334476d3bfe5866eadf0864ef13c1ad12814e008db1214ac1a517d0c3c646c43

Analysis

max time kernel
120s
max time network
16s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
01/10/2024, 16:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

334476d3bfe5866eadf0864ef13c1ad12814e008db1214ac1a517d0c3c646c43N.exe
Size

468KB
MD5

2eb002a1410f0067ba7e389691e6e1e0
SHA1

d214c9701c381740f551c4d83d647fef75314cb4
SHA256

334476d3bfe5866eadf0864ef13c1ad12814e008db1214ac1a517d0c3c646c43
SHA512

e64ccc1d02f0cc61e393dec46e5a2d241482d2bca2c8437ef06366e72fcab80e96029e76c464a4f3ddaca36c7c91e993bd1a1769e820afeebc02b19fbb98d0a7
SSDEEP

3072:1G3HogISIE5TtbYgHzcOcf8/zCcaP0pkJVHeTVPoQ65LR7KgEslL:1G3obMTtfH4OcfVY1eQ6VVKgE

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2492	Unicorn-41969.exe
2924	Unicorn-63816.exe
2648	Unicorn-39866.exe
2840	Unicorn-19515.exe
2872	Unicorn-15430.exe
2708	Unicorn-61102.exe
1652	Unicorn-21552.exe
2588	Unicorn-33194.exe
2600	Unicorn-55844.exe
2444	Unicorn-4605.exe
568	Unicorn-58445.exe
1628	Unicorn-12773.exe
1832	Unicorn-3536.exe
320	Unicorn-3271.exe
1528	Unicorn-18372.exe
1880	Unicorn-21108.exe
1300	Unicorn-9602.exe
636	Unicorn-17984.exe
1620	Unicorn-25887.exe
2136	Unicorn-59208.exe
1600	Unicorn-55124.exe
2032	Unicorn-59187.exe
1924	Unicorn-25768.exe
1928	Unicorn-34128.exe
956	Unicorn-44334.exe
108	Unicorn-46380.exe
2272	Unicorn-41534.exe
2260	Unicorn-43042.exe
2396	Unicorn-62908.exe
2112	Unicorn-7577.exe
2928	Unicorn-47963.exe
1644	Unicorn-45917.exe
2332	Unicorn-52047.exe
2344	Unicorn-48710.exe
2076	Unicorn-31627.exe
2700	Unicorn-28289.exe
1416	Unicorn-44071.exe
2784	Unicorn-51477.exe
2716	Unicorn-43495.exe
2884	Unicorn-23075.exe
2680	Unicorn-7293.exe
2832	Unicorn-27905.exe
2508	Unicorn-19183.exe
2068	Unicorn-36479.exe
2764	Unicorn-56899.exe
2656	Unicorn-37033.exe
1800	Unicorn-28046.exe
1736	Unicorn-19373.exe
1456	Unicorn-44839.exe
1232	Unicorn-499.exe
2760	Unicorn-6629.exe
2904	Unicorn-23926.exe
2080	Unicorn-12228.exe
2424	Unicorn-60874.exe
1268	Unicorn-1459.exe
1108	Unicorn-16504.exe
668	Unicorn-36370.exe
2528	Unicorn-41200.exe
1840	Unicorn-64885.exe
784	Unicorn-61642.exe
344	Unicorn-62197.exe
2452	Unicorn-16526.exe
2072	Unicorn-61569.exe
2476	Unicorn-24310.exe

Loads dropped DLL 64 IoCs

pid	Process
2512	334476d3bfe5866eadf0864ef13c1ad12814e008db1214ac1a517d0c3c646c43N.exe
2512	334476d3bfe5866eadf0864ef13c1ad12814e008db1214ac1a517d0c3c646c43N.exe
2492	Unicorn-41969.exe
2492	Unicorn-41969.exe
2512	334476d3bfe5866eadf0864ef13c1ad12814e008db1214ac1a517d0c3c646c43N.exe
2512	334476d3bfe5866eadf0864ef13c1ad12814e008db1214ac1a517d0c3c646c43N.exe
2924	Unicorn-63816.exe
2492	Unicorn-41969.exe
2924	Unicorn-63816.exe
2648	Unicorn-39866.exe
2648	Unicorn-39866.exe
2492	Unicorn-41969.exe
2512	334476d3bfe5866eadf0864ef13c1ad12814e008db1214ac1a517d0c3c646c43N.exe
2512	334476d3bfe5866eadf0864ef13c1ad12814e008db1214ac1a517d0c3c646c43N.exe
2708	Unicorn-61102.exe
2708	Unicorn-61102.exe
2492	Unicorn-41969.exe
2492	Unicorn-41969.exe
2840	Unicorn-19515.exe
2840	Unicorn-19515.exe
2924	Unicorn-63816.exe
1652	Unicorn-21552.exe
2924	Unicorn-63816.exe
1652	Unicorn-21552.exe
2872	Unicorn-15430.exe
2512	334476d3bfe5866eadf0864ef13c1ad12814e008db1214ac1a517d0c3c646c43N.exe
2872	Unicorn-15430.exe
2512	334476d3bfe5866eadf0864ef13c1ad12814e008db1214ac1a517d0c3c646c43N.exe
2648	Unicorn-39866.exe
2648	Unicorn-39866.exe
2588	Unicorn-33194.exe
2588	Unicorn-33194.exe
2708	Unicorn-61102.exe
2708	Unicorn-61102.exe
2600	Unicorn-55844.exe
2600	Unicorn-55844.exe
2492	Unicorn-41969.exe
2492	Unicorn-41969.exe
1628	Unicorn-12773.exe
1628	Unicorn-12773.exe
1832	Unicorn-3536.exe
1832	Unicorn-3536.exe
1652	Unicorn-21552.exe
1652	Unicorn-21552.exe
1528	Unicorn-18372.exe
320	Unicorn-3271.exe
1528	Unicorn-18372.exe
320	Unicorn-3271.exe
2648	Unicorn-39866.exe
2444	Unicorn-4605.exe
2512	334476d3bfe5866eadf0864ef13c1ad12814e008db1214ac1a517d0c3c646c43N.exe
2648	Unicorn-39866.exe
2444	Unicorn-4605.exe
2512	334476d3bfe5866eadf0864ef13c1ad12814e008db1214ac1a517d0c3c646c43N.exe
692	WerFault.exe
692	WerFault.exe
692	WerFault.exe
692	WerFault.exe
2840	Unicorn-19515.exe
2840	Unicorn-19515.exe
568	Unicorn-58445.exe
568	Unicorn-58445.exe
2924	Unicorn-63816.exe
2924	Unicorn-63816.exe

Program crash 64 IoCs

pid	pid_target	Process	procid_target
692	2872	WerFault.exe	36
2024	2112	WerFault.exe	61
2188	1416	WerFault.exe	68
2340	2700	WerFault.exe	67
3008	2344	WerFault.exe	65
3012	2508	WerFault.exe	74
2992	2764	WerFault.exe	76
2360	1600	WerFault.exe	51
2004	1800	WerFault.exe	78
908	2528	WerFault.exe	90
356	2032	WerFault.exe	53
584	956	WerFault.exe	56
2624	2656	WerFault.exe	77
1952	1232	WerFault.exe	81
2244	2708	WerFault.exe	35
2768	2072	WerFault.exe	95
2728	2736	WerFault.exe	102
1460	2476	WerFault.exe	96
1152	2748	WerFault.exe	111
2780	1968	WerFault.exe	118
4004	2280	WerFault.exe	140
3612	1516	WerFault.exe	147
3680	1540	WerFault.exe	100
3800	3200	WerFault.exe	237
4084	2260	WerFault.exe	59
4052	3020	WerFault.exe	110
3268	2760	WerFault.exe	82
4404	668	WerFault.exe	89
4412	2312	WerFault.exe	117
4576	1648	WerFault.exe	185
4624	332	WerFault.exe	176
4660	2088	WerFault.exe	126
4680	2136	WerFault.exe	50
4692	532	WerFault.exe	144
4700	2272	WerFault.exe	58
4780	1320	WerFault.exe	125
5060	2356	WerFault.exe	127
3564	1056	WerFault.exe	129
4112	2300	WerFault.exe	146
4120	2424	WerFault.exe	85
4136	2368	WerFault.exe	131
4140	784	WerFault.exe	92
4168	1456	WerFault.exe	80
4184	2948	WerFault.exe	148
4568	2928	WerFault.exe	62
4596	2672	WerFault.exe	160
4736	1212	WerFault.exe	133
4636	3976	WerFault.exe	233
5056	1572	WerFault.exe	128
5108	2080	WerFault.exe	84
5116	1744	WerFault.exe	166
3156	3472	WerFault.exe	196
4260	1612	WerFault.exe	152
4276	1544	WerFault.exe	158
4268	2572	WerFault.exe	150
4532	3160	WerFault.exe	188
4764	3004	WerFault.exe	162
4592	2124	WerFault.exe	154
4720	2192	WerFault.exe	164
4688	1668	WerFault.exe	173
5512	1156	WerFault.exe	157
5468	2324	WerFault.exe	159
5528	616	WerFault.exe	143
5520	1316	WerFault.exe	155

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62908.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55786.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49807.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23021.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23960.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1930.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51514.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63050.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27666.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61569.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13518.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38843.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61666.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6629.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10286.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16888.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23960.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32262.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35751.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4455.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44839.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16241.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44603.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61687.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28715.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44290.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39524.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18370.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10467.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31593.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46285.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37697.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41225.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55672.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33747.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48710.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19927.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16123.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59393.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28110.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19397.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61642.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39866.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58016.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4250.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2065.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28480.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29803.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1459.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64577.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46949.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-831.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46363.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28289.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16923.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28046.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15761.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25661.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55904.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36370.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32950.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1022.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51453.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20067.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2512	334476d3bfe5866eadf0864ef13c1ad12814e008db1214ac1a517d0c3c646c43N.exe
2492	Unicorn-41969.exe
2924	Unicorn-63816.exe
2648	Unicorn-39866.exe
2840	Unicorn-19515.exe
2708	Unicorn-61102.exe
2872	Unicorn-15430.exe
1652	Unicorn-21552.exe
2588	Unicorn-33194.exe
2600	Unicorn-55844.exe
1628	Unicorn-12773.exe
568	Unicorn-58445.exe
1832	Unicorn-3536.exe
320	Unicorn-3271.exe
1528	Unicorn-18372.exe
2444	Unicorn-4605.exe
1300	Unicorn-9602.exe
1880	Unicorn-21108.exe
636	Unicorn-17984.exe
1620	Unicorn-25887.exe
2136	Unicorn-59208.exe
1600	Unicorn-55124.exe
108	Unicorn-46380.exe
956	Unicorn-44334.exe
2272	Unicorn-41534.exe
1928	Unicorn-34128.exe
2032	Unicorn-59187.exe
1924	Unicorn-25768.exe
2396	Unicorn-62908.exe
2260	Unicorn-43042.exe
2112	Unicorn-7577.exe
2928	Unicorn-47963.exe
1644	Unicorn-45917.exe
2344	Unicorn-48710.exe
2332	Unicorn-52047.exe
2076	Unicorn-31627.exe
2700	Unicorn-28289.exe
1416	Unicorn-44071.exe
2784	Unicorn-51477.exe
2716	Unicorn-43495.exe
2884	Unicorn-23075.exe
2680	Unicorn-7293.exe
2832	Unicorn-27905.exe
2508	Unicorn-19183.exe
2764	Unicorn-56899.exe
2068	Unicorn-36479.exe
2656	Unicorn-37033.exe
1800	Unicorn-28046.exe
1736	Unicorn-19373.exe
1456	Unicorn-44839.exe
2760	Unicorn-6629.exe
1232	Unicorn-499.exe
2904	Unicorn-23926.exe
1108	Unicorn-16504.exe
1268	Unicorn-1459.exe
2080	Unicorn-12228.exe
2424	Unicorn-60874.exe
668	Unicorn-36370.exe
2528	Unicorn-41200.exe
1840	Unicorn-64885.exe
784	Unicorn-61642.exe
344	Unicorn-62197.exe
2452	Unicorn-16526.exe
2072	Unicorn-61569.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2512 wrote to memory of 2492	2512	334476d3bfe5866eadf0864ef13c1ad12814e008db1214ac1a517d0c3c646c43N.exe	31
PID 2512 wrote to memory of 2492	2512	334476d3bfe5866eadf0864ef13c1ad12814e008db1214ac1a517d0c3c646c43N.exe	31
PID 2512 wrote to memory of 2492	2512	334476d3bfe5866eadf0864ef13c1ad12814e008db1214ac1a517d0c3c646c43N.exe	31
PID 2512 wrote to memory of 2492	2512	334476d3bfe5866eadf0864ef13c1ad12814e008db1214ac1a517d0c3c646c43N.exe	31
PID 2492 wrote to memory of 2924	2492	Unicorn-41969.exe	32
PID 2492 wrote to memory of 2924	2492	Unicorn-41969.exe	32
PID 2492 wrote to memory of 2924	2492	Unicorn-41969.exe	32
PID 2492 wrote to memory of 2924	2492	Unicorn-41969.exe	32
PID 2512 wrote to memory of 2648	2512	334476d3bfe5866eadf0864ef13c1ad12814e008db1214ac1a517d0c3c646c43N.exe	33
PID 2512 wrote to memory of 2648	2512	334476d3bfe5866eadf0864ef13c1ad12814e008db1214ac1a517d0c3c646c43N.exe	33
PID 2512 wrote to memory of 2648	2512	334476d3bfe5866eadf0864ef13c1ad12814e008db1214ac1a517d0c3c646c43N.exe	33
PID 2512 wrote to memory of 2648	2512	334476d3bfe5866eadf0864ef13c1ad12814e008db1214ac1a517d0c3c646c43N.exe	33
PID 2924 wrote to memory of 2840	2924	Unicorn-63816.exe	34
PID 2924 wrote to memory of 2840	2924	Unicorn-63816.exe	34
PID 2924 wrote to memory of 2840	2924	Unicorn-63816.exe	34
PID 2924 wrote to memory of 2840	2924	Unicorn-63816.exe	34
PID 2648 wrote to memory of 2872	2648	Unicorn-39866.exe	36
PID 2648 wrote to memory of 2872	2648	Unicorn-39866.exe	36
PID 2648 wrote to memory of 2872	2648	Unicorn-39866.exe	36
PID 2648 wrote to memory of 2872	2648	Unicorn-39866.exe	36
PID 2492 wrote to memory of 2708	2492	Unicorn-41969.exe	35
PID 2492 wrote to memory of 2708	2492	Unicorn-41969.exe	35
PID 2492 wrote to memory of 2708	2492	Unicorn-41969.exe	35
PID 2492 wrote to memory of 2708	2492	Unicorn-41969.exe	35
PID 2512 wrote to memory of 1652	2512	334476d3bfe5866eadf0864ef13c1ad12814e008db1214ac1a517d0c3c646c43N.exe	37
PID 2512 wrote to memory of 1652	2512	334476d3bfe5866eadf0864ef13c1ad12814e008db1214ac1a517d0c3c646c43N.exe	37
PID 2512 wrote to memory of 1652	2512	334476d3bfe5866eadf0864ef13c1ad12814e008db1214ac1a517d0c3c646c43N.exe	37
PID 2512 wrote to memory of 1652	2512	334476d3bfe5866eadf0864ef13c1ad12814e008db1214ac1a517d0c3c646c43N.exe	37
PID 2708 wrote to memory of 2588	2708	Unicorn-61102.exe	38
PID 2708 wrote to memory of 2588	2708	Unicorn-61102.exe	38
PID 2708 wrote to memory of 2588	2708	Unicorn-61102.exe	38
PID 2708 wrote to memory of 2588	2708	Unicorn-61102.exe	38
PID 2492 wrote to memory of 2600	2492	Unicorn-41969.exe	39
PID 2492 wrote to memory of 2600	2492	Unicorn-41969.exe	39
PID 2492 wrote to memory of 2600	2492	Unicorn-41969.exe	39
PID 2492 wrote to memory of 2600	2492	Unicorn-41969.exe	39
PID 2840 wrote to memory of 2444	2840	Unicorn-19515.exe	40
PID 2840 wrote to memory of 2444	2840	Unicorn-19515.exe	40
PID 2840 wrote to memory of 2444	2840	Unicorn-19515.exe	40
PID 2840 wrote to memory of 2444	2840	Unicorn-19515.exe	40
PID 2924 wrote to memory of 568	2924	Unicorn-63816.exe	41
PID 2924 wrote to memory of 568	2924	Unicorn-63816.exe	41
PID 2924 wrote to memory of 568	2924	Unicorn-63816.exe	41
PID 2924 wrote to memory of 568	2924	Unicorn-63816.exe	41
PID 1652 wrote to memory of 1628	1652	Unicorn-21552.exe	42
PID 1652 wrote to memory of 1628	1652	Unicorn-21552.exe	42
PID 1652 wrote to memory of 1628	1652	Unicorn-21552.exe	42
PID 1652 wrote to memory of 1628	1652	Unicorn-21552.exe	42
PID 2872 wrote to memory of 1832	2872	Unicorn-15430.exe	43
PID 2872 wrote to memory of 1832	2872	Unicorn-15430.exe	43
PID 2872 wrote to memory of 1832	2872	Unicorn-15430.exe	43
PID 2872 wrote to memory of 1832	2872	Unicorn-15430.exe	43
PID 2512 wrote to memory of 320	2512	334476d3bfe5866eadf0864ef13c1ad12814e008db1214ac1a517d0c3c646c43N.exe	44
PID 2512 wrote to memory of 320	2512	334476d3bfe5866eadf0864ef13c1ad12814e008db1214ac1a517d0c3c646c43N.exe	44
PID 2512 wrote to memory of 320	2512	334476d3bfe5866eadf0864ef13c1ad12814e008db1214ac1a517d0c3c646c43N.exe	44
PID 2512 wrote to memory of 320	2512	334476d3bfe5866eadf0864ef13c1ad12814e008db1214ac1a517d0c3c646c43N.exe	44
PID 2648 wrote to memory of 1528	2648	Unicorn-39866.exe	45
PID 2648 wrote to memory of 1528	2648	Unicorn-39866.exe	45
PID 2648 wrote to memory of 1528	2648	Unicorn-39866.exe	45
PID 2648 wrote to memory of 1528	2648	Unicorn-39866.exe	45
PID 2588 wrote to memory of 1880	2588	Unicorn-33194.exe	46
PID 2588 wrote to memory of 1880	2588	Unicorn-33194.exe	46
PID 2588 wrote to memory of 1880	2588	Unicorn-33194.exe	46
PID 2588 wrote to memory of 1880	2588	Unicorn-33194.exe	46

C:\Users\Admin\AppData\Local\Temp\334476d3bfe5866eadf0864ef13c1ad12814e008db1214ac1a517d0c3c646c43N.exe
"C:\Users\Admin\AppData\Local\Temp\334476d3bfe5866eadf0864ef13c1ad12814e008db1214ac1a517d0c3c646c43N.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2512
- C:\Users\Admin\AppData\Local\Temp\Unicorn-41969.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-41969.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2492
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63816.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63816.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19515.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19515.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4605.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:2444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46380.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19183.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2508
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2508 -s 240
        8⤵
        Program crash
        
        PID:3012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53536.exe
        7⤵
        
        PID:1256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27966.exe
        8⤵
        
        PID:2644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60021.exe
        9⤵
        
        PID:5016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20768.exe
        9⤵
        
        PID:5600
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2644 -s 224
        9⤵
        
        PID:7048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-882.exe
        8⤵
        
        PID:4048
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1256 -s 244
        8⤵
        
        PID:5696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38219.exe
        7⤵
        
        PID:3100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44718.exe
        8⤵
        
        PID:5788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26762.exe
        8⤵
        
        PID:6752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28715.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:7456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10450.exe
        8⤵
        
        PID:8716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44603.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3296
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 108 -s 244
        7⤵
        
        PID:5544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37033.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22372.exe
        7⤵
        
        PID:2036
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2656 -s 236
        7⤵
        Program crash
        
        PID:2624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16241.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34790.exe
        7⤵
        
        PID:1544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11152.exe
        8⤵
        
        PID:3192
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1544 -s 248
        8⤵
        Program crash
        
        PID:4276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20067.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3280
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1212 -s 240
        7⤵
        Program crash
        
        PID:4736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31593.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18039.exe
        7⤵
        
        PID:3256
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2672 -s 248
        7⤵
        Program crash
        
        PID:4596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29803.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6242.exe
        6⤵
        
        PID:4560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25410.exe
        6⤵
        
        PID:6208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16697.exe
        6⤵
        
        PID:6796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48588.exe
        6⤵
        
        PID:8020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58316.exe
        6⤵
        
        PID:8488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43042.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23926.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51510.exe
        7⤵
        
        PID:1612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63669.exe
        8⤵
        
        PID:3704
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1612 -s 248
        8⤵
        Program crash
        
        PID:4260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43804.exe
        7⤵
        
        PID:3688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30860.exe
        7⤵
        
        PID:5012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25076.exe
        7⤵
        
        PID:6708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5443.exe
        7⤵
        
        PID:7480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58939.exe
        7⤵
        
        PID:8212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46010.exe
        7⤵
        
        PID:9204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55573.exe
        6⤵
        
        PID:2124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3176.exe
        7⤵
        
        PID:3448
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2124 -s 228
        7⤵
        Program crash
        
        PID:4592
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2260 -s 240
        6⤵
        Program crash
        
        PID:4084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1459.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61725.exe
        6⤵
        
        PID:2064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45117.exe
        7⤵
        
        PID:3588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64918.exe
        8⤵
        
        PID:7720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63081.exe
        8⤵
        
        PID:8640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25661.exe
        7⤵
        
        PID:4468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41930.exe
        7⤵
        
        PID:5300
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2064 -s 248
        7⤵
        
        PID:6732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4447.exe
        6⤵
        
        PID:3740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58167.exe
        7⤵
        
        PID:8528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39397.exe
        6⤵
        
        PID:4448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42642.exe
        6⤵
        
        PID:5364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11766.exe
        6⤵
        
        PID:6280
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1268 -s 248
        6⤵
        
        PID:7756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7934.exe
        5⤵
        
        PID:1572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14945.exe
        6⤵
        
        PID:1744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59393.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4000
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1744 -s 248
        7⤵
        Program crash
        
        PID:5116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60908.exe
        6⤵
        
        PID:3176
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1572 -s 244
        6⤵
        Program crash
        
        PID:5056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15527.exe
        5⤵
        
        PID:1668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2792.exe
        6⤵
        
        PID:3752
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1668 -s 216
        6⤵
        Program crash
        
        PID:4688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44290.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-853.exe
        5⤵
        
        PID:5764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26157.exe
        5⤵
        
        PID:6540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58598.exe
        5⤵
        
        PID:7824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32612.exe
        5⤵
        
        PID:8780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58445.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58445.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62908.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6629.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22372.exe
        7⤵
        
        PID:2100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38843.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23819.exe
        9⤵
        
        PID:9028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52299.exe
        8⤵
        
        PID:4224
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2100 -s 244
        8⤵
        
        PID:6172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2065.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3200
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3200 -s 224
        8⤵
        Program crash
        
        PID:3800
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2760 -s 240
        7⤵
        Program crash
        
        PID:3268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60067.exe
        6⤵
        
        PID:2148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37800.exe
        7⤵
        
        PID:3340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39496.exe
        7⤵
        
        PID:4876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13891.exe
        7⤵
        
        PID:5320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16923.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6944
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2148 -s 244
        7⤵
        
        PID:7840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3356.exe
        6⤵
        
        PID:3524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55672.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39872.exe
        6⤵
        
        PID:6032
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2396 -s 248
        6⤵
        
        PID:6612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12228.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6502.exe
        6⤵
        
        PID:2572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51718.exe
        7⤵
        
        PID:3604
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2572 -s 248
        7⤵
        Program crash
        
        PID:4268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43804.exe
        6⤵
        
        PID:3696
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2080 -s 244
        6⤵
        Program crash
        
        PID:5108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12816.exe
        5⤵
        
        PID:1964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17738.exe
        6⤵
        
        PID:3488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17125.exe
        6⤵
        
        PID:4916
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1964 -s 224
        6⤵
        
        PID:6856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51453.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28060.exe
        5⤵
        
        PID:4872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65412.exe
        5⤵
        
        PID:6656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5973.exe
        5⤵
        
        PID:7412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54473.exe
        5⤵
        
        PID:7252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6700.exe
        5⤵
        
        PID:9144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7577.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7577.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2112
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2112 -s 240
        5⤵
        Program crash
        
        PID:2024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64885.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64885.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49473.exe
        5⤵
        
        PID:788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64577.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23021.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-789.exe
        7⤵
        
        PID:4588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28110.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14108.exe
        7⤵
        
        PID:7488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9937.exe
        7⤵
        
        PID:8164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16500.exe
        7⤵
        
        PID:9196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16258.exe
        6⤵
        
        PID:3868
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 788 -s 244
        6⤵
        
        PID:5656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17083.exe
        5⤵
        
        PID:3528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4482.exe
        6⤵
        
        PID:7460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30107.exe
        6⤵
        
        PID:8988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22100.exe
        5⤵
        
        PID:4248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1012.exe
        5⤵
        
        PID:5820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34905.exe
        5⤵
        
        PID:6608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2862.exe
        5⤵
        
        PID:7864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55278.exe
        5⤵
        
        PID:8820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37670.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37670.exe
      4⤵
      PID:2088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17188.exe
        5⤵
        
        PID:4024
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2088 -s 228
        5⤵
        Program crash
        
        PID:4660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3590.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3590.exe
      4⤵
      PID:3140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5845.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5845.exe
      4⤵
      PID:4724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43676.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43676.exe
      4⤵
      PID:5496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27039.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27039.exe
      4⤵
      PID:6828
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2924 -s 248
      4⤵
      PID:7788
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61102.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61102.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33194.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33194.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21108.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52047.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24310.exe
        7⤵
        Executes dropped EXE
        
        PID:2476
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2476 -s 244
        8⤵
        Program crash
        
        PID:1460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8100.exe
        7⤵
        
        PID:1364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52320.exe
        8⤵
        
        PID:5084
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1364 -s 228
        8⤵
        
        PID:6240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14617.exe
        7⤵
        
        PID:3364
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2332 -s 248
        7⤵
        
        PID:5704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20972.exe
        6⤵
        
        PID:2920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47042.exe
        7⤵
        
        PID:2324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45143.exe
        8⤵
        
        PID:4128
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2324 -s 228
        8⤵
        Program crash
        
        PID:5468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24810.exe
        7⤵
        
        PID:3184
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2920 -s 224
        7⤵
        
        PID:5648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42064.exe
        6⤵
        
        PID:2592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18605.exe
        7⤵
        
        PID:4332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28936.exe
        7⤵
        
        PID:948
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2592 -s 224
        7⤵
        
        PID:6964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44411.exe
        6⤵
        
        PID:3148
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1880 -s 244
        6⤵
        
        PID:5752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48710.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2344
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2344 -s 220
        6⤵
        Program crash
        
        PID:3008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17878.exe
        5⤵
        
        PID:2748
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2748 -s 224
        6⤵
        Program crash
        
        PID:1152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26824.exe
        5⤵
        
        PID:2676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3835.exe
        6⤵
        
        PID:3808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54925.exe
        6⤵
        
        PID:5452
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2676 -s 240
        6⤵
        
        PID:6284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19409.exe
        5⤵
        
        PID:3336
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2588 -s 248
        5⤵
        
        PID:5680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9602.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9602.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47963.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61642.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42875.exe
        7⤵
        
        PID:2300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4826.exe
        8⤵
        
        PID:3664
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2300 -s 228
        8⤵
        Program crash
        
        PID:4112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26185.exe
        7⤵
        
        PID:3908
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 784 -s 244
        7⤵
        Program crash
        
        PID:4140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10373.exe
        6⤵
        
        PID:2948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58303.exe
        7⤵
        
        PID:3772
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2948 -s 248
        7⤵
        Program crash
        
        PID:4184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32904.exe
        6⤵
        
        PID:3084
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2928 -s 248
        6⤵
        Program crash
        
        PID:4568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62197.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47317.exe
        6⤵
        
        PID:332
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 332 -s 240
        7⤵
        Program crash
        
        PID:4624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8858.exe
        6⤵
        
        PID:3644
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 344 -s 244
        6⤵
        
        PID:5604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25966.exe
        5⤵
        
        PID:2056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3534.exe
        6⤵
        
        PID:4216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46949.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37706.exe
        6⤵
        
        PID:6620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28063.exe
        6⤵
        
        PID:7912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54748.exe
        6⤵
        
        PID:8812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28075.exe
        5⤵
        
        PID:3520
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1300 -s 244
        5⤵
        
        PID:5560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45917.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45917.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16526.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35069.exe
        5⤵
        
        PID:1436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44349.exe
        6⤵
        
        PID:3128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13135.exe
        7⤵
        
        PID:7076
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3128 -s 248
        7⤵
        
        PID:7924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25002.exe
        6⤵
        
        PID:3456
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1436 -s 244
        6⤵
        
        PID:5536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42495.exe
        5⤵
        
        PID:3284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35751.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50647.exe
        6⤵
        
        PID:8052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32851.exe
        6⤵
        
        PID:8696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4914.exe
        5⤵
        
        PID:3732
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1644 -s 244
        5⤵
        
        PID:5552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61569.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61569.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2072
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2072 -s 244
        5⤵
        Program crash
        
        PID:2768
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2708 -s 240
      4⤵
      Program crash
      PID:2244
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55844.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55844.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17984.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17984.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31627.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40838.exe
        6⤵
        
        PID:2736
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2736 -s 244
        7⤵
        Program crash
        
        PID:2728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36688.exe
        6⤵
        
        PID:2200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19446.exe
        7⤵
        
        PID:1608
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2200 -s 216
        7⤵
        
        PID:7152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22593.exe
        6⤵
        
        PID:3872
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2076 -s 248
        6⤵
        
        PID:5720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53837.exe
        5⤵
        
        PID:2812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23114.exe
        6⤵
        
        PID:2776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9694.exe
        7⤵
        
        PID:4552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57634.exe
        7⤵
        
        PID:5360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14566.exe
        7⤵
        
        PID:6268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18353.exe
        7⤵
        
        PID:7956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1930.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:9164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11790.exe
        6⤵
        
        PID:3464
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2812 -s 244
        6⤵
        
        PID:5632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58016.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52128.exe
        6⤵
        
        PID:4740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13944.exe
        6⤵
        
        PID:6224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40498.exe
        6⤵
        
        PID:6864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18052.exe
        6⤵
        
        PID:7988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58962.exe
        6⤵
        
        PID:8656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39751.exe
        5⤵
        
        PID:3324
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 636 -s 244
        5⤵
        
        PID:5744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28289.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28289.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2700
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2700 -s 244
        5⤵
        Program crash
        
        PID:2340
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1843.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1843.exe
      4⤵
      PID:1540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13518.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1516
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1516 -s 244
        6⤵
        Program crash
        
        PID:3612
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1540 -s 236
        5⤵
        Program crash
        
        PID:3680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63606.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63606.exe
      4⤵
      PID:2120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54987.exe
        5⤵
        
        PID:3308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11842.exe
        5⤵
        
        PID:4604
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2120 -s 224
        5⤵
        
        PID:6180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8807.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8807.exe
      4⤵
      PID:3452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11525.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11525.exe
      4⤵
      PID:4808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16940.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16940.exe
      4⤵
      PID:6664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49979.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49979.exe
      4⤵
      PID:7404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49138.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49138.exe
      4⤵
      PID:7216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10900.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10900.exe
      4⤵
      PID:9100
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25887.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25887.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44071.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44071.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1416
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1416 -s 224
        5⤵
        Program crash
        
        PID:2188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53645.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53645.exe
      4⤵
      PID:2972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32097.exe
        5⤵
        
        PID:1648
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1648 -s 224
        6⤵
        Program crash
        
        PID:4576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8474.exe
        5⤵
        
        PID:3088
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2972 -s 224
        5⤵
        
        PID:5568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46579.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46579.exe
      4⤵
      PID:3248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61931.exe
        5⤵
        
        PID:5856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58283.exe
        5⤵
        
        PID:6908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39624.exe
        5⤵
        
        PID:7208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55904.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36518.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36518.exe
      4⤵
      PID:4020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-323.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-323.exe
      4⤵
      PID:5460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18370.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18370.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19927.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19927.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33747.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33747.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:8728
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51477.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51477.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8056.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8056.exe
      4⤵
      PID:2820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20374.exe
        5⤵
        
        PID:2720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45527.exe
        6⤵
        
        PID:4516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32278.exe
        6⤵
        
        PID:5304
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2720 -s 224
        6⤵
        
        PID:6728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49891.exe
        5⤵
        
        PID:3196
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2820 -s 224
        5⤵
        
        PID:5736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48064.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48064.exe
      4⤵
      PID:3016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61687.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14375.exe
        5⤵
        
        PID:6832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8243.exe
        5⤵
        
        PID:7464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18602.exe
        5⤵
        
        PID:8228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33035.exe
        5⤵
        
        PID:9128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55458.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55458.exe
      4⤵
      PID:3920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8988.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8988.exe
      4⤵
      PID:5612
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2784 -s 240
      4⤵
      PID:6260
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23623.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23623.exe
    3⤵
    PID:2692
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55786.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55786.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15044.exe
        5⤵
        
        PID:3844
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3004 -s 236
        5⤵
        Program crash
        
        PID:4764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32978.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32978.exe
      4⤵
      PID:3376
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2692 -s 244
      4⤵
      PID:5772
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55746.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55746.exe
    3⤵
    PID:2192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55885.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55885.exe
      4⤵
      PID:3720
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2192 -s 228
      4⤵
      Program crash
      PID:4720
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10085.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10085.exe
    3⤵
    PID:3636
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39524.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39524.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5592
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12770.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12770.exe
    3⤵
    PID:6272
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35063.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35063.exe
    3⤵
    PID:7832
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52213.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52213.exe
    3⤵
    PID:8752
- C:\Users\Admin\AppData\Local\Temp\Unicorn-39866.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-39866.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2648
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15430.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15430.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3536.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3536.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:1832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55124.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23075.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7864.exe
        7⤵
        
        PID:756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36949.exe
        8⤵
        
        PID:3556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16888.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:7052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9744.exe
        9⤵
        
        PID:7392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24958.exe
        9⤵
        
        PID:8276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8365.exe
        8⤵
        
        PID:4280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60684.exe
        8⤵
        
        PID:5840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43571.exe
        8⤵
        
        PID:6572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19397.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:7896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38212.exe
        8⤵
        
        PID:8832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50140.exe
        7⤵
        
        PID:3708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53177.exe
        8⤵
        
        PID:6736
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3708 -s 228
        8⤵
        
        PID:7944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39397.exe
        7⤵
        
        PID:4440
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2884 -s 228
        7⤵
        
        PID:2196
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1600 -s 236
        6⤵
        Program crash
        
        PID:2360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27905.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41113.exe
        6⤵
        
        PID:3020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55210.exe
        7⤵
        
        PID:596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53612.exe
        8⤵
        
        PID:3728
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 596 -s 228
        8⤵
        
        PID:5712
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3020 -s 236
        7⤵
        Program crash
        
        PID:4052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6756.exe
        6⤵
        
        PID:1156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60903.exe
        7⤵
        
        PID:4172
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1156 -s 228
        7⤵
        Program crash
        
        PID:5512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38546.exe
        6⤵
        
        PID:3228
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2832 -s 248
        6⤵
        
        PID:5640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1734.exe
        5⤵
        
        PID:400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56793.exe
        6⤵
        
        PID:3160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39357.exe
        7⤵
        
        PID:3584
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3160 -s 216
        7⤵
        Program crash
        
        PID:4532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32594.exe
        6⤵
        
        PID:3952
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 400 -s 244
        6⤵
        
        PID:5624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11603.exe
        5⤵
        
        PID:3328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27391.exe
        6⤵
        
        PID:6920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47331.exe
        6⤵
        
        PID:7188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4455.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23960.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49324.exe
        5⤵
        
        PID:5500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35436.exe
        5⤵
        
        PID:6564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63934.exe
        5⤵
        
        PID:7856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28412.exe
        5⤵
        
        PID:8796
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2872 -s 236
      4⤵
      Loads dropped DLL
      Program crash
      PID:692
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18372.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18372.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25768.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25768.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36370.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22564.exe
        6⤵
        
        PID:1124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4276.exe
        7⤵
        
        PID:3628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7203.exe
        8⤵
        
        PID:4904
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3628 -s 228
        8⤵
        
        PID:6232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25661.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36777.exe
        7⤵
        
        PID:5420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20431.exe
        7⤵
        
        PID:6588
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1124 -s 244
        7⤵
        
        PID:7884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61816.exe
        6⤵
        
        PID:3780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44441.exe
        7⤵
        
        PID:8180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49646.exe
        7⤵
        
        PID:8960
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 668 -s 240
        6⤵
        Program crash
        
        PID:4404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55407.exe
        5⤵
        
        PID:532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21272.exe
        6⤵
        
        PID:4012
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 532 -s 228
        6⤵
        Program crash
        
        PID:4692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51514.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9320.exe
        5⤵
        
        PID:4668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24412.exe
        5⤵
        
        PID:3000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57260.exe
        5⤵
        
        PID:6916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10218.exe
        5⤵
        
        PID:7800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46466.exe
        5⤵
        
        PID:9132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41200.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41200.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2528
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2528 -s 220
        5⤵
        Program crash
        
        PID:908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14321.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14321.exe
      4⤵
      PID:2356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38075.exe
        5⤵
        
        PID:3492
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2356 -s 236
        5⤵
        Program crash
        
        PID:5060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61930.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61930.exe
      4⤵
      PID:3572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47007.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47007.exe
      4⤵
      PID:4208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23336.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23336.exe
      4⤵
      PID:5860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38228.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38228.exe
      4⤵
      PID:6784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53923.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53923.exe
      4⤵
      PID:7804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54115.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54115.exe
      4⤵
      PID:8564
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44334.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44334.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36479.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36479.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57592.exe
        5⤵
        
        PID:2792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5703.exe
        6⤵
        
        PID:3276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10908.exe
        6⤵
        
        PID:4768
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2792 -s 220
        6⤵
        
        PID:5280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49922.exe
        5⤵
        
        PID:3384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49807.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48537.exe
        5⤵
        
        PID:5784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37697.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58389.exe
        5⤵
        
        PID:7560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15444.exe
        5⤵
        
        PID:8496
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 956 -s 248
      4⤵
      Program crash
      PID:584
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28046.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28046.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1800
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1800 -s 224
      4⤵
      Program crash
      PID:2004
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32950.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32950.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41225.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41225.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36548.exe
        5⤵
        
        PID:8356
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3672 -s 228
        5⤵
        
        PID:9064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25661.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25661.exe
      4⤵
      PID:4476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16164.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16164.exe
      4⤵
      PID:5236
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 856 -s 236
      4⤵
      PID:6548
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8167.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8167.exe
    3⤵
    PID:3816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41501.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41501.exe
      4⤵
      PID:6724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64290.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64290.exe
      4⤵
      PID:7936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4730.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4730.exe
      4⤵
      PID:9112
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37127.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37127.exe
    3⤵
    PID:4396
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12976.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12976.exe
    3⤵
    PID:5400
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50967.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50967.exe
    3⤵
    PID:6188
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53089.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53089.exe
    3⤵
    PID:7764
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17596.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17596.exe
    3⤵
    PID:9080
- C:\Users\Admin\AppData\Local\Temp\Unicorn-21552.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-21552.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1652
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12773.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12773.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59208.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59208.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43495.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25161.exe
        6⤵
        
        PID:1968
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1968 -s 224
        7⤵
        Program crash
        
        PID:2780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7223.exe
        6⤵
        
        PID:1720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47385.exe
        7⤵
        
        PID:4360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41380.exe
        7⤵
        
        PID:5864
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1720 -s 224
        7⤵
        
        PID:6816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22209.exe
        6⤵
        
        PID:3420
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2716 -s 248
        6⤵
        
        PID:5688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30183.exe
        5⤵
        
        PID:1180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52984.exe
        6⤵
        
        PID:3924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46050.exe
        7⤵
        
        PID:8204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55257.exe
        6⤵
        
        PID:4648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1940.exe
        6⤵
        
        PID:5448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4863.exe
        6⤵
        
        PID:7164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9688.exe
        6⤵
        
        PID:7776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50932.exe
        6⤵
        
        PID:9104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27201.exe
        5⤵
        
        PID:3960
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2136 -s 248
        5⤵
        Program crash
        
        PID:4680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7293.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7293.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49089.exe
        5⤵
        
        PID:3048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48049.exe
        6⤵
        
        PID:3408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15055.exe
        7⤵
        
        PID:5868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8462.exe
        7⤵
        
        PID:7876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57548.exe
        7⤵
        
        PID:8764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41037.exe
        6⤵
        
        PID:4156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3123.exe
        6⤵
        
        PID:5484
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3048 -s 236
        6⤵
        
        PID:6296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16123.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30421.exe
        6⤵
        
        PID:3876
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3472 -s 248
        6⤵
        Program crash
        
        PID:3156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13190.exe
        5⤵
        
        PID:3076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36726.exe
        5⤵
        
        PID:4888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16410.exe
        5⤵
        
        PID:6696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54445.exe
        5⤵
        
        PID:7420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10467.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12035.exe
        5⤵
        
        PID:9180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10286.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10286.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24458.exe
        5⤵
        
        PID:2824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48060.exe
        6⤵
        
        PID:6004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-831.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12488.exe
        6⤵
        
        PID:7980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10595.exe
        6⤵
        
        PID:9148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44847.exe
        5⤵
        
        PID:3272
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2576 -s 244
        5⤵
        
        PID:5580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24193.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24193.exe
      4⤵
      PID:2348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46285.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49134.exe
        5⤵
        
        PID:6872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47086.exe
        5⤵
        
        PID:8024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30549.exe
        5⤵
        
        PID:8668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43530.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43530.exe
      4⤵
      PID:3968
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1628 -s 248
      4⤵
      PID:5728
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59187.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59187.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44839.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44839.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8199.exe
        5⤵
        
        PID:1056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58111.exe
        6⤵
        
        PID:3652
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1056 -s 228
        6⤵
        Program crash
        
        PID:3564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58858.exe
        5⤵
        
        PID:3824
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1456 -s 224
        5⤵
        Program crash
        
        PID:4168
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2032 -s 248
      4⤵
      Program crash
      PID:356
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-499.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-499.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1232
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1232 -s 244
      4⤵
      Program crash
      PID:1952
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30249.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30249.exe
    3⤵
    PID:1316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36783.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36783.exe
      4⤵
      PID:3840
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1316 -s 248
      4⤵
      Program crash
      PID:5520
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35745.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35745.exe
    3⤵
    PID:3116
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1652 -s 248
    3⤵
    PID:5672
- C:\Users\Admin\AppData\Local\Temp\Unicorn-3271.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-3271.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:320
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34128.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34128.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60874.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60874.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36980.exe
        5⤵
        
        PID:2688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4250.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36071.exe
        6⤵
        
        PID:5096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42672.exe
        6⤵
        
        PID:5412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46363.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9387.exe
        6⤵
        
        PID:8072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42426.exe
        6⤵
        
        PID:8632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42329.exe
        5⤵
        
        PID:3596
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2424 -s 244
        5⤵
        Program crash
        
        PID:4120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2506.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2506.exe
      4⤵
      PID:2208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1894.exe
        5⤵
        
        PID:3944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53834.exe
        6⤵
        
        PID:8472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32262.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27679.exe
        5⤵
        
        PID:6164
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2208 -s 248
        5⤵
        
        PID:6844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52749.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52749.exe
      4⤵
      PID:3144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31443.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31443.exe
      4⤵
      PID:4536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24879.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24879.exe
      4⤵
      PID:6196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21162.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21162.exe
      4⤵
      PID:1468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9917.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9917.exe
      4⤵
      PID:7784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59450.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59450.exe
      4⤵
      PID:8548
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16504.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16504.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63404.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63404.exe
      4⤵
      PID:2280
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2280 -s 220
        5⤵
        Program crash
        
        PID:4004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1022.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1022.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3455.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3455.exe
      4⤵
      PID:4640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61666.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61666.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8258.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8258.exe
      4⤵
      PID:6980
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1108 -s 228
      4⤵
      PID:7964
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19941.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19941.exe
    3⤵
    PID:616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15761.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15761.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27666.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7016
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3208 -s 248
        5⤵
        
        PID:8064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22070.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22070.exe
      4⤵
      PID:3508
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 616 -s 244
      4⤵
      Program crash
      PID:5528
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15687.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15687.exe
    3⤵
    PID:3368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41786.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41786.exe
      4⤵
      PID:5980
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3368 -s 216
      4⤵
      PID:6900
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23960.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23960.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4104
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 320 -s 248
    3⤵
    PID:5664
- C:\Users\Admin\AppData\Local\Temp\Unicorn-41534.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-41534.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2272
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56899.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56899.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2764
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2764 -s 240
      4⤵
      Program crash
      PID:2992
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49452.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49452.exe
    3⤵
    PID:2312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28480.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28480.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63050.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31306.exe
        5⤵
        
        PID:8840
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2312 -s 236
      4⤵
      Program crash
      PID:4412
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9905.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9905.exe
    3⤵
    PID:3896
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2272 -s 248
    3⤵
    - Program crash
    PID:4700
- C:\Users\Admin\AppData\Local\Temp\Unicorn-19373.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-19373.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1736
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4499.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4499.exe
    3⤵
    PID:1320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57836.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57836.exe
      4⤵
      PID:3180
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1320 -s 248
      4⤵
      Program crash
      PID:4780
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51375.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51375.exe
    3⤵
    PID:3240
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24643.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24643.exe
    3⤵
    PID:4752
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7805.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7805.exe
    3⤵
    PID:5620
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53375.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53375.exe
    3⤵
    PID:6756
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58690.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58690.exe
    3⤵
    PID:7748
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2460.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2460.exe
    3⤵
    PID:9072
- C:\Users\Admin\AppData\Local\Temp\Unicorn-41024.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-41024.exe
  2⤵
  PID:2368
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17079.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17079.exe
    3⤵
    PID:3396
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2368 -s 228
    3⤵
    - Program crash
    PID:4136
- C:\Users\Admin\AppData\Local\Temp\Unicorn-744.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-744.exe
  2⤵
  PID:3976
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64738.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64738.exe
    3⤵
    PID:3796
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3976 -s 236
    3⤵
    - Program crash
    PID:4636
- C:\Users\Admin\AppData\Local\Temp\Unicorn-11491.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-11491.exe
  2⤵
  PID:3892
- C:\Users\Admin\AppData\Local\Temp\Unicorn-5925.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-5925.exe
  2⤵
  PID:4896
- C:\Users\Admin\AppData\Local\Temp\Unicorn-32076.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-32076.exe
  2⤵
  PID:6684
- C:\Users\Admin\AppData\Local\Temp\Unicorn-2908.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-2908.exe
  2⤵
  PID:7436
- C:\Users\Admin\AppData\Local\Temp\Unicorn-22803.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-22803.exe
  2⤵
  PID:8220
- C:\Users\Admin\AppData\Local\Temp\Unicorn-5300.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-5300.exe
  2⤵
  PID:9192

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-21552.exe

Filesize
468KB

MD5
e2b18d8c76a8daa894806c0bd0ef2a87

SHA1
9405193a9abb1733c9fb81da2d3172a3d447e751

SHA256
8ad406cf67fe27ab67e89ddd749c1446619ed09313ceb08e057c5c2e1843ba03

SHA512
361d3aad0766d71b4a18d00fa015cffe89e80645e1a62ea5a431c2825b32a81b296893780aafee7f31b6a818ac9c543a00694864935330deab21b290496dfda5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-58389.exe

Filesize
468KB

MD5
6e21eda2667f9868421e43ab4afa8641

SHA1
46a0794583c81cd1822297c131cd71c63df621d8

SHA256
df57ab7b264e6e23962d72a26a67d6e3f6d095d805e8e266349d41d9a99f7d03

SHA512
f4cf88f6b5cff8871cde37cadb0a3fe6b02ebb19a700a5909b0f24b374cf2ec9900ac4451d43c0e1a8a8c646218c689a48de1096a1efbde930a5a8c9aa68bd29

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-12773.exe

Filesize
468KB

MD5
cf8c217b617b6226583d7b2a2ee81d5a

SHA1
f60a383cc4bf80af9a16c289e924d8956a1c07cb

SHA256
0d7e957c57ab0b7fc5e9099a987e16ef72d4a65a7c1c13007dcac9583d8f3b08

SHA512
789e62c680191a5e8eb8f7059c1530a00dc03d7f096b2ac76c618b5ff08feda66841a3776d01bfd586825a5fe540847bfe5f8d4cf6822a6945a6c493b944852f

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-15430.exe

Filesize
468KB

MD5
41316b89e525e7cbcfa263ed63019404

SHA1
842ac47fb934c463b234d419f17149cb848ed201

SHA256
73edda5d18f6e17f48046fbd59662d921b233be26aa6c78d3d870257a149fd46

SHA512
68d0f26d97dab1371474e22896e188ffa6903d391c78b848ce08fc2cf61e3fc8aa8ff59ef67ed5505e5cd1e1e3235cfda60a050e3e7e5434d0c75a4ef8dedde1

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-17984.exe

Filesize
468KB

MD5
32ef59f92e20ae20966740452c7fcf5b

SHA1
aa479e53dda5348c993c4d9e5b6d75373d98d340

SHA256
67171c18846a40092b303d66446dd25c395efc6b79c0d6365443f5b3dc3e8adb

SHA512
97a8e0ee1700fe4318599680b5a33cdeabbe5fe6ed6d373e2025c52b0ec6735c8e90041114f885ab338246132d0ef3689b839d6797f076908b20d5b01227286d

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-18372.exe

Filesize
468KB

MD5
4725d916cbf053046e7df90ff98abd83

SHA1
f43f644f1df6b565b105403d5d724e0fbd0896e9

SHA256
f9280706d8751c178cd2049689f637603a90164a405e74b67eb35ce91c8e95d1

SHA512
0c1dfb484dc0831835d2fc3e8f681239fc0ea01cc9e12b26fb22ce83927fd340911ecb8de17523b6d63bb08bbe37003c0a8b2d4f6caae7057894dc1b3a646aaf

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-19515.exe

Filesize
468KB

MD5
4cd6f16f8390d7c7adda76296bbcb3c8

SHA1
75e422fef121f0c4a8febba0e3e05c97911463a9

SHA256
d665e7b13d27041d8e1e177cbc3ec2acc8e8b0330cf04bbe9734de0da3ad1f8b

SHA512
e775b8150dbc06a3ae055217216fae46092eb4b8797e5b77d0900ab510b416703d79d23092438b6f2f53a24537611b8052d9c89d0716731afa9ff57808a420b3

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-21108.exe

Filesize
468KB

MD5
f979cfeb0c574f0ced41ad0e57663710

SHA1
d9307b7ac1e36d5146477283e36a9df9addfa1a5

SHA256
16632219f95b654dd37e5e60ff84d1306221157d14361beb8a2e4f53ade3d590

SHA512
6b5735d8987bc4433bfb13b3a02e6ebe30d10421ef60bb1a61a57100a3c033d47b0c42b55619ee1691eaa72c63deb9c076b7bb65f9ae6941f9f859ae4566fa7e

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-25887.exe

Filesize
468KB

MD5
0c6c9f0ccc40d867d676efbcb80df55e

SHA1
50c49bc28e393cb2edc21da3e1efe6e3533ff479

SHA256
3cc2c2b887c9efde1a2bac04e449046f8c58e96ea95f427748e8fea593cf2e7c

SHA512
d4438ea59fa57bb6ec5180fbf32226c81f6e8b4d86807d47bfdf9eb201c2e06f36547f30296559ec9a5102d3b8ee0bef31a158c1d3fa1877d92fb3115011a6d0

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-3271.exe

Filesize
468KB

MD5
41b88e9ff9f853458262037efc5092b4

SHA1
44da9697d17db1b60387ab50e3ee82c8f9a21e9b

SHA256
26ba40f9f666cbfa6a117bd011f468dadcef0892b16c0eae35e95481d59a26e2

SHA512
e6b3a449543ab533da92bee8eb090af5e9caa639ed76602d310c15201e422211cc88fd46addcf8e312451460ec9d3b10a9c989b8a2fc5c9a38525bad90c5321e

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-33194.exe

Filesize
468KB

MD5
4c8de1ab3e902136ce2b9f2ed54ce7e1

SHA1
66320adf6c22e1128bc3e53098883ad0d0137fa8

SHA256
5012592a5246cbbe95a7b66975ac952466b66f9c628f3bbe769922abf86a6e27

SHA512
bea6386582e5985194918b4a029c85f25b2e11171c906e7b51509aaaf1b73b27db878a46d895265b35ce06e1c3d5830451b4998ab7afb409f157b098b68972e5

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-3536.exe

Filesize
468KB

MD5
bd2a7b7e5d741e3983acdd8817aab98c

SHA1
bade7e385e25df5046e140d65393fe583307df49

SHA256
c549216731dec7c8540e7383993058009002ba25898125f470befcc050f2fd66

SHA512
c44bb3ae60fdd147dea3b57124db4f9f4227e5954b0b1d91ed3cec34648c17fb740b090be866aefbefa36aec29f675298ec6865d3de55ac17f773bbff90ca2c4

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-39866.exe

Filesize
468KB

MD5
fc73e5cdc3f34515ad917bba95c48162

SHA1
8d1014494d223cc10fe37a55e33eb9c838078885

SHA256
60f7430481fea3e611752272c0f3580adf847a7cf174fae896bad225068103b2

SHA512
d8bfe28dcae302e1a82670fa7e10f2255f61b85b3e64d053f8b632ce06787f065cbaee05ba04f82852b5050598186d4e19602ef24d1bcd04c593616d4de334a4

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-41969.exe

Filesize
468KB

MD5
5d586de34cabd41f735e1bab30f5161b

SHA1
5a09ff9e87b5a2466981ef85392f4e24ee1aa86e

SHA256
e428ef8bfd2255007130fffa8ed569d960b35db23e5f650bf3ebcd0957cac115

SHA512
9bc738bbd6b66e8f221191ef805d291a5aad7ec023ba8d070d39a50bef147889dd34d1020e1f942ed5c779ae7d0ff85a21909e3f0820a2dffb177319168f2ac8

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-4605.exe

Filesize
468KB

MD5
f80f56cedbaae49d1b9762773040a20c

SHA1
e824e9bdb10057ef819293bebb59cdd0b3770426

SHA256
1fffbf262b450e61ceb2adb7206810330e1cf4802ccdf6f66c5a7e07fe568571

SHA512
9fc107a1266ed49d7fccfd5732980e6cc30054fbedc589b7b46f5c3a13f6dfd471afd2639de674ce9151675dda98fa33fc5f9b94886cc3f227025ad4266bb626

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-55844.exe

Filesize
468KB

MD5
7d18ea801e307de13f46bb653a80fe27

SHA1
335a19ec607c35511165969d5aed6dfa030e16d2

SHA256
41858369576cec17628ad26fe98aedbb90240bf2dd0bd5fff7f79660106a7395

SHA512
300118b189c37e88c895d01c3fda296e3512adb40267999c589c5a11b7ededf806a5a201c3feef46656d81da5d9d16423e32fc9dfbc7925c3829105c73976624

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-58445.exe

Filesize
468KB

MD5
a4e40a9147a0b2b2899478d607967960

SHA1
9e13a87a64c36aa225fc23a95137c9b189ddad37

SHA256
b980ec029be67d43aa9a1f35c4719b60c16d2a34a1ea66a423e15c9204262c14

SHA512
e7361861bef80d3f291d6a38761ffcd7d594b262f6286bc2f1aba9ce31f64cb9b2c89fc8e87906f258804d06feb26e19fe1f4c6c95581dcd07bb2ab79ef57349

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-61102.exe

Filesize
468KB

MD5
afc6a5891818a672097f213f8f8122ba

SHA1
594df180bf1e9692f302c41df1b4034c2888e863

SHA256
16c7785ed24a8cfdfdc7630bbbe47ce1e9a99189c04fd6f759aa40f561b63d7a

SHA512
8edd121831fae88efd885b9251421d8fbc484472bbfdbf4d991e69b0c8882a8aa59ad250ed910ec80bfbb97e808e3a0fbff8a2a7e811665cbc89d4883c1ec697

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-63816.exe

Filesize
468KB

MD5
a3740c552fb3d7b83503f74776dd7902

SHA1
1765f99348fa0db5bb9b3b411644ec324784285a

SHA256
644d9543028b01ec70fb85916ce5d8cc89ecda6fb15b9a2c82795527e0947c71

SHA512
819d520dec35820ffd2f45718dd6ff0b945bb93dcc6402ab3f37f04a6edb7ca353b0da505fdb61ab3a8ae2dcf35f5246befc1f458e245d67cd5adafb53306808

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-9602.exe

Filesize
468KB

MD5
07ccf2db4f55a21a148dad1a7869454d

SHA1
eb1a12944eacb0f12ab9140e0f78c6f3c6025f2f

SHA256
cc724a53df63e50d57e7286a9c6b3524847ce3aaaead8dbb12eab0ea3a836c6a

SHA512
1beaa2d6d3757a9c9f22268c6a0674c95ecfebc11f9779a307b417ce840028304894058ce7d53a081dba341ee4a6d65e78d99609ea4d0235c41e6b447cd8e882

Download Submit