0c9d22825ce979b84b93cbebcd9bf0690b1fdda515863cd2aa77a519aa9adaa8

Analysis

max time kernel
120s
max time network
17s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
21/09/2024, 09:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0c9d22825ce979b84b93cbebcd9bf0690b1fdda515863cd2aa77a519aa9adaa8N.exe
Size

468KB
MD5

b8e4258e0c40265ebde3bc7ee9ddc4f0
SHA1

e234bf17ea685af983951139852a032e02a9c419
SHA256

0c9d22825ce979b84b93cbebcd9bf0690b1fdda515863cd2aa77a519aa9adaa8
SHA512

34ec783b271c639babb09852e193b5e12ac7a52b137df5fe427ee3f0abb1026360d6c9d6823d2973627f8017e292f6c076e38edd3f46c550d7f25c21dd33870a
SSDEEP

3072:1d3HoggSIE5TtbY2HzcO3f8/zDcaP0pkJVHeTVryQ65kv7ggEslL:1d3ozMTtxH4O3faY1oQ6qzggE

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
1788	Unicorn-47758.exe
2736	Unicorn-61245.exe
2128	Unicorn-45464.exe
2912	Unicorn-28607.exe
1992	Unicorn-24523.exe
2628	Unicorn-26560.exe
2920	Unicorn-8741.exe
2684	Unicorn-12436.exe
2648	Unicorn-61180.exe
1764	Unicorn-4076.exe
2484	Unicorn-20413.exe
3016	Unicorn-28070.exe
300	Unicorn-8715.exe
2944	Unicorn-14335.exe
1960	Unicorn-56650.exe
1624	Unicorn-44953.exe
2556	Unicorn-45706.exe
1596	Unicorn-7995.exe
2768	Unicorn-61850.exe
2040	Unicorn-62405.exe
532	Unicorn-20818.exe
952	Unicorn-33070.exe
1260	Unicorn-49406.exe
1524	Unicorn-43276.exe
808	Unicorn-33624.exe
1160	Unicorn-61658.exe
2216	Unicorn-18579.exe
1544	Unicorn-24445.exe
2108	Unicorn-31207.exe
892	Unicorn-39375.exe
1580	Unicorn-41465.exe
792	Unicorn-45497.exe
1612	Unicorn-16215.exe
2316	Unicorn-12685.exe
1572	Unicorn-52971.exe
2412	Unicorn-39757.exe
2960	Unicorn-28275.exe
2728	Unicorn-36997.exe
2752	Unicorn-56863.exe
2712	Unicorn-43442.exe
2592	Unicorn-16708.exe
2848	Unicorn-25430.exe
2916	Unicorn-49380.exe
2652	Unicorn-53464.exe
2564	Unicorn-34123.exe
2520	Unicorn-34388.exe
1712	Unicorn-46375.exe
2460	Unicorn-39026.exe
2612	Unicorn-59447.exe
956	Unicorn-19897.exe
1732	Unicorn-26028.exe
344	Unicorn-42364.exe
1412	Unicorn-41602.exe
2924	Unicorn-1886.exe
264	Unicorn-1715.exe
1952	Unicorn-33463.exe
1700	Unicorn-8212.exe
1380	Unicorn-33271.exe
1912	Unicorn-18226.exe
1620	Unicorn-56764.exe
2372	Unicorn-57029.exe
1792	Unicorn-32101.exe
1312	Unicorn-40501.exe
2300	Unicorn-26063.exe

Loads dropped DLL 64 IoCs

pid	Process
2152	0c9d22825ce979b84b93cbebcd9bf0690b1fdda515863cd2aa77a519aa9adaa8N.exe
2152	0c9d22825ce979b84b93cbebcd9bf0690b1fdda515863cd2aa77a519aa9adaa8N.exe
1788	Unicorn-47758.exe
1788	Unicorn-47758.exe
2152	0c9d22825ce979b84b93cbebcd9bf0690b1fdda515863cd2aa77a519aa9adaa8N.exe
2152	0c9d22825ce979b84b93cbebcd9bf0690b1fdda515863cd2aa77a519aa9adaa8N.exe
2736	Unicorn-61245.exe
2128	Unicorn-45464.exe
2736	Unicorn-61245.exe
1788	Unicorn-47758.exe
2128	Unicorn-45464.exe
1788	Unicorn-47758.exe
2152	0c9d22825ce979b84b93cbebcd9bf0690b1fdda515863cd2aa77a519aa9adaa8N.exe
2152	0c9d22825ce979b84b93cbebcd9bf0690b1fdda515863cd2aa77a519aa9adaa8N.exe
2628	Unicorn-26560.exe
2628	Unicorn-26560.exe
2152	0c9d22825ce979b84b93cbebcd9bf0690b1fdda515863cd2aa77a519aa9adaa8N.exe
2152	0c9d22825ce979b84b93cbebcd9bf0690b1fdda515863cd2aa77a519aa9adaa8N.exe
2912	Unicorn-28607.exe
2912	Unicorn-28607.exe
1992	Unicorn-24523.exe
1992	Unicorn-24523.exe
1788	Unicorn-47758.exe
2736	Unicorn-61245.exe
2128	Unicorn-45464.exe
1788	Unicorn-47758.exe
2736	Unicorn-61245.exe
2128	Unicorn-45464.exe
2936	WerFault.exe
2936	WerFault.exe
2936	WerFault.exe
2936	WerFault.exe
2936	WerFault.exe
2684	Unicorn-12436.exe
2684	Unicorn-12436.exe
2628	Unicorn-26560.exe
2628	Unicorn-26560.exe
2648	Unicorn-61180.exe
2648	Unicorn-61180.exe
2152	0c9d22825ce979b84b93cbebcd9bf0690b1fdda515863cd2aa77a519aa9adaa8N.exe
2152	0c9d22825ce979b84b93cbebcd9bf0690b1fdda515863cd2aa77a519aa9adaa8N.exe
2484	Unicorn-20413.exe
2484	Unicorn-20413.exe
1992	Unicorn-24523.exe
1992	Unicorn-24523.exe
300	Unicorn-8715.exe
300	Unicorn-8715.exe
1764	Unicorn-4076.exe
1764	Unicorn-4076.exe
3016	Unicorn-28070.exe
3016	Unicorn-28070.exe
2128	Unicorn-45464.exe
2128	Unicorn-45464.exe
2912	Unicorn-28607.exe
2912	Unicorn-28607.exe
2944	Unicorn-14335.exe
2944	Unicorn-14335.exe
2736	Unicorn-61245.exe
2736	Unicorn-61245.exe
1788	Unicorn-47758.exe
1788	Unicorn-47758.exe
1624	Unicorn-44953.exe
1624	Unicorn-44953.exe
1960	Unicorn-56650.exe

Program crash 64 IoCs

pid	pid_target	Process	procid_target
2936	2920	WerFault.exe	33
2844	1524	WerFault.exe	54
2784	532	WerFault.exe	51
2776	892	WerFault.exe	60
2448	1612	WerFault.exe	63
2568	2768	WerFault.exe	49
2080	2728	WerFault.exe	68
464	2848	WerFault.exe	72
308	2712	WerFault.exe	70
1816	2916	WerFault.exe	75
2348	344	WerFault.exe	84
2456	2216	WerFault.exe	57
1676	808	WerFault.exe	55
2228	1260	WerFault.exe	53
1696	1764	WerFault.exe	37
744	1936	WerFault.exe	114
2240	1596	WerFault.exe	46
2476	1828	WerFault.exe	136
2504	2208	WerFault.exe	101
3160	2652	WerFault.exe	76
3168	2564	WerFault.exe	77
3744	1208	WerFault.exe	115
3256	1704	WerFault.exe	127
3236	1092	WerFault.exe	135
3080	2156	WerFault.exe	142
3860	2600	WerFault.exe	144
3992	2972	WerFault.exe	164
3096	1620	WerFault.exe	94
3384	2492	WerFault.exe	154
3376	2420	WerFault.exe	159
3116	1968	WerFault.exe	169
3836	2512	WerFault.exe	108
4044	836	WerFault.exe	163
4104	3576	WerFault.exe	195
4188	1924	WerFault.exe	112
4204	1544	WerFault.exe	58
4544	1588	WerFault.exe	150
4632	2108	WerFault.exe	59
4756	1732	WerFault.exe	83
4764	660	WerFault.exe	155
5048	3280	WerFault.exe	187
4160	3248	WerFault.exe	186
4172	4064	WerFault.exe	209
4196	2944	WerFault.exe	41
4268	860	WerFault.exe	122
4328	2404	WerFault.exe	151
4336	1784	WerFault.exe	171
4804	1992	WerFault.exe	31
4796	2460	WerFault.exe	80
5080	1700	WerFault.exe	89
5028	1912	WerFault.exe	93
4524	640	WerFault.exe	145
4968	600	WerFault.exe	143
4700	2220	WerFault.exe	153
4628	1556	WerFault.exe	167
5612	1864	WerFault.exe	146
5708	1380	WerFault.exe	91
5956	652	WerFault.exe	152
6060	2952	WerFault.exe	104
6096	2656	WerFault.exe	161
6116	1960	WerFault.exe	43
5388	3408	WerFault.exe	190
5596	2580	WerFault.exe	148
5628	1728	WerFault.exe	133

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49853.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46366.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9126.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20413.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46100.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65265.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43942.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7372.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50230.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38502.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6344.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40936.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13194.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53582.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4293.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30308.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32878.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42815.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5618.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58346.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61695.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37004.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61518.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43391.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3951.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9528.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45464.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1715.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5099.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54902.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31467.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31276.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47412.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40164.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15834.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19794.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7782.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1158.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45263.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48493.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24403.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62369.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64639.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34123.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8207.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23132.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8813.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18579.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13085.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64964.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4481.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20652.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42183.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33838.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18788.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26122.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37700.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33098.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19364.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8596.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29178.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52582.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11060.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59836.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2152	0c9d22825ce979b84b93cbebcd9bf0690b1fdda515863cd2aa77a519aa9adaa8N.exe
1788	Unicorn-47758.exe
2736	Unicorn-61245.exe
2128	Unicorn-45464.exe
2628	Unicorn-26560.exe
2912	Unicorn-28607.exe
2920	Unicorn-8741.exe
1992	Unicorn-24523.exe
2684	Unicorn-12436.exe
2648	Unicorn-61180.exe
2484	Unicorn-20413.exe
1764	Unicorn-4076.exe
300	Unicorn-8715.exe
2944	Unicorn-14335.exe
3016	Unicorn-28070.exe
1624	Unicorn-44953.exe
1960	Unicorn-56650.exe
2556	Unicorn-45706.exe
1596	Unicorn-7995.exe
2768	Unicorn-61850.exe
2040	Unicorn-62405.exe
532	Unicorn-20818.exe
1524	Unicorn-43276.exe
952	Unicorn-33070.exe
808	Unicorn-33624.exe
1260	Unicorn-49406.exe
1160	Unicorn-61658.exe
2216	Unicorn-18579.exe
1544	Unicorn-24445.exe
2108	Unicorn-31207.exe
1580	Unicorn-41465.exe
892	Unicorn-39375.exe
1612	Unicorn-16215.exe
2412	Unicorn-39757.exe
1572	Unicorn-52971.exe
2316	Unicorn-12685.exe
2728	Unicorn-36997.exe
2960	Unicorn-28275.exe
2752	Unicorn-56863.exe
2712	Unicorn-43442.exe
2848	Unicorn-25430.exe
2652	Unicorn-53464.exe
2592	Unicorn-16708.exe
2916	Unicorn-49380.exe
2520	Unicorn-34388.exe
2564	Unicorn-34123.exe
1712	Unicorn-46375.exe
2460	Unicorn-39026.exe
2612	Unicorn-59447.exe
956	Unicorn-19897.exe
1732	Unicorn-26028.exe
344	Unicorn-42364.exe
1412	Unicorn-41602.exe
2924	Unicorn-1886.exe
264	Unicorn-1715.exe
1952	Unicorn-33463.exe
1700	Unicorn-8212.exe
1380	Unicorn-33271.exe
904	Unicorn-24357.exe
1912	Unicorn-18226.exe
1620	Unicorn-56764.exe
2372	Unicorn-57029.exe
1792	Unicorn-32101.exe
1312	Unicorn-40501.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2152 wrote to memory of 1788	2152	0c9d22825ce979b84b93cbebcd9bf0690b1fdda515863cd2aa77a519aa9adaa8N.exe	28
PID 2152 wrote to memory of 1788	2152	0c9d22825ce979b84b93cbebcd9bf0690b1fdda515863cd2aa77a519aa9adaa8N.exe	28
PID 2152 wrote to memory of 1788	2152	0c9d22825ce979b84b93cbebcd9bf0690b1fdda515863cd2aa77a519aa9adaa8N.exe	28
PID 2152 wrote to memory of 1788	2152	0c9d22825ce979b84b93cbebcd9bf0690b1fdda515863cd2aa77a519aa9adaa8N.exe	28
PID 1788 wrote to memory of 2736	1788	Unicorn-47758.exe	29
PID 1788 wrote to memory of 2736	1788	Unicorn-47758.exe	29
PID 1788 wrote to memory of 2736	1788	Unicorn-47758.exe	29
PID 1788 wrote to memory of 2736	1788	Unicorn-47758.exe	29
PID 2152 wrote to memory of 2128	2152	0c9d22825ce979b84b93cbebcd9bf0690b1fdda515863cd2aa77a519aa9adaa8N.exe	30
PID 2152 wrote to memory of 2128	2152	0c9d22825ce979b84b93cbebcd9bf0690b1fdda515863cd2aa77a519aa9adaa8N.exe	30
PID 2152 wrote to memory of 2128	2152	0c9d22825ce979b84b93cbebcd9bf0690b1fdda515863cd2aa77a519aa9adaa8N.exe	30
PID 2152 wrote to memory of 2128	2152	0c9d22825ce979b84b93cbebcd9bf0690b1fdda515863cd2aa77a519aa9adaa8N.exe	30
PID 2736 wrote to memory of 1992	2736	Unicorn-61245.exe	31
PID 2736 wrote to memory of 1992	2736	Unicorn-61245.exe	31
PID 2736 wrote to memory of 1992	2736	Unicorn-61245.exe	31
PID 2736 wrote to memory of 1992	2736	Unicorn-61245.exe	31
PID 2128 wrote to memory of 2912	2128	Unicorn-45464.exe	32
PID 2128 wrote to memory of 2912	2128	Unicorn-45464.exe	32
PID 2128 wrote to memory of 2912	2128	Unicorn-45464.exe	32
PID 2128 wrote to memory of 2912	2128	Unicorn-45464.exe	32
PID 1788 wrote to memory of 2920	1788	Unicorn-47758.exe	33
PID 1788 wrote to memory of 2920	1788	Unicorn-47758.exe	33
PID 1788 wrote to memory of 2920	1788	Unicorn-47758.exe	33
PID 1788 wrote to memory of 2920	1788	Unicorn-47758.exe	33
PID 2152 wrote to memory of 2628	2152	0c9d22825ce979b84b93cbebcd9bf0690b1fdda515863cd2aa77a519aa9adaa8N.exe	34
PID 2152 wrote to memory of 2628	2152	0c9d22825ce979b84b93cbebcd9bf0690b1fdda515863cd2aa77a519aa9adaa8N.exe	34
PID 2152 wrote to memory of 2628	2152	0c9d22825ce979b84b93cbebcd9bf0690b1fdda515863cd2aa77a519aa9adaa8N.exe	34
PID 2152 wrote to memory of 2628	2152	0c9d22825ce979b84b93cbebcd9bf0690b1fdda515863cd2aa77a519aa9adaa8N.exe	34
PID 2628 wrote to memory of 2684	2628	Unicorn-26560.exe	35
PID 2628 wrote to memory of 2684	2628	Unicorn-26560.exe	35
PID 2628 wrote to memory of 2684	2628	Unicorn-26560.exe	35
PID 2628 wrote to memory of 2684	2628	Unicorn-26560.exe	35
PID 2152 wrote to memory of 2648	2152	0c9d22825ce979b84b93cbebcd9bf0690b1fdda515863cd2aa77a519aa9adaa8N.exe	36
PID 2152 wrote to memory of 2648	2152	0c9d22825ce979b84b93cbebcd9bf0690b1fdda515863cd2aa77a519aa9adaa8N.exe	36
PID 2152 wrote to memory of 2648	2152	0c9d22825ce979b84b93cbebcd9bf0690b1fdda515863cd2aa77a519aa9adaa8N.exe	36
PID 2152 wrote to memory of 2648	2152	0c9d22825ce979b84b93cbebcd9bf0690b1fdda515863cd2aa77a519aa9adaa8N.exe	36
PID 2912 wrote to memory of 1764	2912	Unicorn-28607.exe	37
PID 2912 wrote to memory of 1764	2912	Unicorn-28607.exe	37
PID 2912 wrote to memory of 1764	2912	Unicorn-28607.exe	37
PID 2912 wrote to memory of 1764	2912	Unicorn-28607.exe	37
PID 1992 wrote to memory of 2484	1992	Unicorn-24523.exe	38
PID 1992 wrote to memory of 2484	1992	Unicorn-24523.exe	38
PID 1992 wrote to memory of 2484	1992	Unicorn-24523.exe	38
PID 1992 wrote to memory of 2484	1992	Unicorn-24523.exe	38
PID 2920 wrote to memory of 2936	2920	Unicorn-8741.exe	39
PID 2920 wrote to memory of 2936	2920	Unicorn-8741.exe	39
PID 2920 wrote to memory of 2936	2920	Unicorn-8741.exe	39
PID 2920 wrote to memory of 2936	2920	Unicorn-8741.exe	39
PID 1788 wrote to memory of 3016	1788	Unicorn-47758.exe	40
PID 1788 wrote to memory of 3016	1788	Unicorn-47758.exe	40
PID 1788 wrote to memory of 3016	1788	Unicorn-47758.exe	40
PID 1788 wrote to memory of 3016	1788	Unicorn-47758.exe	40
PID 2736 wrote to memory of 2944	2736	Unicorn-61245.exe	41
PID 2736 wrote to memory of 2944	2736	Unicorn-61245.exe	41
PID 2736 wrote to memory of 2944	2736	Unicorn-61245.exe	41
PID 2736 wrote to memory of 2944	2736	Unicorn-61245.exe	41
PID 2128 wrote to memory of 300	2128	Unicorn-45464.exe	42
PID 2128 wrote to memory of 300	2128	Unicorn-45464.exe	42
PID 2128 wrote to memory of 300	2128	Unicorn-45464.exe	42
PID 2128 wrote to memory of 300	2128	Unicorn-45464.exe	42
PID 2684 wrote to memory of 1960	2684	Unicorn-12436.exe	43
PID 2684 wrote to memory of 1960	2684	Unicorn-12436.exe	43
PID 2684 wrote to memory of 1960	2684	Unicorn-12436.exe	43
PID 2684 wrote to memory of 1960	2684	Unicorn-12436.exe	43

C:\Users\Admin\AppData\Local\Temp\0c9d22825ce979b84b93cbebcd9bf0690b1fdda515863cd2aa77a519aa9adaa8N.exe
"C:\Users\Admin\AppData\Local\Temp\0c9d22825ce979b84b93cbebcd9bf0690b1fdda515863cd2aa77a519aa9adaa8N.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2152
- C:\Users\Admin\AppData\Local\Temp\Unicorn-47758.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-47758.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1788
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61245.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61245.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24523.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24523.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20413.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61850.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28275.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40501.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12099.exe
        9⤵
        
        PID:1864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55945.exe
        10⤵
        
        PID:3680
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1864 -s 216
        10⤵
        Program crash
        
        PID:5612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53568.exe
        9⤵
        
        PID:3916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14584.exe
        9⤵
        
        PID:5752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25964.exe
        9⤵
        
        PID:6940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58741.exe
        9⤵
        
        PID:8032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11578.exe
        9⤵
        
        PID:8408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46890.exe
        9⤵
        
        PID:9528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38502.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:2288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65405.exe
        9⤵
        
        PID:3408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1949.exe
        10⤵
        
        PID:3480
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3408 -s 228
        10⤵
        Program crash
        
        PID:5388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54502.exe
        9⤵
        
        PID:4480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19794.exe
        9⤵
        
        PID:5784
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2288 -s 248
        9⤵
        
        PID:6736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27754.exe
        8⤵
        
        PID:3500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54321.exe
        9⤵
        
        PID:6028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1158.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:6428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55423.exe
        9⤵
        
        PID:7176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4293.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:8244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32878.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10362.exe
        8⤵
        
        PID:5456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24146.exe
        8⤵
        
        PID:6420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49946.exe
        8⤵
        
        PID:7900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40164.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:8376
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2768 -s 248
        7⤵
        Program crash
        
        PID:2568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36997.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2728
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2728 -s 224
        7⤵
        Program crash
        
        PID:2080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15834.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28265.exe
        7⤵
        
        PID:2688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5099.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35036.exe
        8⤵
        
        PID:5064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65290.exe
        8⤵
        
        PID:7044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6088.exe
        8⤵
        
        PID:7256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17532.exe
        8⤵
        
        PID:8768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22211.exe
        8⤵
        
        PID:9208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65244.exe
        7⤵
        
        PID:3372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58933.exe
        7⤵
        
        PID:5408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31467.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6304
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1976 -s 224
        7⤵
        
        PID:7564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35976.exe
        6⤵
        
        PID:2720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9754.exe
        7⤵
        
        PID:4908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64964.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39398.exe
        7⤵
        
        PID:6424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36592.exe
        7⤵
        
        PID:7396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61165.exe
        7⤵
        
        PID:9140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30927.exe
        6⤵
        
        PID:2028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-459.exe
        6⤵
        
        PID:5764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4481.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32717.exe
        6⤵
        
        PID:7448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52488.exe
        6⤵
        
        PID:8652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7862.exe
        6⤵
        
        PID:9412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62405.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56863.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53521.exe
        7⤵
        
        PID:2852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64445.exe
        8⤵
        
        PID:3028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52297.exe
        9⤵
        
        PID:5032
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3028 -s 228
        9⤵
        
        PID:6648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61518.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19794.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12616.exe
        8⤵
        
        PID:6720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53718.exe
        8⤵
        
        PID:7608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62289.exe
        8⤵
        
        PID:8628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6023.exe
        8⤵
        
        PID:9312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58368.exe
        7⤵
        
        PID:3004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54902.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32478.exe
        8⤵
        
        PID:7124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12475.exe
        8⤵
        
        PID:7408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59939.exe
        8⤵
        
        PID:8836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9966.exe
        8⤵
        
        PID:8896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9716.exe
        7⤵
        
        PID:4236
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2752 -s 248
        7⤵
        
        PID:5684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63552.exe
        6⤵
        
        PID:2552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48493.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1784
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1784 -s 220
        8⤵
        Program crash
        
        PID:4336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24076.exe
        7⤵
        
        PID:3540
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2552 -s 244
        7⤵
        
        PID:5812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6566.exe
        6⤵
        
        PID:1004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7372.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5012
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1004 -s 228
        7⤵
        
        PID:6656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15581.exe
        6⤵
        
        PID:4260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16994.exe
        6⤵
        
        PID:5776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52953.exe
        6⤵
        
        PID:6840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54248.exe
        6⤵
        
        PID:7520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57823.exe
        6⤵
        
        PID:8708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44694.exe
        6⤵
        
        PID:9300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43442.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2712
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2712 -s 224
        6⤵
        Program crash
        
        PID:308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35405.exe
        5⤵
        
        PID:1704
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1704 -s 224
        6⤵
        Program crash
        
        PID:3256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64809.exe
        5⤵
        
        PID:3616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35186.exe
        6⤵
        
        PID:8156
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3616 -s 216
        6⤵
        
        PID:9196
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1992 -s 228
        5⤵
        Program crash
        
        PID:4804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14335.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14335.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61658.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16708.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63682.exe
        7⤵
        
        PID:1208
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1208 -s 224
        8⤵
        Program crash
        
        PID:3744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10428.exe
        7⤵
        
        PID:3868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62702.exe
        8⤵
        
        PID:6104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34598.exe
        8⤵
        
        PID:7440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31276.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:2832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30308.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:8544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19768.exe
        7⤵
        
        PID:4980
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2592 -s 236
        7⤵
        
        PID:5168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15804.exe
        6⤵
        
        PID:860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6749.exe
        7⤵
        
        PID:1048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56706.exe
        8⤵
        
        PID:7472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57827.exe
        8⤵
        
        PID:8904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35372.exe
        8⤵
        
        PID:8748
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 860 -s 228
        7⤵
        Program crash
        
        PID:4268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30167.exe
        6⤵
        
        PID:3364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20879.exe
        7⤵
        
        PID:7696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11667.exe
        7⤵
        
        PID:8576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16178.exe
        6⤵
        
        PID:4512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18468.exe
        6⤵
        
        PID:6216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40887.exe
        6⤵
        
        PID:7844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42183.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1602.exe
        6⤵
        
        PID:9076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25430.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2848
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2848 -s 240
        6⤵
        Program crash
        
        PID:464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31978.exe
        5⤵
        
        PID:2312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38462.exe
        6⤵
        
        PID:3920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63252.exe
        7⤵
        
        PID:7000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52025.exe
        7⤵
        
        PID:7268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20332.exe
        7⤵
        
        PID:8752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47412.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6033.exe
        6⤵
        
        PID:4988
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2312 -s 244
        6⤵
        
        PID:6132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51793.exe
        5⤵
        
        PID:4016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49329.exe
        6⤵
        
        PID:6860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35553.exe
        6⤵
        
        PID:7920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63778.exe
        6⤵
        
        PID:8260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55025.exe
        6⤵
        
        PID:9516
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2944 -s 244
        5⤵
        Program crash
        
        PID:4196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18579.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18579.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49380.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2916
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2916 -s 224
        6⤵
        Program crash
        
        PID:1816
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2216 -s 228
        5⤵
        Program crash
        
        PID:2456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46375.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46375.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8596.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17912.exe
        6⤵
        
        PID:2192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1949.exe
        7⤵
        
        PID:4072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40018.exe
        7⤵
        
        PID:5380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50332.exe
        7⤵
        
        PID:6412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25627.exe
        7⤵
        
        PID:7348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40724.exe
        7⤵
        
        PID:8448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5486.exe
        7⤵
        
        PID:8828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35752.exe
        6⤵
        
        PID:4080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4937.exe
        6⤵
        
        PID:6108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62144.exe
        6⤵
        
        PID:3056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29576.exe
        6⤵
        
        PID:7496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42387.exe
        6⤵
        
        PID:8784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50590.exe
        6⤵
        
        PID:9764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22358.exe
        5⤵
        
        PID:836
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 836 -s 220
        6⤵
        Program crash
        
        PID:4044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16431.exe
        5⤵
        
        PID:3340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14694.exe
        5⤵
        
        PID:5280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6691.exe
        5⤵
        
        PID:6884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26637.exe
        5⤵
        
        PID:7820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1892.exe
        5⤵
        
        PID:9004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1348.exe
        5⤵
        
        PID:9828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40507.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40507.exe
      4⤵
      PID:2952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26080.exe
        5⤵
        
        PID:2656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14585.exe
        6⤵
        
        PID:3652
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2656 -s 248
        6⤵
        Program crash
        
        PID:6096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43921.exe
        5⤵
        
        PID:3292
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2952 -s 240
        5⤵
        Program crash
        
        PID:6060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16758.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16758.exe
      4⤵
      PID:2972
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2972 -s 240
        5⤵
        Program crash
        
        PID:3992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11172.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11172.exe
      4⤵
      PID:3440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35132.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35132.exe
      4⤵
      PID:5392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57918.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57918.exe
      4⤵
      PID:6256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37700.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37700.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35227.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35227.exe
      4⤵
      PID:8972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38205.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38205.exe
      4⤵
      PID:8808
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8741.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8741.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2920
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2920 -s 244
      4⤵
      Loads dropped DLL
      Program crash
      PID:2936
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28070.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28070.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:3016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49406.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49406.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42364.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:344
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 344 -s 220
        6⤵
        Program crash
        
        PID:2348
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1260 -s 248
        5⤵
        Program crash
        
        PID:2228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1886.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1886.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6121.exe
        5⤵
        
        PID:988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36625.exe
        6⤵
        
        PID:3448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15151.exe
        7⤵
        
        PID:5132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50712.exe
        7⤵
        
        PID:6700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56881.exe
        7⤵
        
        PID:7652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34724.exe
        7⤵
        
        PID:8832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22348.exe
        7⤵
        
        PID:9836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21637.exe
        6⤵
        
        PID:4532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56551.exe
        6⤵
        
        PID:5900
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 988 -s 236
        6⤵
        
        PID:6456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58944.exe
        5⤵
        
        PID:3576
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3576 -s 224
        6⤵
        Program crash
        
        PID:4104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27012.exe
        5⤵
        
        PID:4616
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2924 -s 248
        5⤵
        
        PID:5332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29539.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29539.exe
      4⤵
      PID:2232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6344.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33143.exe
        6⤵
        
        PID:4664
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2164 -s 248
        6⤵
        
        PID:5324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19032.exe
        5⤵
        
        PID:3724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8829.exe
        5⤵
        
        PID:5272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15356.exe
        5⤵
        
        PID:6988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43173.exe
        5⤵
        
        PID:7884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50364.exe
        5⤵
        
        PID:9036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22878.exe
        5⤵
        
        PID:9868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23724.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23724.exe
      4⤵
      PID:2328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65265.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-849.exe
        5⤵
        
        PID:5744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20098.exe
        5⤵
        
        PID:6596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1869.exe
        5⤵
        
        PID:8028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28113.exe
        5⤵
        
        PID:8400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29824.exe
        5⤵
        
        PID:9476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15302.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15302.exe
      4⤵
      PID:4088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60786.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60786.exe
      4⤵
      PID:5728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17828.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17828.exe
      4⤵
      PID:6948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37740.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37740.exe
      4⤵
      PID:8084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5862.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5862.exe
      4⤵
      PID:8492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24224.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24224.exe
      4⤵
      PID:9492
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24445.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24445.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26028.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26028.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40714.exe
        5⤵
        
        PID:1092
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1092 -s 244
        6⤵
        Program crash
        
        PID:3236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53874.exe
        5⤵
        
        PID:3628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17191.exe
        6⤵
        
        PID:4364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6059.exe
        6⤵
        
        PID:5720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6751.exe
        6⤵
        
        PID:6856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58299.exe
        6⤵
        
        PID:7460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13287.exe
        6⤵
        
        PID:8696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54495.exe
        6⤵
        
        PID:9288
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1732 -s 244
        5⤵
        Program crash
        
        PID:4756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36992.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36992.exe
      4⤵
      PID:1828
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1828 -s 220
        5⤵
        Program crash
        
        PID:2476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14734.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14734.exe
      4⤵
      PID:3100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6931.exe
        5⤵
        
        PID:4396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49853.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5436
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3100 -s 224
        5⤵
        
        PID:7340
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1544 -s 236
      4⤵
      Program crash
      PID:4204
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41602.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41602.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35670.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35670.exe
      4⤵
      PID:1292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50906.exe
        5⤵
        
        PID:3780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2847.exe
        6⤵
        
        PID:4360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49853.exe
        6⤵
        
        PID:6068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24213.exe
        6⤵
        
        PID:7332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34729.exe
        6⤵
        
        PID:7596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29836.exe
        6⤵
        
        PID:8692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63594.exe
        5⤵
        
        PID:4936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13162.exe
        5⤵
        
        PID:6124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45263.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27926.exe
        5⤵
        
        PID:7436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44629.exe
        5⤵
        
        PID:9176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59437.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59437.exe
      4⤵
      PID:3948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14744.exe
        5⤵
        
        PID:6832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51314.exe
        5⤵
        
        PID:7456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41111.exe
        5⤵
        
        PID:8900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31014.exe
        5⤵
        
        PID:9860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44273.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44273.exe
      4⤵
      PID:5104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19027.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19027.exe
      4⤵
      PID:5296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40682.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40682.exe
      4⤵
      PID:6992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11391.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11391.exe
      4⤵
      PID:7648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61695.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61695.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:8236
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59213.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59213.exe
    3⤵
    PID:2748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64886.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64886.exe
      4⤵
      PID:3488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46115.exe
        5⤵
        
        PID:8548
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3488 -s 228
        5⤵
        
        PID:8912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16998.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16998.exe
      4⤵
      PID:4640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21268.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21268.exe
      4⤵
      PID:6232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-551.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-551.exe
      4⤵
      PID:7856
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2748 -s 244
      4⤵
      PID:8332
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9314.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9314.exe
    3⤵
    PID:3808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51534.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51534.exe
      4⤵
      PID:3996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56739.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56739.exe
      4⤵
      PID:6080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56279.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56279.exe
      4⤵
      PID:6468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38242.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38242.exe
      4⤵
      PID:7464
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3808 -s 244
      4⤵
      PID:8764
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58167.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58167.exe
    3⤵
    PID:3184
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37062.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37062.exe
    3⤵
    PID:5176
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50092.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50092.exe
    3⤵
    PID:6908
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58838.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58838.exe
    3⤵
    PID:7780
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64364.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64364.exe
    3⤵
    PID:8980
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35214.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35214.exe
    3⤵
    PID:9812
- C:\Users\Admin\AppData\Local\Temp\Unicorn-45464.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-45464.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2128
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28607.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28607.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4076.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4076.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:1764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33070.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53464.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21041.exe
        7⤵
        
        PID:2208
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2208 -s 240
        8⤵
        Program crash
        
        PID:2504
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2652 -s 248
        7⤵
        Program crash
        
        PID:3160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46100.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1575.exe
        7⤵
        
        PID:2420
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2420 -s 244
        8⤵
        Program crash
        
        PID:3376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24403.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11761.exe
        7⤵
        
        PID:5936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4967.exe
        7⤵
        
        PID:6200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33852.exe
        7⤵
        
        PID:7292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42579.exe
        7⤵
        
        PID:1376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14902.exe
        7⤵
        
        PID:9668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33078.exe
        6⤵
        
        PID:1844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44269.exe
        7⤵
        
        PID:3436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63563.exe
        7⤵
        
        PID:5980
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1844 -s 240
        7⤵
        
        PID:6224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62177.exe
        6⤵
        
        PID:3840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2137.exe
        6⤵
        
        PID:6088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36943.exe
        6⤵
        
        PID:6460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30107.exe
        6⤵
        
        PID:7492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33838.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8776
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 952 -s 244
        6⤵
        
        PID:9756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59447.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30818.exe
        6⤵
        
        PID:1276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33693.exe
        7⤵
        
        PID:3604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16034.exe
        8⤵
        
        PID:4964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55063.exe
        8⤵
        
        PID:6640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2854.exe
        8⤵
        
        PID:7948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50318.exe
        8⤵
        
        PID:8360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22602.exe
        8⤵
        
        PID:9116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13085.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4776
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1276 -s 244
        7⤵
        
        PID:5204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18788.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43543.exe
        7⤵
        
        PID:6472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46488.exe
        7⤵
        
        PID:7868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44453.exe
        7⤵
        
        PID:8340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31268.exe
        7⤵
        
        PID:9028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3624.exe
        6⤵
        
        PID:4824
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2612 -s 228
        6⤵
        
        PID:5256
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1764 -s 244
        5⤵
        Program crash
        
        PID:1696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33624.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33624.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34388.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52582.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31446.exe
        7⤵
        
        PID:4064
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4064 -s 224
        8⤵
        Program crash
        
        PID:4172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52603.exe
        7⤵
        
        PID:4276
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 932 -s 244
        7⤵
        
        PID:5548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32000.exe
        6⤵
        
        PID:4092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53525.exe
        7⤵
        
        PID:7620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6405.exe
        7⤵
        
        PID:8212
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4092 -s 224
        7⤵
        
        PID:8812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-801.exe
        6⤵
        
        PID:4304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3916.exe
        6⤵
        
        PID:5952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17329.exe
        6⤵
        
        PID:7300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9528.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30367.exe
        6⤵
        
        PID:8716
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 808 -s 248
        5⤵
        Program crash
        
        PID:1676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19897.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19897.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40906.exe
        5⤵
        
        PID:1728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24757.exe
        6⤵
        
        PID:3204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43942.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3796
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3204 -s 228
        7⤵
        
        PID:5704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62862.exe
        6⤵
        
        PID:4320
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1728 -s 240
        6⤵
        Program crash
        
        PID:5628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25311.exe
        5⤵
        
        PID:3248
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3248 -s 220
        6⤵
        Program crash
        
        PID:4160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11060.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4308
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 956 -s 248
        5⤵
        
        PID:5576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32281.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32281.exe
      4⤵
      PID:812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64502.exe
        5⤵
        
        PID:3692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50946.exe
        6⤵
        
        PID:6408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60427.exe
        6⤵
        
        PID:8944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61539.exe
        5⤵
        
        PID:4820
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 812 -s 240
        5⤵
        
        PID:6320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37372.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37372.exe
      4⤵
      PID:3884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8813.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4973.exe
        5⤵
        
        PID:10212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55939.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55939.exe
      4⤵
      PID:4752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55755.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55755.exe
      4⤵
      PID:6348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36422.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36422.exe
      4⤵
      PID:7836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15317.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15317.exe
      4⤵
      PID:8304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-467.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-467.exe
      4⤵
      PID:8952
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8715.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8715.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20818.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20818.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:532
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 532 -s 224
        5⤵
        Program crash
        
        PID:2784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39026.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39026.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45483.exe
        5⤵
        
        PID:1640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22375.exe
        6⤵
        
        PID:3012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4610.exe
        7⤵
        
        PID:10136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28539.exe
        6⤵
        
        PID:4888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3261.exe
        6⤵
        
        PID:6752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45476.exe
        6⤵
        
        PID:8064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49629.exe
        6⤵
        
        PID:8464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6067.exe
        6⤵
        
        PID:9180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32249.exe
        5⤵
        
        PID:3196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30205.exe
        6⤵
        
        PID:9732
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2460 -s 220
        5⤵
        Program crash
        
        PID:4796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28444.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28444.exe
      4⤵
      PID:2352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21223.exe
        5⤵
        
        PID:3932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35425.exe
        6⤵
        
        PID:8704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40023.exe
        5⤵
        
        PID:4256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58025.exe
        5⤵
        
        PID:6376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-551.exe
        5⤵
        
        PID:7876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41653.exe
        5⤵
        
        PID:8324
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2352 -s 216
        5⤵
        
        PID:8268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54974.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54974.exe
      4⤵
      PID:4012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10858.exe
        5⤵
        
        PID:9792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39283.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39283.exe
      4⤵
      PID:4152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49462.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49462.exe
      4⤵
      PID:6676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-584.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-584.exe
      4⤵
      PID:7932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20652.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20652.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:8368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61804.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61804.exe
      4⤵
      PID:8640
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43276.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43276.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1524
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1524 -s 220
      4⤵
      Program crash
      PID:2844
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34123.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34123.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43454.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43454.exe
      4⤵
      PID:1924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12696.exe
        5⤵
        
        PID:2308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25899.exe
        6⤵
        
        PID:5056
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2308 -s 248
        6⤵
        
        PID:5308
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1924 -s 216
        5⤵
        Program crash
        
        PID:4188
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2564 -s 228
      4⤵
      Program crash
      PID:3168
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29178.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29178.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1936
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1936 -s 224
      4⤵
      Program crash
      PID:744
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38979.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38979.exe
    3⤵
    PID:2616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31109.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31109.exe
      4⤵
      PID:4652
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2616 -s 228
      4⤵
      PID:6664
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7446.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7446.exe
    3⤵
    PID:4248
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61531.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61531.exe
    3⤵
    PID:5740
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43152.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43152.exe
    3⤵
    PID:6608
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31582.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31582.exe
    3⤵
    PID:7480
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28953.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28953.exe
    3⤵
    PID:8672
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27462.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27462.exe
    3⤵
    PID:9424
- C:\Users\Admin\AppData\Local\Temp\Unicorn-26560.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-26560.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2628
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12436.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12436.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56650.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56650.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:1960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39375.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:892
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 892 -s 244
        6⤵
        Program crash
        
        PID:2776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33271.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34632.exe
        6⤵
        
        PID:440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27741.exe
        7⤵
        
        PID:3532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45198.exe
        7⤵
        
        PID:5424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25601.exe
        7⤵
        
        PID:6308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2964.exe
        7⤵
        
        PID:7588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19561.exe
        7⤵
        
        PID:8992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24204.exe
        7⤵
        
        PID:8856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45400.exe
        6⤵
        
        PID:3788
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1380 -s 240
        6⤵
        Program crash
        
        PID:5708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61174.exe
        5⤵
        
        PID:580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13625.exe
        6⤵
        
        PID:3968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63563.exe
        6⤵
        
        PID:5988
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 580 -s 240
        6⤵
        
        PID:6296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54009.exe
        5⤵
        
        PID:3624
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1960 -s 244
        5⤵
        Program crash
        
        PID:6116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41465.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41465.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8212.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40517.exe
        6⤵
        
        PID:1556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37004.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3588
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1556 -s 248
        7⤵
        Program crash
        
        PID:4628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15083.exe
        6⤵
        
        PID:3708
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1700 -s 244
        6⤵
        Program crash
        
        PID:5080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16375.exe
        5⤵
        
        PID:1968
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1968 -s 240
        6⤵
        Program crash
        
        PID:3116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33727.exe
        5⤵
        
        PID:3552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25660.exe
        5⤵
        
        PID:5564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3951.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33098.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13817.exe
        5⤵
        
        PID:8624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8997.exe
        5⤵
        
        PID:9392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18226.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18226.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50008.exe
        5⤵
        
        PID:2220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13459.exe
        6⤵
        
        PID:3740
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2220 -s 248
        6⤵
        Program crash
        
        PID:4700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9930.exe
        5⤵
        
        PID:3892
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1912 -s 244
        5⤵
        Program crash
        
        PID:5028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57719.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57719.exe
      4⤵
      PID:2248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54466.exe
        5⤵
        
        PID:3472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63563.exe
        5⤵
        
        PID:6004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64639.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42518.exe
        5⤵
        
        PID:7284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59115.exe
        5⤵
        
        PID:8648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63374.exe
        5⤵
        
        PID:9656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8779.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8779.exe
      4⤵
      PID:4052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57963.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57963.exe
      4⤵
      PID:5924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62369.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62369.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12852.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12852.exe
      4⤵
      PID:7288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32779.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32779.exe
      4⤵
      PID:8636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57774.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57774.exe
      4⤵
      PID:9640
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44953.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44953.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31207.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31207.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1715.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5275.exe
        6⤵
        
        PID:2580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60.exe
        7⤵
        
        PID:3280
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3280 -s 224
        8⤵
        Program crash
        
        PID:5048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17745.exe
        7⤵
        
        PID:4404
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2580 -s 240
        7⤵
        Program crash
        
        PID:5596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12867.exe
        6⤵
        
        PID:3356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1425.exe
        7⤵
        
        PID:5260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7782.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62636.exe
        7⤵
        
        PID:7612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28227.exe
        7⤵
        
        PID:9012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40740.exe
        7⤵
        
        PID:9112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2700.exe
        6⤵
        
        PID:4460
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 264 -s 248
        6⤵
        
        PID:5692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58923.exe
        5⤵
        
        PID:1588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65405.exe
        6⤵
        
        PID:3400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2847.exe
        7⤵
        
        PID:4376
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3400 -s 228
        7⤵
        
        PID:5528
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1588 -s 228
        6⤵
        Program crash
        
        PID:4544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27754.exe
        5⤵
        
        PID:3492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26122.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65151.exe
        6⤵
        
        PID:7160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54468.exe
        6⤵
        
        PID:7500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24143.exe
        6⤵
        
        PID:8932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32571.exe
        6⤵
        
        PID:8860
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2108 -s 236
        5⤵
        Program crash
        
        PID:4632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33463.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33463.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3246.exe
        5⤵
        
        PID:600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34949.exe
        6⤵
        
        PID:3760
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 600 -s 248
        6⤵
        Program crash
        
        PID:4968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50771.exe
        5⤵
        
        PID:4036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48772.exe
        5⤵
        
        PID:5036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5618.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62960.exe
        5⤵
        
        PID:7296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-997.exe
        5⤵
        
        PID:8740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39277.exe
        5⤵
        
        PID:8452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26581.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26581.exe
      4⤵
      PID:640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16584.exe
        5⤵
        
        PID:3544
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 640 -s 228
        5⤵
        Program crash
        
        PID:4524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13194.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13194.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45972.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45972.exe
      4⤵
      PID:4288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45954.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45954.exe
      4⤵
      PID:7016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63490.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63490.exe
      4⤵
      PID:7276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62069.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62069.exe
      4⤵
      PID:8720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12411.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12411.exe
      4⤵
      PID:9120
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45497.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45497.exe
    3⤵
    - Executes dropped EXE
    PID:792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24357.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24357.exe
      4⤵
      Suspicious use of SetWindowsHookEx
      PID:904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46443.exe
        5⤵
        
        PID:2572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32188.exe
        6⤵
        
        PID:3336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37994.exe
        7⤵
        
        PID:9404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45369.exe
        6⤵
        
        PID:4832
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2572 -s 240
        6⤵
        
        PID:6692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36634.exe
        5⤵
        
        PID:3524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5819.exe
        5⤵
        
        PID:4900
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 904 -s 248
        5⤵
        
        PID:6764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48342.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48342.exe
      4⤵
      PID:2156
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2156 -s 224
        5⤵
        Program crash
        
        PID:3080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7692.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7692.exe
      4⤵
      PID:3192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48140.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48140.exe
      4⤵
      PID:4856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-461.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-461.exe
      4⤵
      PID:6632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49055.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49055.exe
      4⤵
      PID:7940
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 792 -s 244
      4⤵
      PID:8312
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56764.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56764.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37756.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37756.exe
      4⤵
      PID:652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40185.exe
        5⤵
        
        PID:3264
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 652 -s 236
        5⤵
        Program crash
        
        PID:5956
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1620 -s 236
      4⤵
      Program crash
      PID:3096
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49054.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49054.exe
    3⤵
    PID:660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55182.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55182.exe
      4⤵
      PID:3636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47492.exe
        5⤵
        
        PID:6844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52601.exe
        5⤵
        
        PID:8172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24992.exe
        5⤵
        
        PID:8608
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3636 -s 228
        5⤵
        
        PID:9048
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 660 -s 236
      4⤵
      Program crash
      PID:4764
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25440.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25440.exe
    3⤵
    PID:3772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46366.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46366.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18646.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18646.exe
      4⤵
      PID:7388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23108.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23108.exe
      4⤵
      PID:624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13971.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13971.exe
      4⤵
      PID:8460
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1354.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1354.exe
    3⤵
    PID:4844
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54898.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54898.exe
    3⤵
    PID:5124
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10262.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10262.exe
    3⤵
    PID:6452
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5791.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5791.exe
    3⤵
    PID:7400
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11293.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11293.exe
    3⤵
    PID:9156
- C:\Users\Admin\AppData\Local\Temp\Unicorn-61180.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-61180.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:2648
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45706.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45706.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16215.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16215.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1612
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1612 -s 224
        5⤵
        Program crash
        
        PID:2448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26063.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26063.exe
      4⤵
      Executes dropped EXE
      PID:2300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18047.exe
        5⤵
        
        PID:948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55431.exe
        6⤵
        
        PID:3964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60640.exe
        7⤵
        
        PID:9136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24455.exe
        6⤵
        
        PID:4704
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 948 -s 240
        6⤵
        
        PID:6708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63962.exe
        5⤵
        
        PID:4056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48959.exe
        6⤵
        
        PID:9964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42275.exe
        5⤵
        
        PID:4872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9126.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36810.exe
        5⤵
        
        PID:8076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33093.exe
        5⤵
        
        PID:8472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23132.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28060.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28060.exe
      4⤵
      PID:2176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38654.exe
        5⤵
        
        PID:3732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11399.exe
        6⤵
        
        PID:4180
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3732 -s 228
        6⤵
        
        PID:5512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55426.exe
        5⤵
        
        PID:4836
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2176 -s 244
        5⤵
        
        PID:5420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30029.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30029.exe
      4⤵
      PID:3876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34233.exe
        5⤵
        
        PID:4996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44290.exe
        5⤵
        
        PID:6396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60223.exe
        5⤵
        
        PID:7912
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3876 -s 228
        5⤵
        
        PID:8384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16968.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16968.exe
      4⤵
      PID:5000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59364.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59364.exe
      4⤵
      PID:5432
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41212.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41212.exe
      4⤵
      PID:6316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28415.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28415.exe
      4⤵
      PID:7888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34829.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34829.exe
      4⤵
      PID:8392
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12685.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12685.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64258.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64258.exe
      4⤵
      PID:2172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19002.exe
        5⤵
        
        PID:3152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9669.exe
        6⤵
        
        PID:8120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5829.exe
        6⤵
        
        PID:8516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25402.exe
        6⤵
        
        PID:8792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48519.exe
        5⤵
        
        PID:4292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63588.exe
        5⤵
        
        PID:6040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25995.exe
        5⤵
        
        PID:7316
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2172 -s 244
        5⤵
        
        PID:7328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40936.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40936.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19364.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27811.exe
        5⤵
        
        PID:8852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18481.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18481.exe
      4⤵
      PID:4572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27134.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27134.exe
      4⤵
      PID:6204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57423.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57423.exe
      4⤵
      PID:7804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25117.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25117.exe
      4⤵
      PID:8296
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2316 -s 240
      4⤵
      PID:8920
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22523.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22523.exe
    3⤵
    PID:2800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56718.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56718.exe
      4⤵
      PID:3428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58346.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50230.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4746.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4746.exe
      4⤵
      PID:4584
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2800 -s 224
      4⤵
      PID:6248
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17449.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17449.exe
    3⤵
    PID:3800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45160.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45160.exe
      4⤵
      PID:7208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29788.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29788.exe
      4⤵
      PID:8444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24821.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24821.exe
      4⤵
      PID:3956
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6937.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6937.exe
    3⤵
    PID:4784
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38689.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38689.exe
    3⤵
    PID:6360
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57953.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57953.exe
    3⤵
    PID:7824
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2648 -s 236
    3⤵
    PID:8280
- C:\Users\Admin\AppData\Local\Temp\Unicorn-7995.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-7995.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1596
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52971.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52971.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49437.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49437.exe
      4⤵
      PID:2136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33885.exe
        5⤵
        
        PID:3516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28120.exe
        6⤵
        
        PID:4944
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3516 -s 216
        6⤵
        
        PID:6340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13277.exe
        5⤵
        
        PID:4676
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2136 -s 244
        5⤵
        
        PID:5196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35316.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35316.exe
      4⤵
      PID:3644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56926.exe
        5⤵
        
        PID:5864
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3644 -s 216
        5⤵
        
        PID:7380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26820.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26820.exe
      4⤵
      PID:4744
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1572 -s 228
      4⤵
      PID:5316
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59468.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59468.exe
    3⤵
    PID:2512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52577.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52577.exe
      4⤵
      PID:1316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49671.exe
        5⤵
        
        PID:4556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42815.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5912
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1316 -s 244
        5⤵
        
        PID:6892
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2512 -s 248
      4⤵
      Program crash
      PID:3836
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1596 -s 240
    3⤵
    - Program crash
    PID:2240
- C:\Users\Admin\AppData\Local\Temp\Unicorn-39757.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-39757.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2412
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57029.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57029.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37756.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37756.exe
      4⤵
      PID:2404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39422.exe
        5⤵
        
        PID:3200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53582.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62679.exe
        6⤵
        
        PID:9124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27779.exe
        6⤵
        
        PID:9360
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2404 -s 228
        5⤵
        Program crash
        
        PID:4328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16240.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16240.exe
      4⤵
      PID:3568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8270.exe
        5⤵
        
        PID:5832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26591.exe
        5⤵
        
        PID:7064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65433.exe
        5⤵
        
        PID:7180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55528.exe
        5⤵
        
        PID:8564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14372.exe
        5⤵
        
        PID:9680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9737.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9737.exe
      4⤵
      PID:4860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63890.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63890.exe
      4⤵
      PID:6368
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2372 -s 224
      4⤵
      PID:7812
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62815.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62815.exe
    3⤵
    PID:2492
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2492 -s 224
      4⤵
      Program crash
      PID:3384
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48528.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48528.exe
    3⤵
    PID:3560
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17626.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17626.exe
    3⤵
    PID:5996
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61839.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61839.exe
    3⤵
    PID:7136
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17317.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17317.exe
    3⤵
    PID:7228
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59645.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59645.exe
    3⤵
    PID:1088
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58908.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58908.exe
    3⤵
    PID:9624
- C:\Users\Admin\AppData\Local\Temp\Unicorn-32101.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-32101.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1792
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8207.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8207.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2600
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2600 -s 244
      4⤵
      Program crash
      PID:3860
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10615.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10615.exe
    3⤵
    PID:3144
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57864.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57864.exe
    3⤵
    PID:5488
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27383.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27383.exe
    3⤵
    PID:6264
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59836.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59836.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:7580
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3026.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3026.exe
    3⤵
    PID:8984
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41270.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41270.exe
    3⤵
    PID:9068
- C:\Users\Admin\AppData\Local\Temp\Unicorn-14841.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-14841.exe
  2⤵
  PID:1760
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55945.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55945.exe
    3⤵
    PID:3728
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7865.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7865.exe
    3⤵
    PID:5620
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43391.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43391.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6724
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4801.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4801.exe
    3⤵
    PID:7796
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24413.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24413.exe
    3⤵
    PID:9160
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8444.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8444.exe
    3⤵
    PID:9352
- C:\Users\Admin\AppData\Local\Temp\Unicorn-38167.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-38167.exe
  2⤵
  PID:3904
- C:\Users\Admin\AppData\Local\Temp\Unicorn-55185.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-55185.exe
  2⤵
  PID:5696
- C:\Users\Admin\AppData\Local\Temp\Unicorn-32964.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-32964.exe
  2⤵
  PID:6900
- C:\Users\Admin\AppData\Local\Temp\Unicorn-56206.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-56206.exe
  2⤵
  PID:8044
- C:\Users\Admin\AppData\Local\Temp\Unicorn-40979.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-40979.exe
  2⤵
  PID:8416
- C:\Users\Admin\AppData\Local\Temp\Unicorn-18624.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-18624.exe
  2⤵
  PID:9456

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-27811.exe

Filesize
468KB

MD5
6e7d793e44d5ee87d99fcf9ddea0a1db

SHA1
5ec1d18675129e5d0d972cfca44c67d76587a196

SHA256
eaa01909deb28afbdb204fec3b7b05378bd53e66fa740be2f108a156cef7b788

SHA512
7fa82886897c91f791ffa2fcaca1bd4312615c77e63e695ecde1385a7a3554267362aae33fc789a6b18d6e70b49d5b8f1b91861587e903010a8175ea377c5133

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-35752.exe

Filesize
468KB

MD5
15bce2d8e94f1f88c563f3d89d15e42c

SHA1
2a0781bb987c52c79a9ba4562322a3bc54ca5ee4

SHA256
6e062d5c86f0286dc33a3e89f3b41304e8de30fc7f405ee0bf835b99579acbcf

SHA512
3aec67dc03bfc0d986b0d94423f98bbf6be1231723128760277cf103872d815c2d2ec640b91b8a7600f03c847322ffc00def08c7d73a6da2a52a3d2e26a4a821

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-4076.exe

Filesize
468KB

MD5
9d5a5f067224dc5af14884f22fef0ad0

SHA1
80d81617efed16967c32edf67cbc379eff642ad4

SHA256
7938fbd420ba7752a6d62bfaeb53713044f83e2ad7c0c8a56ce21cc08f975aa1

SHA512
8330911844097f37bbfc6e06ee9d1beca26e90fa175c3bac33a1f6d8ce372f5a5b6c539df4b57ab4dba231d43e3c87293f69f9dc61ae94fc6a7709f78f065158

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5486.exe

Filesize
468KB

MD5
2efe5484c6a4cf8cfd9826bf18230aba

SHA1
cd3ca27ab5e5938d4511ea8fd2d25df68230f45e

SHA256
9999942a7434f84c01df7b3dddbeb8007524bc1e68429645dfcce27c256a0a8c

SHA512
602fa8d0c4d96b0f6d42badf9c5e28718f5cac1bc744b7926242e159eb338e4ce845e31727e6776462306cd6eee662408a37196765c5120a9bf6d0626496e609

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-56881.exe

Filesize
468KB

MD5
3a93f62d2087c55db2680801e2092006

SHA1
ea7f5efa7832dd601fbeea0b672259f0e443b4ac

SHA256
5693afe23c9285c8a78699840fbf8d64de5cd415ad5458b376d9f9d6ae24511d

SHA512
8b544bfbd19b7e6d52a78c0468feb7220868faee66d76dcf4cff079f6bb2202c80a4c85cc7308d2ae5924c53be2ee6e5fca018e408eec7838545fde05a355aac

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-8741.exe

Filesize
468KB

MD5
20f8aeea6afa7ed3062a98ffbaa8344e

SHA1
2effbb49495487e7bd59e430eea98bb133b0934d

SHA256
151410c6f83ef4dcd8633d17adfb994cffbaddf3111735c438803ecde69f2aa4

SHA512
807948dd694cad9a168ec8a45609ae19a7200f63e4ab5484660c7ddb8bbe74d09d99f4a2658c3911445991daf7246f6a456a2c8847b62ff6fef2925c112d86bc

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-12436.exe

Filesize
468KB

MD5
734b3d2c156376496afbbd6ddb373af1

SHA1
79d918806c90f5200b90acc9882596d346d9da16

SHA256
50cb864d1c12f5540020e8de05cc2b18d84e4fce1f207267f08faa6a56f34393

SHA512
baf3a9b7e0ba55a74ee3e28a09bd458c4cb71ad25c7683ed6cf29d14b9bcb74adec0f04cf4f5f3ba368549bfe930bbf269a3cdb99796070fb3ebc37e358f184a

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-14335.exe

Filesize
468KB

MD5
a2c6ac1f6a2ca2ea4d51dce6e8aae503

SHA1
3eb399f5253a253e1e5ce0b091d15b77d347163f

SHA256
6a714b9c74b3eb414378431df724b07f358e0bd7256ab1abfd92d8d19f554a25

SHA512
ddaf270ff00271a0e8c2d99e35c970dd8b69d346fdda4bbe09aa9607244d5ece6b1de695fc4244c2580c3e59416506f3be92d22ff11f04263c722eaa1e437919

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-20413.exe

Filesize
468KB

MD5
6b441c368add86e944067abc408e2b0a

SHA1
207b57c2ff8929a0a639433132051f76e65b52c4

SHA256
64843f8d2f11ee21c0311460efdff0a12a8b42e5141c321d97a8eabf9701a1f7

SHA512
76aea11fb267f599a97eeef915a9e19cbc11eed43a43e58e9f48c981a96d9914f83bbc4affc1052a9e74a8842938640d1feed951c4dcb467d7c86b5f944a44cb

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-24523.exe

Filesize
468KB

MD5
649b75f50b9945d0ef30f0fb45c2eb6e

SHA1
7416c1060387f37101dadaf07324c64bb301144b

SHA256
8ac0b1965243c1a41f1453101c53eccb244ffc2ee773d63223cfb5ebe670222d

SHA512
754553cfb1f0b2fc7ac571061a8f303001211ba15b880ff076c07f25e209b9b63d46c1e176df8171b7eccd46fea4ac3b6457448e9f57576cb04e6fb57b59a8f6

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-26560.exe

Filesize
468KB

MD5
eee5bee82f8e02aa04b8f5bbbd9fe3a9

SHA1
9090862d1bb827a8cd0256e6e08d2f00aa39c897

SHA256
ca7f669bfa2cc01e6538cb4e5563eeae336b0f76e074b5059110fe8e241acd54

SHA512
8057b244bd1e930c9a1d07f93b71f91f4785fb1d5f111d8807911110aa1e7a669836b692b6a6db8028ab76c7a4b26b7f15ffd045fffbbe67b9316f42b19b53b5

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-28070.exe

Filesize
468KB

MD5
aa66a89582932410a97f0e24bb386d78

SHA1
9982cb15924deb7a4ae2b304e1efe965a4e3bde9

SHA256
3442644b21a83255f0b5fb41a7e554e9736ac19418d2f578dd69d0eba4c53646

SHA512
4c2b1f2a2cf33432e9c4812f620f186c76703b88c2452c3829c562459b14063b97c1c123c1517eb99b669dda92b05f0ed4233f6bc4fe4a660730e4880180bd77

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-28607.exe

Filesize
468KB

MD5
f9eff9a692e05bd6ad70fddd181ae95d

SHA1
92294f7d4f133b0b06eb4dc2ce0085a295f45ae4

SHA256
bdb94ef27f4a85c224bfbd254f28d60030e4c4b71923667402052c50a5bc0541

SHA512
3230dc33cb7c5741c2a673882cafd1d75110c66c33b7d7f214fdb03af0386b75a2d8bda4f3c357fef01291bb0999c3152bbefbff630cd78bdf391a309b8f04bc

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-44953.exe

Filesize
468KB

MD5
3727a5a32d9c4034ae897a5b987dfb1c

SHA1
7e84fa04eb24b98866704a7cbbdaf25171ffdd17

SHA256
bb071c27002982c1fa7fe2569bb67b01d3e2b84a59ff5229121ce6d7e7bbfd13

SHA512
b35d1d64a11c7a22a37c05d2b469c182d34b25c2278582245838f25387add30f9cf4d0ee408c8d6e7c9c295d0d40927ae7dc3d119bf32f1afe02f18f39f5676f

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-45464.exe

Filesize
468KB

MD5
fdc75a1a2a11e547d23314de867be678

SHA1
c74a04d428c20892cbc370455a247fa6442def4f

SHA256
e3ed1f5f274de497e7e1db9e0116d79135800e735a94cbbe0d6a035b9d59cabe

SHA512
f925386f617cd07a7dd29747f0d477d85fe36cb84855b46646ce5dc81e5ed73a8ea3eb08a864def61ea0d95898c3020e6f6bfde9ec7a3768431730985e6ce34b

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-45706.exe

Filesize
468KB

MD5
3b05e1d74a05d5aabf0d0988ab319d30

SHA1
afda64f2be6b780bb2a6c0f618d1cc7954268ab1

SHA256
66d066a0f75619d9e873558ccb31ca41880ac5a91e0772e5c92bdffb12ded68b

SHA512
e68bc70ff6f784bbe20d3bc2f2dc1eab650050f75497f61f1539e497eb2827d428d8a1a92620f61d218fc059304e39e9a50addb5a77d060496fc37948c92e885

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-47758.exe

Filesize
468KB

MD5
183e9827525f53d66bcd3159c1913f93

SHA1
15159b9c6685693a4c0dc634e6a25bbf77a70225

SHA256
ecc4f4c7b0b50571004d4898012dd5dbc15670a6b330653f6ee1b0d3e87f05f1

SHA512
5dafb10383020a5141799241039ff46f4e6d69f8694ca33d841e5f1dce132d534817f575cd36c900b398a90f1d6282951480c1effedb86d626d1bc26623135b0

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-56650.exe

Filesize
468KB

MD5
2b775e392ed61636a534724560086edb

SHA1
ce853b8fade26a8912b075c5c3965e7ddc19cf55

SHA256
5f09e06d0cee4cddfb7b9d571271576c075010227c5c0e01362a4f740cf87a53

SHA512
cb6ca7dd43bd9230e068fe4bb88a82ae324e292031f0d846f7ed6ffb9d18d3764f858d4afcdb00187d521a2e48695cc319bbe8f26006c56bbb4ab3797ee5bd5e

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-61180.exe

Filesize
468KB

MD5
fcb7d17e269bbe6a205bdc4f14cede07

SHA1
aac68038201b20117dcf5179c6bec98d13f05283

SHA256
6f55ed29fdcb94e7955ff57d6532bb1c6344cb54873801832b49c3a15ef870e2

SHA512
beec39fc43c491a5c8ba0572a1c14af368f99ac74a35b432ef51d6b9db3fadd4178d04ba8f3cc31fdc77d0e1c0ab8ac2607b2d542c85945df2852f862fd6db08

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-61245.exe

Filesize
468KB

MD5
fc518b615746b4295456ad8bf811e64b

SHA1
27b64e1b4ebc0b7718d0036566ab6f95f6d9d2e1

SHA256
f99b106d0d8e492cf782cf18aeab2b850ff93e15692b578fe41e3de0b7692147

SHA512
060cf974685ec7b6024c4140e23471d2e88376a75f6ae965efe5cfb21b9c598be90eaeaec627dd8341f74d80cfe835b192a4e70553f3899d08b1ceff7cd21ffc

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-8715.exe

Filesize
468KB

MD5
5cd7b271e93dff361969ee4c44b9582e

SHA1
105b059cf10337288253dfd044b62f39a6446b86

SHA256
21f5daac74184d10a9f178574bbac740e819053d9863b462b5ecaabccff7fba9

SHA512
81456087ca09aad8124a69db15bf87b0bec7865f3115b6ea7f5efa74d448c91c7d1ddb5531936c13f6a3eff79380e397ad2c069d59f572c39e139e901113ea24

Download Submit
memory/792-1261-0x0000000002750000-0x0000000002860000-memory.dmp

Filesize
1.1MB

Download
memory/792-2079-0x0000000002750000-0x00000000027C5000-memory.dmp

Filesize
468KB

Download
memory/792-2077-0x0000000002750000-0x00000000028AC000-memory.dmp

Filesize
1.4MB

Download
memory/792-2275-0x0000000002750000-0x0000000002860000-memory.dmp

Filesize
1.1MB

Download
memory/792-2276-0x0000000002750000-0x00000000027C5000-memory.dmp

Filesize
468KB

Download
memory/792-2274-0x0000000002750000-0x00000000028AC000-memory.dmp

Filesize
1.4MB

Download
memory/792-2078-0x0000000002750000-0x0000000002860000-memory.dmp

Filesize
1.1MB

Download
memory/792-2990-0x0000000002750000-0x00000000028AC000-memory.dmp

Filesize
1.4MB

Download
memory/792-2995-0x0000000002750000-0x00000000027C5000-memory.dmp

Filesize
468KB

Download
memory/792-2991-0x0000000002750000-0x0000000002860000-memory.dmp

Filesize
1.1MB

Download
memory/792-3329-0x0000000002750000-0x00000000028AC000-memory.dmp

Filesize
1.4MB

Download
memory/792-3331-0x0000000002750000-0x00000000027C5000-memory.dmp

Filesize
468KB

Download
memory/792-3330-0x0000000002750000-0x0000000002860000-memory.dmp

Filesize
1.1MB

Download
memory/792-1262-0x0000000002750000-0x00000000027C5000-memory.dmp

Filesize
468KB

Download
memory/792-1260-0x0000000002750000-0x00000000028AC000-memory.dmp

Filesize
1.4MB

Download