1ad7

SHA256
f59dae697bd57442d3f7dc84b75a810652e98315edd07957ca6a2a5380074bbf

SHA512
1ee2a8cfd5ec4d045679e899a31eb929e4b16ea8246c4376ccbdb444d39c76f4d876d6ca96738fb9ae24d68e4be1aaa8b7a133b54fab364675556808fee06ec4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-65488.exe

Filesize
468KB

MD5
2d481d5fcb21c8dbd6fc06f785649169

SHA1
0aee936e838ae1a150a33d047f8c0e3e75973eaf

SHA256
394545148b8ba34bf4f55b9cf77f2ded3acc920948e9d590c9f7cb24e509c751

SHA512
0b8aa0f75146781f9806a293c56b78661aea7fb1e610bc9a5c2a522bfecfe6c82df1ee86e591cd7e9e81b4bcd7299f0c57f8684e44c99139f55995286e114602

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-14950.exe

Filesize
468KB

MD5
1aa4e09de8aabb674bb4d8e74fe8a95c

SHA1
3e4c7bfec2b08605b583e70836f998ab395f0d69

SHA256
4b38eb414ff57fd7dbc30b808e03f77e85957e97b93d2cdbb4e70d7df0e572b7

SHA512
241e8c80659e07c5d0e68e1437f32ed5fa1b2062784153f53c091323d3aa4e92ee70408f6bfea7fc2f0ee82c9dbc768ba83fac5cb0ed2823daba949856270e35

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-21591.exe

Filesize
468KB

MD5
0463d56fc6714675a118f8784da6f928

SHA1
14008b373f2f92a37d17231850639713a90e07c3

SHA256
9b1caa8ea3f390c6fb88d4d35c02625d72496f3282d3f376d4087515dfa79724

SHA512
791d17b4ede26ed7881972965a43a0adddcba06c0db1f83ff6e9e166194615e9da2a47f0c4e950032f10f569816c7909873e077ba06fa875e873567ea6e25bd6

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-22997.exe

Filesize
468KB

MD5
bfe132764f00dd792952c87e50b1c1c5

SHA1
bbe3acd401348965f1443718e589ca1ed39a4d48

SHA256
bf60d71e9e7db48c0f73ee445762a5c8dfe063fe9f792b6b08c02a45b37df75d

SHA512
ec537401f197db038fbad7be4f1768bdc07b01694faba12a742adfadd015a7bbbe9d9a65218166212970d4bee8f1a9d3d4baa060e6e9db346756b7a79a6f9e33

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-24456.exe

Filesize
468KB

MD5
b50d9f616bb1147517222c07eb07f5d8

SHA1
f83716ca0adb40cf5af1d8c0bd730019b71a8689

SHA256
d039d18fbe8328b11260e3d5e66e70aed817eed5250e82df3ee9a559e6e8e374

SHA512
6782c3a693f29cb82b840e42fc30a84091aa872f7751376c34a9c6fdc37aa854025a055969ab14b4d244b697588a9110c5a566354fe61a11c93af0e52d4eb803

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-42729.exe

Filesize
468KB

MD5
1f972129b1f2f6cb804c35c57c1b2860

SHA1
f65cf1f81b28cad9dc665394d445ca049fedaff0

SHA256
55e48a5f5b8675b2f6241eeb2aa75029b044f9c074abfbd3eb83805cc9377b25

SHA512
f6837371ef9ce56dde397c32b0dcda387e152c05199b01e2acef8894e4de6072ddc1afe95771a98e6ce34368a5bce0f28197c8ff3adadb7e40dba165d5684f72

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-43408.exe

Filesize
468KB

MD5
c5b091a09db053e47009817f04a9b017

SHA1
d97e1ee893d3598a9fc53effc4ba9b889216a19d

SHA256
103ca9ad1dea9e7927ae76f7900d1561ee7a0c2bd627400004f885e64ca715d5

SHA512
b4f47c19ffa7cbf101e820d4612aae312dce8dc016b889e1d4835bc128c3537b02ba9c76ad55ee757560143ec1725b30aec88cf1bdf60a483df44ce9c5f9ec1f

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-47403.exe

Filesize
468KB

MD5
cd711cb5ab0ad47308130a8d660f8dc6

SHA1
d1d1104f7c23ddd3febb5f251ed848154dca7b6c

SHA256
cfac98a45b9ada43efebdf7607bcc82f59f0de7f1213a5bb4c2d7fc0b5d00a9a

SHA512
95a5730aa3760ac8469fca7e0fa113ac32765ef594ec5cd61068a238b3bf0f0878ea9254ea52ee1bdeffd710c1eb76199b8a31e7dcf4f8c4fd23c88998ec8571

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-48007.exe

Filesize
468KB

MD5
311bf1abb3fc58cf17cb69706caf0f61

SHA1
bb84792780d8aecc584ba7e7655c7e9fa05e720f

SHA256
d16dbbb93e1872fc063396b4ec300f13fdc8396b61a5c1e10c1eec77f24bd610

SHA512
ecc5a8adb6247f280c26a026918c52992c3923a58371a72eeef4832c315a6dfdea8dbe498dc6e57617aaedaa7475cf8bf7569487e351c5dd84210b6c6699cefc

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-52168.exe

Filesize
468KB

MD5
290adf5e0ec48c291f20048c173cf3be

SHA1
ab01385e7ca0e5e54e35fa6dcad63ce7dae133cc

SHA256
ccb724f3bcea192d4372e32373de2c3b284fc897dced5aedf5a40f74f4307b50

SHA512
f77f7507893cba375f2ac644e7152eb19bea1040799234c14e8ee065bfd37c8c9f04387d4ed3a8484b18cb49fce6fb1b6f2899487738076a0b2913b65b9a6622

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-52297.exe

Filesize
468KB

MD5
f2f981c5e097aaa7aa1e6e91ce394319

SHA1
52b77aaa831b5c98a6ac1252e7ad0df624294a53

SHA256
e1738d7f1a68fe258ad570bf79e9ef1f44ed5cc8d4edd0ffc3baf57393465ae2

SHA512
94d03e4c0cbbe4a78198077cc40402d46c170d29722e03d4b735c86ef2518f9ca6d98de78033c5a59b9700ffeb506d17a482f19aea68b7ba80bf26c364c67571

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-52338.exe

Filesize
468KB

MD5
2a4dd651f7b9b9686bdc146ebbfe3830

SHA1
e9092d79f7ee39a260b890cfeb42bef73137d104

SHA256
874c7073825318e0e44308d12aa54824c3ce49bfb79a0f5426e6299faf7b0614

SHA512
a512e37c02c0d4289b98a2b0fc3698ccc3b83ad57a968da28ce4a378e2c085d87ada4cfa12b06b0fc60910e0529862a7a963e24ba7574d4aaacd3fa1d7052c54

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-9806.exe

Filesize
468KB

MD5
eaadf49d549f8d4413bbe981948448be

SHA1
d199e602ec4d4c1dadee7d562ca295f6a7b69fda

SHA256
2004317cb8219241274bbacc9b4a904ea68c5ce4aa4a936f680ea9b00802feaa

SHA512
82ea11ba1043d676772185421ad8261ed6285d0788ceb26bbae307e9e048a58f8f9c6984531348b2c82feee333fc416396fdd3b507946e092921a65c81852ccf

Download Submit