4b3fbdcb3f4343a92000c3d8a45d90f1c61fe329625c66a6fc93967f5ace2e2b

Analysis

max time kernel
120s
max time network
16s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
05/10/2024, 13:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4b3fbdcb3f4343a92000c3d8a45d90f1c61fe329625c66a6fc93967f5ace2e2bN.exe
Size

468KB
MD5

289cfb676ade7526816f4ac2892cef10
SHA1

945d3ee14bfc6850e7aca4d068a13f6bb069274b
SHA256

4b3fbdcb3f4343a92000c3d8a45d90f1c61fe329625c66a6fc93967f5ace2e2b
SHA512

8240e5191645e15611321c5b0f497f30feb4f7cfcb47a5c01dce1864b0d76ae2337a9df7d66f91669b1088b9086fcbc4fc9b5e0c6e03a1ea7c33f524675109d1
SSDEEP

3072:1G3HogISIE5TtbY2HzcOcf8/zCc8P0pkJVHeTVPyQ6RLa7tgErlL:1G3obMTtxH4OcfHY10Q6NYtgE

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2656	Unicorn-34412.exe
2208	Unicorn-47899.exe
2416	Unicorn-32117.exe
2832	Unicorn-24764.exe
2772	Unicorn-44630.exe
2796	Unicorn-7681.exe
2732	Unicorn-1551.exe
2636	Unicorn-748.exe
2284	Unicorn-54588.exe
468	Unicorn-33805.exe
2904	Unicorn-34359.exe
2540	Unicorn-48095.exe
1972	Unicorn-54225.exe
1044	Unicorn-7774.exe
2196	Unicorn-58631.exe
2144	Unicorn-13514.exe
1500	Unicorn-44002.exe
444	Unicorn-53653.exe
1360	Unicorn-31003.exe
1600	Unicorn-5922.exe
1544	Unicorn-62529.exe
676	Unicorn-2393.exe
2076	Unicorn-14645.exe
1616	Unicorn-34511.exe
1148	Unicorn-46763.exe
300	Unicorn-46498.exe
3068	Unicorn-65521.exe
568	Unicorn-10665.exe
1688	Unicorn-35170.exe
884	Unicorn-15304.exe
1772	Unicorn-28708.exe
1696	Unicorn-3649.exe
2488	Unicorn-13855.exe
936	Unicorn-19986.exe
2888	Unicorn-52009.exe
2720	Unicorn-52274.exe
2768	Unicorn-40576.exe
2704	Unicorn-7157.exe
2120	Unicorn-15880.exe
1708	Unicorn-40214.exe
2980	Unicorn-51505.exe
2356	Unicorn-23686.exe
2184	Unicorn-53161.exe
2164	Unicorn-53426.exe
1852	Unicorn-59548.exe
2956	Unicorn-60525.exe
536	Unicorn-7240.exe
2560	Unicorn-8179.exe
2376	Unicorn-61786.exe
2672	Unicorn-41920.exe
2756	Unicorn-2586.exe
2612	Unicorn-11516.exe
2380	Unicorn-21338.exe
692	Unicorn-1163.exe
956	Unicorn-31618.exe
1724	Unicorn-21029.exe
848	Unicorn-42802.exe
1856	Unicorn-24921.exe
1384	Unicorn-29559.exe
2188	Unicorn-36104.exe
2116	Unicorn-2974.exe
1668	Unicorn-36296.exe
1580	Unicorn-40934.exe
2496	Unicorn-3431.exe

Loads dropped DLL 64 IoCs

pid	Process
2364	4b3fbdcb3f4343a92000c3d8a45d90f1c61fe329625c66a6fc93967f5ace2e2bN.exe
2364	4b3fbdcb3f4343a92000c3d8a45d90f1c61fe329625c66a6fc93967f5ace2e2bN.exe
2656	Unicorn-34412.exe
2656	Unicorn-34412.exe
2364	4b3fbdcb3f4343a92000c3d8a45d90f1c61fe329625c66a6fc93967f5ace2e2bN.exe
2364	4b3fbdcb3f4343a92000c3d8a45d90f1c61fe329625c66a6fc93967f5ace2e2bN.exe
2656	Unicorn-34412.exe
2208	Unicorn-47899.exe
2656	Unicorn-34412.exe
2208	Unicorn-47899.exe
2364	4b3fbdcb3f4343a92000c3d8a45d90f1c61fe329625c66a6fc93967f5ace2e2bN.exe
2416	Unicorn-32117.exe
2416	Unicorn-32117.exe
2364	4b3fbdcb3f4343a92000c3d8a45d90f1c61fe329625c66a6fc93967f5ace2e2bN.exe
2772	Unicorn-44630.exe
2772	Unicorn-44630.exe
2208	Unicorn-47899.exe
2208	Unicorn-47899.exe
2832	Unicorn-24764.exe
2832	Unicorn-24764.exe
2416	Unicorn-32117.exe
2656	Unicorn-34412.exe
2656	Unicorn-34412.exe
2416	Unicorn-32117.exe
2796	Unicorn-7681.exe
2796	Unicorn-7681.exe
2364	4b3fbdcb3f4343a92000c3d8a45d90f1c61fe329625c66a6fc93967f5ace2e2bN.exe
2364	4b3fbdcb3f4343a92000c3d8a45d90f1c61fe329625c66a6fc93967f5ace2e2bN.exe
1292	WerFault.exe
1292	WerFault.exe
1292	WerFault.exe
1292	WerFault.exe
1292	WerFault.exe
2284	Unicorn-54588.exe
2284	Unicorn-54588.exe
2636	Unicorn-748.exe
2636	Unicorn-748.exe
2208	Unicorn-47899.exe
2772	Unicorn-44630.exe
2772	Unicorn-44630.exe
2208	Unicorn-47899.exe
1044	Unicorn-7774.exe
1044	Unicorn-7774.exe
1972	Unicorn-54225.exe
1972	Unicorn-54225.exe
2364	4b3fbdcb3f4343a92000c3d8a45d90f1c61fe329625c66a6fc93967f5ace2e2bN.exe
2364	4b3fbdcb3f4343a92000c3d8a45d90f1c61fe329625c66a6fc93967f5ace2e2bN.exe
2556	WerFault.exe
2556	WerFault.exe
2556	WerFault.exe
2556	WerFault.exe
2796	Unicorn-7681.exe
2796	Unicorn-7681.exe
2556	WerFault.exe
2540	Unicorn-48095.exe
2832	Unicorn-24764.exe
2540	Unicorn-48095.exe
2832	Unicorn-24764.exe
2904	Unicorn-34359.exe
2656	Unicorn-34412.exe
2904	Unicorn-34359.exe
2656	Unicorn-34412.exe
2416	Unicorn-32117.exe
2416	Unicorn-32117.exe

Program crash 64 IoCs

pid	pid_target	Process	procid_target
1292	2732	WerFault.exe	36
2556	468	WerFault.exe	40
700	2144	WerFault.exe	47
1740	884	WerFault.exe	62
316	568	WerFault.exe	60
2936	2756	WerFault.exe	83
1908	2956	WerFault.exe	78
2108	2980	WerFault.exe	73
2404	1616	WerFault.exe	55
1320	2672	WerFault.exe	82
1588	300	WerFault.exe	58
2344	1708	WerFault.exe	72
1556	1852	WerFault.exe	77
1256	1600	WerFault.exe	51
3004	2120	WerFault.exe	71
2864	2832	WerFault.exe	34
2592	1848	WerFault.exe	102
2584	2496	WerFault.exe	100
2576	2740	WerFault.exe	106
2780	2620	WerFault.exe	109
1584	2888	WerFault.exe	67
2848	2776	WerFault.exe	103
1188	2276	WerFault.exe	92
612	1668	WerFault.exe	98
3476	640	WerFault.exe	110
3484	1100	WerFault.exe	122
3468	2200	WerFault.exe	108
3656	2612	WerFault.exe	84
4036	536	WerFault.exe	79
4028	2768	WerFault.exe	69
4012	676	WerFault.exe	54
4064	2840	WerFault.exe	104
4072	2376	WerFault.exe	81
4056	2356	WerFault.exe	74
3096	2796	WerFault.exe	37
1356	2656	WerFault.exe	31
3128	1148	WerFault.exe	57
3312	2940	WerFault.exe	121
3292	2372	WerFault.exe	111
3288	1524	WerFault.exe	123
3284	764	WerFault.exe	126
3264	620	WerFault.exe	145
3248	1248	WerFault.exe	135
3232	2028	WerFault.exe	118
3220	352	WerFault.exe	146
3200	1292	WerFault.exe	125
3196	1804	WerFault.exe	127
3180	2320	WerFault.exe	130
3168	2716	WerFault.exe	133
3508	2184	WerFault.exe	75
3616	956	WerFault.exe	91
3684	2560	WerFault.exe	80
3644	2076	WerFault.exe	56
4352	2116	WerFault.exe	97
4404	1688	WerFault.exe	61
4412	2720	WerFault.exe	68
4384	1696	WerFault.exe	64
4392	2164	WerFault.exe	76
4428	2636	WerFault.exe	38
4436	1360	WerFault.exe	50
4444	848	WerFault.exe	93
4480	2916	WerFault.exe	137
4472	2824	WerFault.exe	107
4464	2456	WerFault.exe	144

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5922.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43054.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54856.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46621.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25748.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48249.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28708.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45582.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53817.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50632.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7774.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53653.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2974.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5667.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11669.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22862.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44040.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53226.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-458.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32654.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22682.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34074.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37632.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42802.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20507.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14276.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7807.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49720.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62894.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11842.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7008.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51400.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24509.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62765.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57008.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43324.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52274.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8179.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55605.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27221.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30337.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10897.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41833.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33559.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25939.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59091.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25940.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17196.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51505.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16485.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63865.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12713.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3649.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35457.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14196.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32537.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13372.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3341.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39158.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5503.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11284.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32006.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39323.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25172.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2364	4b3fbdcb3f4343a92000c3d8a45d90f1c61fe329625c66a6fc93967f5ace2e2bN.exe
2656	Unicorn-34412.exe
2208	Unicorn-47899.exe
2416	Unicorn-32117.exe
2772	Unicorn-44630.exe
2832	Unicorn-24764.exe
2796	Unicorn-7681.exe
2732	Unicorn-1551.exe
2636	Unicorn-748.exe
2284	Unicorn-54588.exe
2904	Unicorn-34359.exe
468	Unicorn-33805.exe
1972	Unicorn-54225.exe
2540	Unicorn-48095.exe
1044	Unicorn-7774.exe
2196	Unicorn-58631.exe
2144	Unicorn-13514.exe
444	Unicorn-53653.exe
1500	Unicorn-44002.exe
1360	Unicorn-31003.exe
1600	Unicorn-5922.exe
1544	Unicorn-62529.exe
1616	Unicorn-34511.exe
300	Unicorn-46498.exe
676	Unicorn-2393.exe
2076	Unicorn-14645.exe
3068	Unicorn-65521.exe
1148	Unicorn-46763.exe
568	Unicorn-10665.exe
1688	Unicorn-35170.exe
884	Unicorn-15304.exe
1696	Unicorn-3649.exe
2488	Unicorn-13855.exe
2720	Unicorn-52274.exe
936	Unicorn-19986.exe
2888	Unicorn-52009.exe
2768	Unicorn-40576.exe
2704	Unicorn-7157.exe
2120	Unicorn-15880.exe
1708	Unicorn-40214.exe
2980	Unicorn-51505.exe
2356	Unicorn-23686.exe
2184	Unicorn-53161.exe
2164	Unicorn-53426.exe
1852	Unicorn-59548.exe
2956	Unicorn-60525.exe
536	Unicorn-7240.exe
2612	Unicorn-11516.exe
2672	Unicorn-41920.exe
2376	Unicorn-61786.exe
2756	Unicorn-2586.exe
2560	Unicorn-8179.exe
2380	Unicorn-21338.exe
1724	Unicorn-21029.exe
692	Unicorn-1163.exe
956	Unicorn-31618.exe
2276	Unicorn-41833.exe
848	Unicorn-42802.exe
1856	Unicorn-24921.exe
1384	Unicorn-29559.exe
2188	Unicorn-36104.exe
2116	Unicorn-2974.exe
1668	Unicorn-36296.exe
1580	Unicorn-40934.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2364 wrote to memory of 2656	2364	4b3fbdcb3f4343a92000c3d8a45d90f1c61fe329625c66a6fc93967f5ace2e2bN.exe	31
PID 2364 wrote to memory of 2656	2364	4b3fbdcb3f4343a92000c3d8a45d90f1c61fe329625c66a6fc93967f5ace2e2bN.exe	31
PID 2364 wrote to memory of 2656	2364	4b3fbdcb3f4343a92000c3d8a45d90f1c61fe329625c66a6fc93967f5ace2e2bN.exe	31
PID 2364 wrote to memory of 2656	2364	4b3fbdcb3f4343a92000c3d8a45d90f1c61fe329625c66a6fc93967f5ace2e2bN.exe	31
PID 2656 wrote to memory of 2208	2656	Unicorn-34412.exe	32
PID 2656 wrote to memory of 2208	2656	Unicorn-34412.exe	32
PID 2656 wrote to memory of 2208	2656	Unicorn-34412.exe	32
PID 2656 wrote to memory of 2208	2656	Unicorn-34412.exe	32
PID 2364 wrote to memory of 2416	2364	4b3fbdcb3f4343a92000c3d8a45d90f1c61fe329625c66a6fc93967f5ace2e2bN.exe	33
PID 2364 wrote to memory of 2416	2364	4b3fbdcb3f4343a92000c3d8a45d90f1c61fe329625c66a6fc93967f5ace2e2bN.exe	33
PID 2364 wrote to memory of 2416	2364	4b3fbdcb3f4343a92000c3d8a45d90f1c61fe329625c66a6fc93967f5ace2e2bN.exe	33
PID 2364 wrote to memory of 2416	2364	4b3fbdcb3f4343a92000c3d8a45d90f1c61fe329625c66a6fc93967f5ace2e2bN.exe	33
PID 2656 wrote to memory of 2832	2656	Unicorn-34412.exe	34
PID 2656 wrote to memory of 2832	2656	Unicorn-34412.exe	34
PID 2656 wrote to memory of 2832	2656	Unicorn-34412.exe	34
PID 2656 wrote to memory of 2832	2656	Unicorn-34412.exe	34
PID 2208 wrote to memory of 2772	2208	Unicorn-47899.exe	35
PID 2208 wrote to memory of 2772	2208	Unicorn-47899.exe	35
PID 2208 wrote to memory of 2772	2208	Unicorn-47899.exe	35
PID 2208 wrote to memory of 2772	2208	Unicorn-47899.exe	35
PID 2416 wrote to memory of 2796	2416	Unicorn-32117.exe	37
PID 2416 wrote to memory of 2796	2416	Unicorn-32117.exe	37
PID 2416 wrote to memory of 2796	2416	Unicorn-32117.exe	37
PID 2416 wrote to memory of 2796	2416	Unicorn-32117.exe	37
PID 2364 wrote to memory of 2732	2364	4b3fbdcb3f4343a92000c3d8a45d90f1c61fe329625c66a6fc93967f5ace2e2bN.exe	36
PID 2364 wrote to memory of 2732	2364	4b3fbdcb3f4343a92000c3d8a45d90f1c61fe329625c66a6fc93967f5ace2e2bN.exe	36
PID 2364 wrote to memory of 2732	2364	4b3fbdcb3f4343a92000c3d8a45d90f1c61fe329625c66a6fc93967f5ace2e2bN.exe	36
PID 2364 wrote to memory of 2732	2364	4b3fbdcb3f4343a92000c3d8a45d90f1c61fe329625c66a6fc93967f5ace2e2bN.exe	36
PID 2772 wrote to memory of 2636	2772	Unicorn-44630.exe	38
PID 2772 wrote to memory of 2636	2772	Unicorn-44630.exe	38
PID 2772 wrote to memory of 2636	2772	Unicorn-44630.exe	38
PID 2772 wrote to memory of 2636	2772	Unicorn-44630.exe	38
PID 2208 wrote to memory of 2284	2208	Unicorn-47899.exe	39
PID 2208 wrote to memory of 2284	2208	Unicorn-47899.exe	39
PID 2208 wrote to memory of 2284	2208	Unicorn-47899.exe	39
PID 2208 wrote to memory of 2284	2208	Unicorn-47899.exe	39
PID 2832 wrote to memory of 468	2832	Unicorn-24764.exe	40
PID 2832 wrote to memory of 468	2832	Unicorn-24764.exe	40
PID 2832 wrote to memory of 468	2832	Unicorn-24764.exe	40
PID 2832 wrote to memory of 468	2832	Unicorn-24764.exe	40
PID 2656 wrote to memory of 2540	2656	Unicorn-34412.exe	42
PID 2656 wrote to memory of 2540	2656	Unicorn-34412.exe	42
PID 2656 wrote to memory of 2540	2656	Unicorn-34412.exe	42
PID 2656 wrote to memory of 2540	2656	Unicorn-34412.exe	42
PID 2416 wrote to memory of 2904	2416	Unicorn-32117.exe	41
PID 2416 wrote to memory of 2904	2416	Unicorn-32117.exe	41
PID 2416 wrote to memory of 2904	2416	Unicorn-32117.exe	41
PID 2416 wrote to memory of 2904	2416	Unicorn-32117.exe	41
PID 2732 wrote to memory of 1292	2732	Unicorn-1551.exe	43
PID 2732 wrote to memory of 1292	2732	Unicorn-1551.exe	43
PID 2732 wrote to memory of 1292	2732	Unicorn-1551.exe	43
PID 2732 wrote to memory of 1292	2732	Unicorn-1551.exe	43
PID 2796 wrote to memory of 1972	2796	Unicorn-7681.exe	44
PID 2796 wrote to memory of 1972	2796	Unicorn-7681.exe	44
PID 2796 wrote to memory of 1972	2796	Unicorn-7681.exe	44
PID 2796 wrote to memory of 1972	2796	Unicorn-7681.exe	44
PID 2364 wrote to memory of 1044	2364	4b3fbdcb3f4343a92000c3d8a45d90f1c61fe329625c66a6fc93967f5ace2e2bN.exe	45
PID 2364 wrote to memory of 1044	2364	4b3fbdcb3f4343a92000c3d8a45d90f1c61fe329625c66a6fc93967f5ace2e2bN.exe	45
PID 2364 wrote to memory of 1044	2364	4b3fbdcb3f4343a92000c3d8a45d90f1c61fe329625c66a6fc93967f5ace2e2bN.exe	45
PID 2364 wrote to memory of 1044	2364	4b3fbdcb3f4343a92000c3d8a45d90f1c61fe329625c66a6fc93967f5ace2e2bN.exe	45
PID 2284 wrote to memory of 2196	2284	Unicorn-54588.exe	46
PID 2284 wrote to memory of 2196	2284	Unicorn-54588.exe	46
PID 2284 wrote to memory of 2196	2284	Unicorn-54588.exe	46
PID 2284 wrote to memory of 2196	2284	Unicorn-54588.exe	46

C:\Users\Admin\AppData\Local\Temp\4b3fbdcb3f4343a92000c3d8a45d90f1c61fe329625c66a6fc93967f5ace2e2bN.exe
"C:\Users\Admin\AppData\Local\Temp\4b3fbdcb3f4343a92000c3d8a45d90f1c61fe329625c66a6fc93967f5ace2e2bN.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2364
- C:\Users\Admin\AppData\Local\Temp\Unicorn-34412.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-34412.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2656
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47899.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47899.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44630.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44630.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-748.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:2636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13514.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35170.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21029.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61763.exe
        9⤵
        
        PID:3120
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3120 -s 220
        10⤵
        
        PID:4292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47617.exe
        9⤵
        
        PID:4488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37424.exe
        10⤵
        
        PID:7808
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4488 -s 228
        10⤵
        
        PID:8228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40382.exe
        9⤵
        
        PID:5592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46621.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:6228
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1724 -s 244
        9⤵
        
        PID:6204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33921.exe
        8⤵
        
        PID:3236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57555.exe
        9⤵
        
        PID:4892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37139.exe
        9⤵
        
        PID:5148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45201.exe
        9⤵
        
        PID:6764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36256.exe
        9⤵
        
        PID:7532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50632.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:9048
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1688 -s 244
        8⤵
        Program crash
        
        PID:4404
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2144 -s 236
        7⤵
        Program crash
        
        PID:700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28708.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41833.exe
        7⤵
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2276
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2276 -s 244
        8⤵
        Program crash
        
        PID:1188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29562.exe
        7⤵
        
        PID:2240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52848.exe
        8⤵
        
        PID:5024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6069.exe
        9⤵
        
        PID:7608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21296.exe
        8⤵
        
        PID:5696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28197.exe
        8⤵
        
        PID:7028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45332.exe
        8⤵
        
        PID:7444
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2240 -s 220
        8⤵
        
        PID:7904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61352.exe
        7⤵
        
        PID:4376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4175.exe
        8⤵
        
        PID:7840
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4376 -s 228
        8⤵
        
        PID:8204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42163.exe
        7⤵
        
        PID:5576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37955.exe
        7⤵
        
        PID:6212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-458.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39086.exe
        7⤵
        
        PID:7380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42802.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54088.exe
        7⤵
        
        PID:1476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19024.exe
        8⤵
        
        PID:4956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44305.exe
        9⤵
        
        PID:7764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37056.exe
        8⤵
        
        PID:5564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44342.exe
        8⤵
        
        PID:6944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7807.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:7288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16080.exe
        8⤵
        
        PID:7316
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 848 -s 236
        7⤵
        Program crash
        
        PID:4444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57907.exe
        6⤵
        
        PID:2408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19024.exe
        7⤵
        
        PID:4972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37289.exe
        8⤵
        
        PID:7944
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2408 -s 248
        7⤵
        
        PID:5584
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2636 -s 224
        6⤵
        Program crash
        
        PID:4428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44002.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3649.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24921.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40684.exe
        8⤵
        
        PID:2008
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2008 -s 224
        9⤵
        
        PID:4372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13600.exe
        8⤵
        
        PID:4308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25172.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:7780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58617.exe
        9⤵
        
        PID:8196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24429.exe
        8⤵
        
        PID:5492
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1856 -s 248
        8⤵
        
        PID:5348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34222.exe
        7⤵
        
        PID:1680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62137.exe
        8⤵
        
        PID:4836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25940.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:8096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59769.exe
        9⤵
        
        PID:8428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64135.exe
        8⤵
        
        PID:5716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21103.exe
        8⤵
        
        PID:6452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54247.exe
        8⤵
        
        PID:6524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1607.exe
        8⤵
        
        PID:7984
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1696 -s 244
        7⤵
        Program crash
        
        PID:4384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29559.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28240.exe
        7⤵
        
        PID:3000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26424.exe
        8⤵
        
        PID:4848
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4848 -s 224
        9⤵
        
        PID:7576
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3000 -s 216
        8⤵
        
        PID:5304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38296.exe
        7⤵
        
        PID:4244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39323.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:7708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62016.exe
        8⤵
        
        PID:8148
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4244 -s 220
        8⤵
        
        PID:3976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52826.exe
        7⤵
        
        PID:5404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14332.exe
        7⤵
        
        PID:5648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16993.exe
        7⤵
        
        PID:7052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22020.exe
        7⤵
        
        PID:7540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1497.exe
        6⤵
        
        PID:1032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20607.exe
        7⤵
        
        PID:5020
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1032 -s 236
        7⤵
        
        PID:6124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4612.exe
        6⤵
        
        PID:4276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55467.exe
        7⤵
        
        PID:7672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62016.exe
        7⤵
        
        PID:4228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50026.exe
        6⤵
        
        PID:5420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54669.exe
        6⤵
        
        PID:5708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17523.exe
        6⤵
        
        PID:7004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17555.exe
        6⤵
        
        PID:7388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13855.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36104.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27773.exe
        7⤵
        
        PID:3040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22065.exe
        8⤵
        
        PID:5056
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3040 -s 216
        8⤵
        
        PID:5072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16485.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24471.exe
        8⤵
        
        PID:6240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16463.exe
        8⤵
        
        PID:7824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24154.exe
        7⤵
        
        PID:5252
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2188 -s 248
        7⤵
        
        PID:1280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25587.exe
        6⤵
        
        PID:2932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51613.exe
        7⤵
        
        PID:4496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18348.exe
        8⤵
        
        PID:8020
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4496 -s 228
        8⤵
        
        PID:8884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3341.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11669.exe
        7⤵
        
        PID:6920
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2932 -s 216
        7⤵
        
        PID:7252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14076.exe
        6⤵
        
        PID:3412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14979.exe
        7⤵
        
        PID:7104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32472.exe
        7⤵
        
        PID:8044
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2488 -s 236
        6⤵
        
        PID:5240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2974.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16455.exe
        6⤵
        
        PID:3304
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3304 -s 224
        7⤵
        
        PID:4548
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2116 -s 236
        6⤵
        Program crash
        
        PID:4352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37264.exe
        5⤵
        
        PID:3392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57830.exe
        6⤵
        
        PID:4260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43589.exe
        7⤵
        
        PID:8080
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3392 -s 228
        6⤵
        
        PID:5516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65068.exe
        5⤵
        
        PID:4780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25748.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51409.exe
        6⤵
        
        PID:8300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10063.exe
        5⤵
        
        PID:5724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62840.exe
        5⤵
        
        PID:6444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19246.exe
        5⤵
        
        PID:7016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40924.exe
        5⤵
        
        PID:7828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54588.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54588.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58631.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10665.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:568
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 568 -s 244
        7⤵
        Program crash
        
        PID:316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1163.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21115.exe
        7⤵
        
        PID:3188
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3188 -s 224
        8⤵
        
        PID:4368
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 692 -s 236
        7⤵
        
        PID:4456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42997.exe
        6⤵
        
        PID:3336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-845.exe
        7⤵
        
        PID:4580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31851.exe
        8⤵
        
        PID:9156
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3336 -s 236
        7⤵
        
        PID:5320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34353.exe
        6⤵
        
        PID:4536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49100.exe
        7⤵
        
        PID:7888
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4536 -s 248
        7⤵
        
        PID:8220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30337.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25696.exe
        6⤵
        
        PID:6296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46112.exe
        6⤵
        
        PID:6488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46143.exe
        6⤵
        
        PID:7928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15304.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:884
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 884 -s 244
        6⤵
        Program crash
        
        PID:1740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31618.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1301.exe
        6⤵
        
        PID:2572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18889.exe
        7⤵
        
        PID:3368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32802.exe
        8⤵
        
        PID:5808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55036.exe
        8⤵
        
        PID:7144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28148.exe
        8⤵
        
        PID:7632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43324.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49942.exe
        7⤵
        
        PID:4932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50875.exe
        7⤵
        
        PID:5136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10417.exe
        7⤵
        
        PID:6492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4373.exe
        7⤵
        
        PID:7452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42648.exe
        7⤵
        
        PID:8688
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 956 -s 248
        6⤵
        Program crash
        
        PID:3616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1036.exe
        5⤵
        
        PID:1248
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1248 -s 244
        6⤵
        Program crash
        
        PID:3248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55075.exe
        5⤵
        
        PID:3088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36393.exe
        6⤵
        
        PID:5884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56354.exe
        6⤵
        
        PID:6576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7173.exe
        6⤵
        
        PID:7508
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3088 -s 228
        6⤵
        
        PID:8740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18685.exe
        5⤵
        
        PID:4300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4803.exe
        6⤵
        
        PID:7952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48605.exe
        5⤵
        
        PID:6076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20715.exe
        5⤵
        
        PID:6376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22770.exe
        5⤵
        
        PID:7200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27572.exe
        5⤵
        
        PID:8468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53653.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53653.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19986.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20404.exe
        6⤵
        
        PID:2200
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2200 -s 224
        7⤵
        Program crash
        
        PID:3468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26137.exe
        6⤵
        
        PID:3664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49745.exe
        7⤵
        
        PID:4640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23045.exe
        7⤵
        
        PID:5296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19793.exe
        7⤵
        
        PID:7128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47221.exe
        7⤵
        
        PID:7352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7958.exe
        6⤵
        
        PID:4184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38768.exe
        7⤵
        
        PID:8140
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4184 -s 228
        7⤵
        
        PID:8892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42402.exe
        6⤵
        
        PID:6064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8869.exe
        6⤵
        
        PID:6788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15471.exe
        6⤵
        
        PID:6732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20009.exe
        6⤵
        
        PID:7680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62183.exe
        5⤵
        
        PID:640
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 640 -s 224
        6⤵
        Program crash
        
        PID:3476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44040.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62765.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5188
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3768 -s 228
        6⤵
        
        PID:5300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51348.exe
        5⤵
        
        PID:4504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2011.exe
        6⤵
        
        PID:7836
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4504 -s 228
        6⤵
        
        PID:8704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14276.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57871.exe
        5⤵
        
        PID:6796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24368.exe
        5⤵
        
        PID:6244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65085.exe
        5⤵
        
        PID:2328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52009.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52009.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29148.exe
        5⤵
        
        PID:1808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3652.exe
        6⤵
        
        PID:2812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38785.exe
        7⤵
        
        PID:5088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46360.exe
        8⤵
        
        PID:8128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38772.exe
        8⤵
        
        PID:8516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35245.exe
        7⤵
        
        PID:5936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11669.exe
        7⤵
        
        PID:6880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57008.exe
        7⤵
        
        PID:7268
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2812 -s 220
        7⤵
        
        PID:8108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61602.exe
        6⤵
        
        PID:3504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10897.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34646.exe
        7⤵
        
        PID:6480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4547.exe
        7⤵
        
        PID:7560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50750.exe
        7⤵
        
        PID:7344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14642.exe
        6⤵
        
        PID:4856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59091.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14196.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54335.exe
        6⤵
        
        PID:7912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6429.exe
        6⤵
        
        PID:8828
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2888 -s 228
        5⤵
        Program crash
        
        PID:1584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61250.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61250.exe
      4⤵
      PID:2884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50310.exe
        5⤵
        
        PID:2808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25391.exe
        6⤵
        
        PID:3520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12713.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43781.exe
        8⤵
        
        PID:6280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30170.exe
        7⤵
        
        PID:5544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45393.exe
        7⤵
        
        PID:6984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57963.exe
        7⤵
        
        PID:7792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59184.exe
        7⤵
        
        PID:8656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51400.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21856.exe
        7⤵
        
        PID:8068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51601.exe
        7⤵
        
        PID:8368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48981.exe
        6⤵
        
        PID:5944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17534.exe
        6⤵
        
        PID:6776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32006.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2944.exe
        6⤵
        
        PID:7692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1140.exe
        5⤵
        
        PID:3800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15931.exe
        6⤵
        
        PID:3856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1227.exe
        7⤵
        
        PID:7008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7008.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-907.exe
        6⤵
        
        PID:5036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53226.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22862.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21669.exe
        6⤵
        
        PID:8060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54901.exe
        6⤵
        
        PID:8856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34304.exe
        5⤵
        
        PID:3456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5503.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44533.exe
        6⤵
        
        PID:7876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30020.exe
        5⤵
        
        PID:5268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5667.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6152
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2884 -s 228
        5⤵
        
        PID:6872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46691.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46691.exe
      4⤵
      PID:352
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 352 -s 244
        5⤵
        Program crash
        
        PID:3220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55605.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55605.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44478.exe
        5⤵
        
        PID:5532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39158.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6972
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4092 -s 220
        5⤵
        
        PID:7320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14220.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14220.exe
      4⤵
      PID:4332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21739.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21739.exe
      4⤵
      PID:6048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19580.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19580.exe
      4⤵
      PID:6428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20039.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20039.exe
      4⤵
      PID:7516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52565.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52565.exe
      4⤵
      PID:8612
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24764.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24764.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33805.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33805.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:468
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 468 -s 244
        5⤵
        Loads dropped DLL
        Program crash
        
        PID:2556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14645.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14645.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53426.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22682.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17140.exe
        7⤵
        
        PID:3052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26424.exe
        8⤵
        
        PID:4868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48773.exe
        9⤵
        
        PID:7592
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4868 -s 236
        9⤵
        
        PID:9076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16553.exe
        8⤵
        
        PID:5288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11669.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6912
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3052 -s 236
        8⤵
        
        PID:7232
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2456 -s 236
        7⤵
        Program crash
        
        PID:4464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17393.exe
        6⤵
        
        PID:3076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31707.exe
        7⤵
        
        PID:4208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54938.exe
        8⤵
        
        PID:8260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53860.exe
        7⤵
        
        PID:932
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3076 -s 244
        7⤵
        
        PID:6564
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2164 -s 224
        6⤵
        Program crash
        
        PID:4392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4015.exe
        5⤵
        
        PID:2464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22065.exe
        6⤵
        
        PID:5064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50060.exe
        7⤵
        
        PID:7736
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5064 -s 228
        7⤵
        
        PID:8668
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2464 -s 216
        6⤵
        
        PID:5888
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2076 -s 244
        5⤵
        Program crash
        
        PID:3644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59548.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59548.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1852
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1852 -s 244
        5⤵
        Program crash
        
        PID:1556
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2832 -s 248
      4⤵
      Program crash
      PID:2864
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48095.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48095.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34511.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34511.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60525.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2956
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2956 -s 224
        6⤵
        Program crash
        
        PID:1908
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1616 -s 248
        5⤵
        Program crash
        
        PID:2404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8179.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8179.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27965.exe
        5⤵
        
        PID:2744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21105.exe
        6⤵
        
        PID:4884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41700.exe
        7⤵
        
        PID:6820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38772.exe
        7⤵
        
        PID:8528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2874.exe
        6⤵
        
        PID:5792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11669.exe
        6⤵
        
        PID:6896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57008.exe
        6⤵
        
        PID:7260
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2744 -s 220
        6⤵
        
        PID:8136
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2560 -s 228
        5⤵
        Program crash
        
        PID:3684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58399.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58399.exe
      4⤵
      PID:1088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31193.exe
        5⤵
        
        PID:4236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36521.exe
        6⤵
        
        PID:7420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47865.exe
        6⤵
        
        PID:9088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3341.exe
        5⤵
        
        PID:5180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11669.exe
        5⤵
        
        PID:6904
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1088 -s 216
        5⤵
        
        PID:7220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15665.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15665.exe
      4⤵
      PID:3740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1587.exe
        5⤵
        
        PID:5460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60269.exe
        5⤵
        
        PID:5652
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3740 -s 244
        5⤵
        
        PID:6332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11842.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11842.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2193.exe
        5⤵
        
        PID:9116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33890.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33890.exe
      4⤵
      PID:5284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14726.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14726.exe
      4⤵
      PID:7156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53953.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53953.exe
      4⤵
      PID:7980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45100.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45100.exe
      4⤵
      PID:8928
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46498.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46498.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61786.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61786.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-751.exe
        5⤵
        
        PID:1524
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1524 -s 244
        6⤵
        Program crash
        
        PID:3288
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2376 -s 248
        5⤵
        Program crash
        
        PID:4072
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 300 -s 248
      4⤵
      Program crash
      PID:1588
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2586.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2586.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2756
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2756 -s 244
      4⤵
      Program crash
      PID:2936
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32654.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32654.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2028
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2028 -s 224
      4⤵
      Program crash
      PID:3232
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2656 -s 244
    3⤵
    - Program crash
    PID:1356
- C:\Users\Admin\AppData\Local\Temp\Unicorn-32117.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-32117.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2416
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7681.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7681.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54225.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54225.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:1972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5922.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7157.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49568.exe
        7⤵
        
        PID:2776
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2776 -s 244
        8⤵
        Program crash
        
        PID:2848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41347.exe
        7⤵
        
        PID:3064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63865.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63272.exe
        9⤵
        
        PID:6252
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4576 -s 228
        9⤵
        
        PID:8904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3341.exe
        8⤵
        
        PID:5184
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3064 -s 220
        8⤵
        
        PID:6848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35457.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16606.exe
        8⤵
        
        PID:5052
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5052 -s 224
        9⤵
        
        PID:7864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58951.exe
        8⤵
        
        PID:5432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61921.exe
        8⤵
        
        PID:6464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13038.exe
        8⤵
        
        PID:7424
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4188 -s 244
        8⤵
        
        PID:8716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24509.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4349.exe
        7⤵
        
        PID:332
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2704 -s 216
        7⤵
        
        PID:6508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29318.exe
        6⤵
        
        PID:2740
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2740 -s 224
        7⤵
        Program crash
        
        PID:2576
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1600 -s 240
        6⤵
        Program crash
        
        PID:1256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15880.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3431.exe
        6⤵
        Executes dropped EXE
        
        PID:2496
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2496 -s 244
        7⤵
        Program crash
        
        PID:2584
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2120 -s 248
        6⤵
        Program crash
        
        PID:3004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2405.exe
        5⤵
        
        PID:2840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30850.exe
        6⤵
        
        PID:620
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 620 -s 244
        7⤵
        Program crash
        
        PID:3264
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2840 -s 248
        6⤵
        Program crash
        
        PID:4064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23616.exe
        5⤵
        
        PID:2628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9812.exe
        6⤵
        
        PID:5012
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5012 -s 224
        7⤵
        
        PID:7860
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2628 -s 216
        6⤵
        
        PID:5900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7000.exe
        5⤵
        
        PID:3732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8819.exe
        6⤵
        
        PID:6744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60101.exe
        6⤵
        
        PID:8184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60844.exe
        5⤵
        
        PID:4284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50956.exe
        5⤵
        
        PID:5660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54648.exe
        5⤵
        
        PID:7020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44534.exe
        5⤵
        
        PID:7884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49300.exe
        5⤵
        
        PID:8844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2393.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2393.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11516.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62204.exe
        6⤵
        
        PID:1100
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1100 -s 224
        7⤵
        Program crash
        
        PID:3484
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2612 -s 236
        6⤵
        Program crash
        
        PID:3656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9941.exe
        5⤵
        
        PID:1292
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1292 -s 244
        6⤵
        Program crash
        
        PID:3200
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 676 -s 240
        5⤵
        Program crash
        
        PID:4012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21338.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21338.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53460.exe
        5⤵
        
        PID:2620
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2620 -s 220
        6⤵
        Program crash
        
        PID:2780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7907.exe
        5⤵
        
        PID:2492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5728.exe
        6⤵
        
        PID:4996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62504.exe
        7⤵
        
        PID:8036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27096.exe
        7⤵
        
        PID:8340
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2492 -s 228
        6⤵
        
        PID:5972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9800.exe
        5⤵
        
        PID:3444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22032.exe
        6⤵
        
        PID:6248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15176.exe
        6⤵
        
        PID:6844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20507.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18701.exe
        6⤵
        
        PID:7776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50426.exe
        5⤵
        
        PID:5680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59114.exe
        5⤵
        
        PID:7044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5863.exe
        5⤵
        
        PID:7868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50435.exe
        5⤵
        
        PID:8812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29651.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29651.exe
      4⤵
      PID:2372
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2372 -s 244
        5⤵
        Program crash
        
        PID:3292
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2796 -s 244
      4⤵
      Program crash
      PID:3096
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34359.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34359.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46763.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46763.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7240.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21556.exe
        6⤵
        
        PID:2040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1078.exe
        7⤵
        
        PID:3420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13372.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:1228
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3420 -s 228
        8⤵
        
        PID:5316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17767.exe
        7⤵
        
        PID:4808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9411.exe
        8⤵
        
        PID:7936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43240.exe
        8⤵
        
        PID:8244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12333.exe
        7⤵
        
        PID:5736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22885.exe
        7⤵
        
        PID:6432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45582.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50609.exe
        7⤵
        
        PID:8012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62894.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3492
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 536 -s 220
        6⤵
        Program crash
        
        PID:4036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38254.exe
        5⤵
        
        PID:916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33559.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3548
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3548 -s 224
        7⤵
        
        PID:5200
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 916 -s 248
        6⤵
        
        PID:4984
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1148 -s 244
        5⤵
        Program crash
        
        PID:3128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41920.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41920.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2672
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2672 -s 244
        5⤵
        Program crash
        
        PID:1320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32612.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32612.exe
      4⤵
      PID:764
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 764 -s 224
        5⤵
        Program crash
        
        PID:3284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63740.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63740.exe
      4⤵
      PID:4084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11805.exe
        5⤵
        
        PID:5588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43242.exe
        5⤵
        
        PID:6988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27598.exe
        5⤵
        
        PID:7328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49250.exe
        5⤵
        
        PID:2160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44541.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44541.exe
      4⤵
      PID:4644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31539.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31539.exe
      4⤵
      PID:6072
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42246.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42246.exe
      4⤵
      PID:6384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28105.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28105.exe
      4⤵
      PID:7296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23372.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23372.exe
      4⤵
      PID:8476
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-65521.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-65521.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23686.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23686.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29916.exe
        5⤵
        
        PID:1968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64005.exe
        6⤵
        
        PID:3148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15973.exe
        7⤵
        
        PID:768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3069.exe
        7⤵
        
        PID:6860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23509.exe
        7⤵
        
        PID:7664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2312.exe
        7⤵
        
        PID:8728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24285.exe
        6⤵
        
        PID:4288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48249.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1736
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1968 -s 240
        6⤵
        
        PID:6100
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2356 -s 248
        5⤵
        Program crash
        
        PID:4056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1690.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1690.exe
      4⤵
      PID:1940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17223.exe
        5⤵
        
        PID:3460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9288.exe
        6⤵
        
        PID:1260
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3460 -s 228
        6⤵
        
        PID:5624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35063.exe
        5⤵
        
        PID:4916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21280.exe
        6⤵
        
        PID:8164
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4916 -s 228
        6⤵
        
        PID:8584
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1940 -s 220
        5⤵
        
        PID:5916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11284.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11284.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29050.exe
        5⤵
        
        PID:4344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39490.exe
        5⤵
        
        PID:5172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16996.exe
        5⤵
        
        PID:5152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30335.exe
        5⤵
        
        PID:8048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5899.exe
        5⤵
        
        PID:8916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54856.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54856.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54336.exe
        5⤵
        
        PID:8000
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5116 -s 216
        5⤵
        
        PID:8332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46181.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46181.exe
      4⤵
      PID:5928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57871.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57871.exe
      4⤵
      PID:6768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32537.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32537.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64016.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64016.exe
      4⤵
      PID:7600
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53161.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53161.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60445.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60445.exe
      4⤵
      PID:1892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59013.exe
        5⤵
        
        PID:4944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58036.exe
        6⤵
        
        PID:7304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38772.exe
        6⤵
        
        PID:8508
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1892 -s 228
        5⤵
        
        PID:5980
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2184 -s 248
      4⤵
      Program crash
      PID:3508
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64919.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64919.exe
    3⤵
    PID:920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58629.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58629.exe
      4⤵
      PID:4264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10371.exe
        5⤵
        
        PID:7204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60501.exe
        5⤵
        
        PID:8876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64026.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64026.exe
      4⤵
      PID:6128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11669.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11669.exe
      4⤵
      PID:6888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57008.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57008.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11996.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11996.exe
      4⤵
      PID:8152
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27221.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27221.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42971.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42971.exe
      4⤵
      PID:6532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27262.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27262.exe
      4⤵
      PID:7360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20759.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20759.exe
      4⤵
      PID:9020
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21884.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21884.exe
    3⤵
    PID:5260
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50203.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50203.exe
    3⤵
    PID:5628
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56194.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56194.exe
    3⤵
    PID:6968
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16420.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16420.exe
    3⤵
    PID:7524
- C:\Users\Admin\AppData\Local\Temp\Unicorn-1551.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-1551.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2732
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2732 -s 240
    3⤵
    - Loads dropped DLL
    - Program crash
    PID:1292
- C:\Users\Admin\AppData\Local\Temp\Unicorn-7774.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-7774.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1044
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31003.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31003.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52274.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52274.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36296.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1668
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1668 -s 244
        6⤵
        Program crash
        
        PID:612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54067.exe
        5⤵
        
        PID:2640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39719.exe
        6⤵
        
        PID:5100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53817.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37632.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48234.exe
        6⤵
        
        PID:7056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45332.exe
        6⤵
        
        PID:7436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17196.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7640
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2720 -s 244
        5⤵
        Program crash
        
        PID:4412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40934.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40934.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38743.exe
        5⤵
        
        PID:2320
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2320 -s 244
        6⤵
        Program crash
        
        PID:3180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44140.exe
        5⤵
        
        PID:4048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20488.exe
        6⤵
        
        PID:5540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23489.exe
        6⤵
        
        PID:6940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43930.exe
        6⤵
        
        PID:7720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63765.exe
        6⤵
        
        PID:8624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47341.exe
        5⤵
        
        PID:4612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56740.exe
        5⤵
        
        PID:6056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41716.exe
        5⤵
        
        PID:6292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32570.exe
        5⤵
        
        PID:7228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50238.exe
        5⤵
        
        PID:8456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60708.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60708.exe
      4⤵
      PID:2916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8862.exe
        5⤵
        
        PID:3152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26424.exe
        6⤵
        
        PID:4844
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3152 -s 236
        6⤵
        
        PID:4864
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2916 -s 236
        5⤵
        Program crash
        
        PID:4480
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12105.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12105.exe
      4⤵
      PID:3276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58022.exe
        5⤵
        
        PID:4364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33200.exe
        6⤵
        
        PID:7160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26470.exe
        5⤵
        
        PID:5336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4552.exe
        5⤵
        
        PID:6536
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3276 -s 216
        5⤵
        
        PID:7412
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1360 -s 244
      4⤵
      Program crash
      PID:4436
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40576.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40576.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45484.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45484.exe
      4⤵
      PID:1848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1301.exe
        5⤵
        
        PID:1932
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1848 -s 236
        5⤵
        Program crash
        
        PID:2592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46973.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46973.exe
      4⤵
      PID:2716
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2716 -s 244
        5⤵
        Program crash
        
        PID:3168
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2768 -s 240
      4⤵
      Program crash
      PID:4028
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43054.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43054.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13055.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13055.exe
      4⤵
      PID:2972
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2972 -s 224
        5⤵
        
        PID:4400
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2824 -s 216
      4⤵
      Program crash
      PID:4472
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36994.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36994.exe
    3⤵
    PID:1812
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1812 -s 244
      4⤵
      PID:4508
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58552.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58552.exe
    3⤵
    PID:4420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57652.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57652.exe
      4⤵
      PID:7752
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4420 -s 248
      4⤵
      PID:8212
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16962.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16962.exe
    3⤵
    PID:5604
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38486.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38486.exe
    3⤵
    PID:6220
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61530.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61530.exe
    3⤵
    PID:6936
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12220.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12220.exe
    3⤵
    PID:7348
- C:\Users\Admin\AppData\Local\Temp\Unicorn-62529.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-62529.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1544
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40214.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40214.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1708
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1708 -s 244
      4⤵
      Program crash
      PID:2344
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18877.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18877.exe
    3⤵
    PID:1804
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1804 -s 224
      4⤵
      Program crash
      PID:3196
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57875.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57875.exe
    3⤵
    PID:3112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18163.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18163.exe
      4⤵
      PID:6036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63471.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63471.exe
      4⤵
      PID:6836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42975.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42975.exe
      4⤵
      PID:7184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20661.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20661.exe
      4⤵
      PID:7972
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53206.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53206.exe
    3⤵
    PID:4660
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48075.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48075.exe
    3⤵
    PID:5168
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50754.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50754.exe
    3⤵
    PID:6556
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4903.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4903.exe
    3⤵
    PID:7428
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38183.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38183.exe
    3⤵
    PID:8696
- C:\Users\Admin\AppData\Local\Temp\Unicorn-51505.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-51505.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2980
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2980 -s 244
    3⤵
    - Program crash
    PID:2108
- C:\Users\Admin\AppData\Local\Temp\Unicorn-49720.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-49720.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2940
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2940 -s 244
    3⤵
    - Program crash
    PID:3312
- C:\Users\Admin\AppData\Local\Temp\Unicorn-34074.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-34074.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3104
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42091.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42091.exe
    3⤵
    PID:5820
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3104 -s 216
    3⤵
    PID:6756
- C:\Users\Admin\AppData\Local\Temp\Unicorn-8885.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-8885.exe
  2⤵
  PID:4340
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4803.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4803.exe
    3⤵
    PID:8188
- C:\Users\Admin\AppData\Local\Temp\Unicorn-25939.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-25939.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5144
- C:\Users\Admin\AppData\Local\Temp\Unicorn-9249.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-9249.exe
  2⤵
  PID:6472
- C:\Users\Admin\AppData\Local\Temp\Unicorn-1838.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-1838.exe
  2⤵
  PID:7500
- C:\Users\Admin\AppData\Local\Temp\Unicorn-2428.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-2428.exe
  2⤵
  PID:8640

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-32117.exe

Filesize
468KB

MD5
82b4c33aeca2711eb03b7c95308e358c

SHA1
eb4c4b69a0024bd1580cae17420afcb84d1da815

SHA256
ca94b445448fc87d50839fdd3a33740cb2df36638c4b65d489e00df42582f97f

SHA512
dd394024b916b564b797428a8903f9d4368b9a5d776976a279188b39a6f1a3a1e5d3d937b089047d44c4c099f17bbff3861b5bb358e9c0c1bca1114d1b884faf

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-36256.exe

Filesize
468KB

MD5
82c885369a8c012f308e136a7594cb62

SHA1
df361cec45553013be9b8783a559abb1e3f97cdb

SHA256
f5971c2f41c63003bdf96b54785af9f1e3d241a431d1bed06fe18a9f81bbcec8

SHA512
74371e3d0d1f3c78d6762012654384eed098d4c1eb34d2ef8c258f81beab51b82e05abbca611a8f44785fb315baab2ccc36b6283000b5f5bf0bd6191c4ed21bc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-44630.exe

Filesize
468KB

MD5
da306793417147b6b01a46206e161aa0

SHA1
4d5c1f8983e29e7cc52bf369ca7b10855086d610

SHA256
a3e7a79a26e5606f96a6f1f5b7c5c2625b50c858a2baf7f6d5c537987213a8e3

SHA512
7ee0d4930206a9e8ecb2f58dc7fa7c4e470ca577a6da0ef4cddfb2c0b9d48057d89e56767b81f9a8a3c4216acca87309622b4e7afbd58839db1fedb6f48eaec9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-47899.exe

Filesize
468KB

MD5
b5865da746fbb96bb427051e768c54a8

SHA1
821008fa0b9a47d041245017936e3c7c799ea26e

SHA256
4f39b7edf31d67a423eb688af185563ddf1cb31ec88c62494e70d12b6baba985

SHA512
4f495434e803668b79a087f2f47d33b9b8b8bdb4a05a0764a21560a4a20f815b3e52a0c479398b951ffda0308d6b179825197d050b97bd441d8b8599dc32a462

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-54225.exe

Filesize
468KB

MD5
878816a2fd104b7355413b86063e7ed4

SHA1
60b04296c3b71cf793a25ee8bcb4b3157937878e

SHA256
55132250ea46a8f95f39943977d767a6635beb855554ebe2d9270fafa1b66cca

SHA512
7676d9a95b1fc11d897b5ccebc4002ab046420978448abf95c6c320dbc59f8752e2371e872b3e14dc52cc90daf15d166fca2de0bb6ff0ae717d7ac5652e3c315

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-54938.exe

Filesize
468KB

MD5
5a72169d0b8d12b7454e968bd11ad959

SHA1
29a0d2ef1b7f74845813b1b7eaa571c4cc40f322

SHA256
af675fa45b5cb6f1b53d299dbf73e808f6ef2cba205ad98db2094aca3893cc94

SHA512
8b700be1f6bc7c02959093e04672be8b90537cb1664f8e1af98a1e7dd7ccf12ab9345de3b0c9282f0407dd1644aa47667ab53c080e6c7a534f24ba16103af4db

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-59013.exe

Filesize
468KB

MD5
f2d183af0f09355f69e2583c7fa171d9

SHA1
436cc3ddeb96739d1b41a42e84767903cd9449b2

SHA256
1b2987e39e2021a28e9620e8d71486df1fe75034741e5827a96b2b95ddfade4f

SHA512
33c356dccd6f9d04f3ea1a2998ab491e8e6f4fae3e0221e2ec3bc63bae6c969e84019dcb763265abf6aebb2baf911da550a73acfb8f60221ee6947bc30c3ecf2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-7157.exe

Filesize
468KB

MD5
d213b58b56e6b41ea8d02f0d27dc4493

SHA1
3e7c4cff01a176eca689a6dc2320f6d48234526c

SHA256
d76de5d8697b6135d3699fb2f8ffb0afb6348ac8580a12fa6271eccaa58e5996

SHA512
bed74068f2020aeaf19caade012abbb359dd3ca4415006e59b2bf7b24b0bb1128cf5a6b98ff8f31707cd52c1576589eccd4e63fcb4ab3ce802854097b9ca407e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-7681.exe

Filesize
468KB

MD5
19d4fda3a4065de8cac79e812465e26e

SHA1
2bd68535ce169fe12ad3fb7c7a7155d52f178a75

SHA256
d351cc47a81e023bc5be87b9bf469699be3123bc43e04521ab7980cc5fad7b42

SHA512
37e501fcc864c91abcbe621b34f22611a7b9b0c99108c3d74f2da9402d1e05cfc326053dab5a07fb347fe7e0157bf78b893b92af7174d0707cbeb96081d08865

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-7958.exe

Filesize
468KB

MD5
2074679de8dbcf4ad78955ab6a870963

SHA1
9339f2f1de134c4cdd8fd3ece1e68357210c2681

SHA256
499d4ff4ae5c75c00ad67b1b8b34a8feec83f75d630800fd62a5310c0f80130a

SHA512
7125a9ddbc4ba4d65e548c57224f2cff8df9a0b5b2ef0a4358be52cab4a40434fe4ccf5d9d29c812aca4d6e08659f1febe8f90b44290abce6d76bf056fdbe581

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-13514.exe

Filesize
468KB

MD5
6918d44ed75cc07accfe09fd9222c6fb

SHA1
9406a41852b1d75b38fb28be5308c770835753ef

SHA256
b7fd9d84c9d8c9464e430850d10a33143e2332cee88011005efe6445b8f4753c

SHA512
d99375f6edbe347356aa5bf69afd4f3b28b57aaff7e014993dddb61e024221f3a6bf4618859d0e36e7c4baea4e4be4279387dbc37e57b2da4fb75e6348ee0c22

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-1551.exe

Filesize
468KB

MD5
98481840da01ace99437690529dc2c66

SHA1
529d3a9757126dcf81975047875fec967f2868a6

SHA256
95908a2f8de0897a5a138eb070d09caebb2459b3a9019717a6a776e095851222

SHA512
80a8e069d24303bcf84d80dea75d0cf1cabd939f7ee16ab7851a8df25f6f68915ace88c4df012aea0217feab9a1a3c2897a134231bc85d4594350015923cb2d9

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-24764.exe

Filesize
468KB

MD5
f42a9bfddc3e554fe331f7a62ca6bc39

SHA1
637213d65eb8c021ab5f66d0e5528fe67ec1db25

SHA256
6451651aadcc8629a342ab6cc425acc7f095a5de04f39b63ee2effca70f3029a

SHA512
9d29580d7f5de27d46750000d0660da64d65459ca865ad30220bb183a5abe96cd49cc21796706c08be9c40b3608835715f79b28778d0c11b8cfd6691bf0397ee

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-33805.exe

Filesize
468KB

MD5
57f66d55519d5759611df363299a31c8

SHA1
5b7522db645a63145600ac53c4f421fd02b1ae0b

SHA256
340d0cb986286b0ac801546ac0643e6705c8b48738175515d040d0010e39cc25

SHA512
f602a8ac73d405115fea662087e378ea53ee1b5fe85fd1b38853bd24e187854fc78d01143872278a08ce43476a4dbaf5f7369529d70acc9489cf1ba555c19141

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-34359.exe

Filesize
468KB

MD5
78f52d117a4293b58ce26ffeaf574241

SHA1
10aecca88172ceefafb22c71ebb8a0df8939cc8b

SHA256
69b1db8a63219d02bab35865d2e5208db2ae9ff21bc7e246ec0d414623537721

SHA512
ac68cb058462f3cfb34f8210218193709c7713e3f37ac8e59009e83f737d021b3d2108e56565d5dfffc640a69308c34bd3592f9b2bdef341e39f0b452f4d1464

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-34412.exe

Filesize
468KB

MD5
6e62c5815427f4b31e78ea352f40d1eb

SHA1
d818657272bd4ea3715592cd0f7c20b13ba8592d

SHA256
74f76ae96fc9fe3e5f48ff2dc05d160f48168de7f1887c70d2079371b7b8f1bd

SHA512
a87027571d9f9468777e03a72b034da6ec7f157c01a9123edb06c00b6d6b02b5f96584222177b4abf1236f6e4359e1271889cfdb269575562fe83721fd41ecc1

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-48095.exe

Filesize
468KB

MD5
edb79daa70c6c46fbf18c74eea231faf

SHA1
097e6def7ed92b3a1f5872b628c93f35c34c7715

SHA256
1912fff31c94eb7443bc2fd6e9cd2e98015ce0a82d367b2042ecaa8ad9e8180b

SHA512
eee0066cf5503a9b40b518691978fa866ff69f9500dff462cffa226400a978590daba2233ef81cff84ce9ae86d4ccfbe64e522f903de0b29478d141d783536b0

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-53653.exe

Filesize
468KB

MD5
91048f31f7ab8bc2fa478837dcdaf039

SHA1
b68e925628ea69c6c51926d6ed1b54c1bd4c6f10

SHA256
34ed45a7da165e752a7409b32c34393e1fa3fe77f5c4a19ecf1c570e96a222ee

SHA512
c875906b15d9c177622de61e636a069700c640dc564fac47441d8dd7ac4ba716b4ace44a8f15921d09c4f9a4186a99a7a79c4c6da876a5bf97d4ccb86b4cc31a

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-54588.exe

Filesize
468KB

MD5
728262ba99a69776eb7430a48916a49b

SHA1
987d73c90ee0d1df1278b39247bdc39da2325f28

SHA256
a23386a04eed7289f20c2cd16ea838fd5a510f2db4444fe2af069856d7bdd655

SHA512
ef43407697e8612a6e9c745a6e926693a5d868991296e52a88795556de74d103c8da00b96428d841ad6c358e44487d420129b51016ba15549a33dd20d164c751

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-58631.exe

Filesize
468KB

MD5
f66019ecd7d35f4163196fcdf10a147d

SHA1
179f9dce64a9853f640b4958c208f031a929d9b1

SHA256
f4244a204eab37692a00fca1e0c8a3a05224bb2a95d98835056cd736eafe8539

SHA512
cf07f7800fd17035bf4ecb17d19b46121c6f7648da53f9a8fd45e617af19647af2441071dcf6ce628c6027a46f73c9c735f0565ca9251a118bbdbd191053c235

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-748.exe

Filesize
468KB

MD5
e0ab1cffe748aa8d347453e5356e5507

SHA1
2fcae7ea90d9e9dd52c8919d2a1aa68214e031c9

SHA256
0be92827f9b380700d87053549efdebbb1a39486d3000a1a0d3b6f95f5eda0bf

SHA512
c5aa85e4babb0316e5080aa39210a5c4f150d113c9f892a18cda9a9783ee90aa320ce56836b32a99ea89e72bb4aa7188299f007ee27ba9a5e2004a5750848b2e

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-7774.exe

Filesize
468KB

MD5
7a4c16932d0eb4537e87c9503e57b475

SHA1
523ea6f905a0ea85b3d7521a9388feb069d52cd2

SHA256
7e70138229fbe94cfbfbf419327aaa0ce8689e1a07ff40dea39539670cfc77ce

SHA512
98f4922dccc8715c1fe809b21fbc45ae45bc3ab922166c53737ab78661c14a9031af354090cfd6e5eb8fe7bbc30295112523c49d444d22493c7cb9f94df83bff

Download Submit
memory/1772-1888-0x00000000028B0000-0x0000000002A0C000-memory.dmp

Filesize
1.4MB

Download
memory/1772-2323-0x00000000028B0000-0x0000000002A0C000-memory.dmp

Filesize
1.4MB

Download
memory/1772-1670-0x00000000028B0000-0x0000000002A0C000-memory.dmp

Filesize
1.4MB

Download
memory/1772-2754-0x00000000028B0000-0x0000000002A0C000-memory.dmp

Filesize
1.4MB

Download
memory/1772-1126-0x00000000028B0000-0x0000000002A0C000-memory.dmp

Filesize
1.4MB

Download