9d4da235c07c190b81cea0ec2dc687e93815de1d45b56902206302dcafcb72ec

Analysis

max time kernel
120s
max time network
20s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
09/10/2024, 03:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9d4da235c07c190b81cea0ec2dc687e93815de1d45b56902206302dcafcb72ecN.exe
Size

468KB
MD5

6c639fffc6a61b6e1eca9e2724d6a200
SHA1

11e53efd7dcf1a9c5723f0c31abae72d179d9ace
SHA256

9d4da235c07c190b81cea0ec2dc687e93815de1d45b56902206302dcafcb72ec
SHA512

68eed0c1c860964a68454536c64e91376976eb0f8a58b55ed8a7b13cfed8e01b46e4c0fbc3bb210dd5e000cdffaffa17b9daa8abf23b7cf2689857c55722f1c4
SSDEEP

3072:UG3HogISIE5TtbY2HzcOcf8/vChaPkp2JVHeTVPuQXsy67ggEClP:UG3obMTtxH4OcfSoHIQX34ggE

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2308	Unicorn-16557.exe
2808	Unicorn-21521.exe
2996	Unicorn-19802.exe
2680	Unicorn-40488.exe
2864	Unicorn-52034.exe
2644	Unicorn-39227.exe
2388	Unicorn-17445.exe
376	Unicorn-57286.exe
2200	Unicorn-35050.exe
2964	Unicorn-18138.exe
2788	Unicorn-13626.exe
1880	Unicorn-4032.exe
1208	Unicorn-53306.exe
2216	Unicorn-64660.exe
2120	Unicorn-18989.exe
2952	Unicorn-8480.exe
2860	Unicorn-22788.exe
2556	Unicorn-5610.exe
348	Unicorn-35298.exe
1484	Unicorn-41428.exe
1076	Unicorn-18769.exe
2276	Unicorn-24900.exe
664	Unicorn-20986.exe
1340	Unicorn-31921.exe
828	Unicorn-24516.exe
1204	Unicorn-19533.exe
1080	Unicorn-40468.exe
740	Unicorn-6726.exe
576	Unicorn-22029.exe
284	Unicorn-41630.exe
1652	Unicorn-8039.exe
868	Unicorn-53519.exe
1856	Unicorn-9082.exe
1604	Unicorn-54370.exe
2820	Unicorn-64806.exe
2176	Unicorn-25235.exe
2876	Unicorn-37645.exe
2616	Unicorn-20614.exe
2640	Unicorn-37609.exe
2608	Unicorn-31366.exe
2188	Unicorn-35314.exe
1896	Unicorn-55180.exe
2212	Unicorn-22124.exe
320	Unicorn-2258.exe
2144	Unicorn-48282.exe
2944	Unicorn-55481.exe
2936	Unicorn-37884.exe
3056	Unicorn-1961.exe
888	Unicorn-31250.exe
1776	Unicorn-22975.exe
2452	Unicorn-22133.exe
3020	Unicorn-51350.exe
844	Unicorn-5678.exe
1704	Unicorn-34144.exe
1220	Unicorn-50673.exe
352	Unicorn-64408.exe
1036	Unicorn-47880.exe
1636	Unicorn-54010.exe
1584	Unicorn-5001.exe
864	Unicorn-37290.exe
2284	Unicorn-50097.exe
1492	Unicorn-53050.exe
3052	Unicorn-30199.exe
2672	Unicorn-2588.exe

Loads dropped DLL 64 IoCs

pid	Process
2892	9d4da235c07c190b81cea0ec2dc687e93815de1d45b56902206302dcafcb72ecN.exe
2892	9d4da235c07c190b81cea0ec2dc687e93815de1d45b56902206302dcafcb72ecN.exe
2308	Unicorn-16557.exe
2308	Unicorn-16557.exe
2892	9d4da235c07c190b81cea0ec2dc687e93815de1d45b56902206302dcafcb72ecN.exe
2892	9d4da235c07c190b81cea0ec2dc687e93815de1d45b56902206302dcafcb72ecN.exe
2808	Unicorn-21521.exe
2808	Unicorn-21521.exe
2308	Unicorn-16557.exe
2308	Unicorn-16557.exe
2996	Unicorn-19802.exe
2996	Unicorn-19802.exe
2892	9d4da235c07c190b81cea0ec2dc687e93815de1d45b56902206302dcafcb72ecN.exe
2892	9d4da235c07c190b81cea0ec2dc687e93815de1d45b56902206302dcafcb72ecN.exe
2680	Unicorn-40488.exe
2808	Unicorn-21521.exe
2808	Unicorn-21521.exe
2680	Unicorn-40488.exe
2864	Unicorn-52034.exe
2864	Unicorn-52034.exe
2308	Unicorn-16557.exe
2308	Unicorn-16557.exe
2892	9d4da235c07c190b81cea0ec2dc687e93815de1d45b56902206302dcafcb72ecN.exe
2388	Unicorn-17445.exe
2892	9d4da235c07c190b81cea0ec2dc687e93815de1d45b56902206302dcafcb72ecN.exe
2388	Unicorn-17445.exe
2996	Unicorn-19802.exe
2996	Unicorn-19802.exe
2644	Unicorn-39227.exe
2644	Unicorn-39227.exe
2200	Unicorn-35050.exe
2200	Unicorn-35050.exe
376	Unicorn-57286.exe
376	Unicorn-57286.exe
2680	Unicorn-40488.exe
2680	Unicorn-40488.exe
2808	Unicorn-21521.exe
2808	Unicorn-21521.exe
2216	Unicorn-64660.exe
2216	Unicorn-64660.exe
2996	Unicorn-19802.exe
1208	Unicorn-53306.exe
2996	Unicorn-19802.exe
1208	Unicorn-53306.exe
2388	Unicorn-17445.exe
2388	Unicorn-17445.exe
2892	9d4da235c07c190b81cea0ec2dc687e93815de1d45b56902206302dcafcb72ecN.exe
2120	Unicorn-18989.exe
2892	9d4da235c07c190b81cea0ec2dc687e93815de1d45b56902206302dcafcb72ecN.exe
2120	Unicorn-18989.exe
2352	WerFault.exe
2352	WerFault.exe
2352	WerFault.exe
2352	WerFault.exe
2644	Unicorn-39227.exe
2644	Unicorn-39227.exe
2964	Unicorn-18138.exe
2964	Unicorn-18138.exe
2788	Unicorn-13626.exe
2788	Unicorn-13626.exe
2308	Unicorn-16557.exe
2864	Unicorn-52034.exe
2308	Unicorn-16557.exe
2864	Unicorn-52034.exe

Program crash 64 IoCs

pid	pid_target	Process	procid_target
2352	1880	WerFault.exe	41
2584	348	WerFault.exe	48
1096	1080	WerFault.exe	57
1764	1076	WerFault.exe	50
3028	1208	WerFault.exe	42
2468	1484	WerFault.exe	49
1872	2936	WerFault.exe	79
2756	2540	WerFault.exe	108
2116	2188	WerFault.exe	72
2752	2308	WerFault.exe	30
624	1636	WerFault.exe	93
2164	1704	WerFault.exe	90
936	3020	WerFault.exe	86
1336	1492	WerFault.exe	98
2312	740	WerFault.exe	58
3832	1972	WerFault.exe	152
3788	320	WerFault.exe	75
3840	1856	WerFault.exe	63
3908	2716	WerFault.exe	143
3952	300	WerFault.exe	151
3932	2504	WerFault.exe	140
3140	1956	WerFault.exe	111
3884	2084	WerFault.exe	144
3440	888	WerFault.exe	81
3564	2080	WerFault.exe	107
3764	2112	WerFault.exe	157
3376	2380	WerFault.exe	122
5004	2832	WerFault.exe	124
5012	1860	WerFault.exe	149
5076	2612	WerFault.exe	170
4352	1660	WerFault.exe	134
4336	840	WerFault.exe	136
4304	576	WerFault.exe	60
4384	2640	WerFault.exe	70
4412	1652	WerFault.exe	61
4464	332	WerFault.exe	129
4452	1040	WerFault.exe	120
4508	1900	WerFault.exe	137
4484	2852	WerFault.exe	125
4560	3052	WerFault.exe	99
4544	680	WerFault.exe	133
4536	2228	WerFault.exe	159
4516	2212	WerFault.exe	74
4432	2652	WerFault.exe	127
4584	824	WerFault.exe	179
4760	2980	WerFault.exe	132
4704	2900	WerFault.exe	130
4972	1220	WerFault.exe	91
5056	1648	WerFault.exe	138
5064	3000	WerFault.exe	142
4948	1036	WerFault.exe	94
5068	844	WerFault.exe	88
4128	352	WerFault.exe	92
5148	1372	WerFault.exe	150
5160	568	WerFault.exe	168
5168	2148	WerFault.exe	101
5176	2644	WerFault.exe	35
5220	2776	WerFault.exe	147
5212	2944	WerFault.exe	77
5524	2952	WerFault.exe	45
5604	2288	WerFault.exe	105
5624	1724	WerFault.exe	154
5988	2820	WerFault.exe	65
5272	2712	WerFault.exe	165

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21417.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44084.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58922.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17707.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15949.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56154.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29747.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52901.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47880.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52962.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36144.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52369.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11134.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33606.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54285.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60116.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4032.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-478.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60542.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43955.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14858.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39930.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37610.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2588.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3601.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49392.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8690.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19533.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12564.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14938.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38460.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48065.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10938.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3808.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63264.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63581.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46760.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29190.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33211.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22220.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35298.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9082.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58468.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56984.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57818.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40488.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21372.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44860.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32151.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52073.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63964.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32686.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55481.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45075.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-323.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33671.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42200.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54345.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1715.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41955.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55129.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51485.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5570.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33120.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2892	9d4da235c07c190b81cea0ec2dc687e93815de1d45b56902206302dcafcb72ecN.exe
2308	Unicorn-16557.exe
2808	Unicorn-21521.exe
2996	Unicorn-19802.exe
2680	Unicorn-40488.exe
2864	Unicorn-52034.exe
2388	Unicorn-17445.exe
2644	Unicorn-39227.exe
2200	Unicorn-35050.exe
376	Unicorn-57286.exe
2964	Unicorn-18138.exe
2788	Unicorn-13626.exe
1208	Unicorn-53306.exe
2120	Unicorn-18989.exe
1880	Unicorn-4032.exe
2216	Unicorn-64660.exe
2952	Unicorn-8480.exe
2860	Unicorn-22788.exe
2556	Unicorn-5610.exe
348	Unicorn-35298.exe
1076	Unicorn-18769.exe
1484	Unicorn-41428.exe
2276	Unicorn-24900.exe
664	Unicorn-20986.exe
1340	Unicorn-31921.exe
828	Unicorn-24516.exe
1204	Unicorn-19533.exe
1080	Unicorn-40468.exe
740	Unicorn-6726.exe
576	Unicorn-22029.exe
284	Unicorn-41630.exe
1652	Unicorn-8039.exe
868	Unicorn-53519.exe
1856	Unicorn-9082.exe
1604	Unicorn-54370.exe
2820	Unicorn-64806.exe
2176	Unicorn-25235.exe
2876	Unicorn-37645.exe
2616	Unicorn-20614.exe
2640	Unicorn-37609.exe
2608	Unicorn-31366.exe
2188	Unicorn-35314.exe
1896	Unicorn-55180.exe
320	Unicorn-2258.exe
2944	Unicorn-55481.exe
2212	Unicorn-22124.exe
2144	Unicorn-48282.exe
2936	Unicorn-37884.exe
3056	Unicorn-1961.exe
1776	Unicorn-22975.exe
888	Unicorn-31250.exe
3020	Unicorn-51350.exe
2452	Unicorn-22133.exe
844	Unicorn-5678.exe
1220	Unicorn-50673.exe
1704	Unicorn-34144.exe
1036	Unicorn-47880.exe
1636	Unicorn-54010.exe
352	Unicorn-64408.exe
1584	Unicorn-5001.exe
864	Unicorn-37290.exe
2284	Unicorn-50097.exe
1492	Unicorn-53050.exe
3052	Unicorn-30199.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2892 wrote to memory of 2308	2892	9d4da235c07c190b81cea0ec2dc687e93815de1d45b56902206302dcafcb72ecN.exe	30
PID 2892 wrote to memory of 2308	2892	9d4da235c07c190b81cea0ec2dc687e93815de1d45b56902206302dcafcb72ecN.exe	30
PID 2892 wrote to memory of 2308	2892	9d4da235c07c190b81cea0ec2dc687e93815de1d45b56902206302dcafcb72ecN.exe	30
PID 2892 wrote to memory of 2308	2892	9d4da235c07c190b81cea0ec2dc687e93815de1d45b56902206302dcafcb72ecN.exe	30
PID 2308 wrote to memory of 2808	2308	Unicorn-16557.exe	31
PID 2308 wrote to memory of 2808	2308	Unicorn-16557.exe	31
PID 2308 wrote to memory of 2808	2308	Unicorn-16557.exe	31
PID 2308 wrote to memory of 2808	2308	Unicorn-16557.exe	31
PID 2892 wrote to memory of 2996	2892	9d4da235c07c190b81cea0ec2dc687e93815de1d45b56902206302dcafcb72ecN.exe	32
PID 2892 wrote to memory of 2996	2892	9d4da235c07c190b81cea0ec2dc687e93815de1d45b56902206302dcafcb72ecN.exe	32
PID 2892 wrote to memory of 2996	2892	9d4da235c07c190b81cea0ec2dc687e93815de1d45b56902206302dcafcb72ecN.exe	32
PID 2892 wrote to memory of 2996	2892	9d4da235c07c190b81cea0ec2dc687e93815de1d45b56902206302dcafcb72ecN.exe	32
PID 2808 wrote to memory of 2680	2808	Unicorn-21521.exe	33
PID 2808 wrote to memory of 2680	2808	Unicorn-21521.exe	33
PID 2808 wrote to memory of 2680	2808	Unicorn-21521.exe	33
PID 2808 wrote to memory of 2680	2808	Unicorn-21521.exe	33
PID 2308 wrote to memory of 2864	2308	Unicorn-16557.exe	34
PID 2308 wrote to memory of 2864	2308	Unicorn-16557.exe	34
PID 2308 wrote to memory of 2864	2308	Unicorn-16557.exe	34
PID 2308 wrote to memory of 2864	2308	Unicorn-16557.exe	34
PID 2996 wrote to memory of 2644	2996	Unicorn-19802.exe	35
PID 2996 wrote to memory of 2644	2996	Unicorn-19802.exe	35
PID 2996 wrote to memory of 2644	2996	Unicorn-19802.exe	35
PID 2996 wrote to memory of 2644	2996	Unicorn-19802.exe	35
PID 2892 wrote to memory of 2388	2892	9d4da235c07c190b81cea0ec2dc687e93815de1d45b56902206302dcafcb72ecN.exe	36
PID 2892 wrote to memory of 2388	2892	9d4da235c07c190b81cea0ec2dc687e93815de1d45b56902206302dcafcb72ecN.exe	36
PID 2892 wrote to memory of 2388	2892	9d4da235c07c190b81cea0ec2dc687e93815de1d45b56902206302dcafcb72ecN.exe	36
PID 2892 wrote to memory of 2388	2892	9d4da235c07c190b81cea0ec2dc687e93815de1d45b56902206302dcafcb72ecN.exe	36
PID 2808 wrote to memory of 376	2808	Unicorn-21521.exe	38
PID 2808 wrote to memory of 376	2808	Unicorn-21521.exe	38
PID 2808 wrote to memory of 376	2808	Unicorn-21521.exe	38
PID 2808 wrote to memory of 376	2808	Unicorn-21521.exe	38
PID 2680 wrote to memory of 2200	2680	Unicorn-40488.exe	37
PID 2680 wrote to memory of 2200	2680	Unicorn-40488.exe	37
PID 2680 wrote to memory of 2200	2680	Unicorn-40488.exe	37
PID 2680 wrote to memory of 2200	2680	Unicorn-40488.exe	37
PID 2864 wrote to memory of 2964	2864	Unicorn-52034.exe	39
PID 2864 wrote to memory of 2964	2864	Unicorn-52034.exe	39
PID 2864 wrote to memory of 2964	2864	Unicorn-52034.exe	39
PID 2864 wrote to memory of 2964	2864	Unicorn-52034.exe	39
PID 2308 wrote to memory of 2788	2308	Unicorn-16557.exe	40
PID 2308 wrote to memory of 2788	2308	Unicorn-16557.exe	40
PID 2308 wrote to memory of 2788	2308	Unicorn-16557.exe	40
PID 2308 wrote to memory of 2788	2308	Unicorn-16557.exe	40
PID 2892 wrote to memory of 1880	2892	9d4da235c07c190b81cea0ec2dc687e93815de1d45b56902206302dcafcb72ecN.exe	41
PID 2892 wrote to memory of 1880	2892	9d4da235c07c190b81cea0ec2dc687e93815de1d45b56902206302dcafcb72ecN.exe	41
PID 2892 wrote to memory of 1880	2892	9d4da235c07c190b81cea0ec2dc687e93815de1d45b56902206302dcafcb72ecN.exe	41
PID 2892 wrote to memory of 1880	2892	9d4da235c07c190b81cea0ec2dc687e93815de1d45b56902206302dcafcb72ecN.exe	41
PID 2388 wrote to memory of 1208	2388	Unicorn-17445.exe	42
PID 2388 wrote to memory of 1208	2388	Unicorn-17445.exe	42
PID 2388 wrote to memory of 1208	2388	Unicorn-17445.exe	42
PID 2388 wrote to memory of 1208	2388	Unicorn-17445.exe	42
PID 2996 wrote to memory of 2216	2996	Unicorn-19802.exe	43
PID 2996 wrote to memory of 2216	2996	Unicorn-19802.exe	43
PID 2996 wrote to memory of 2216	2996	Unicorn-19802.exe	43
PID 2996 wrote to memory of 2216	2996	Unicorn-19802.exe	43
PID 2644 wrote to memory of 2120	2644	Unicorn-39227.exe	44
PID 2644 wrote to memory of 2120	2644	Unicorn-39227.exe	44
PID 2644 wrote to memory of 2120	2644	Unicorn-39227.exe	44
PID 2644 wrote to memory of 2120	2644	Unicorn-39227.exe	44
PID 2200 wrote to memory of 2952	2200	Unicorn-35050.exe	45
PID 2200 wrote to memory of 2952	2200	Unicorn-35050.exe	45
PID 2200 wrote to memory of 2952	2200	Unicorn-35050.exe	45
PID 2200 wrote to memory of 2952	2200	Unicorn-35050.exe	45

C:\Users\Admin\AppData\Local\Temp\9d4da235c07c190b81cea0ec2dc687e93815de1d45b56902206302dcafcb72ecN.exe
"C:\Users\Admin\AppData\Local\Temp\9d4da235c07c190b81cea0ec2dc687e93815de1d45b56902206302dcafcb72ecN.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2892
- C:\Users\Admin\AppData\Local\Temp\Unicorn-16557.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-16557.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2308
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21521.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21521.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40488.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40488.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35050.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8480.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8039.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5001.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55256.exe
        9⤵
        
        PID:1412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65197.exe
        10⤵
        
        PID:3432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60795.exe
        10⤵
        
        PID:4708
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1412 -s 224
        10⤵
        
        PID:6100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52369.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:3692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65267.exe
        9⤵
        
        PID:4848
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1584 -s 248
        9⤵
        
        PID:6172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54223.exe
        8⤵
        
        PID:332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40911.exe
        9⤵
        
        PID:3112
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 332 -s 248
        9⤵
        Program crash
        
        PID:4464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38538.exe
        8⤵
        
        PID:3220
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1652 -s 248
        8⤵
        Program crash
        
        PID:4412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34144.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1704
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1704 -s 224
        8⤵
        Program crash
        
        PID:2164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16583.exe
        7⤵
        
        PID:568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15712.exe
        8⤵
        
        PID:3988
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 568 -s 248
        8⤵
        Program crash
        
        PID:5160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62011.exe
        7⤵
        
        PID:3724
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2952 -s 240
        7⤵
        Program crash
        
        PID:5524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53519.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54010.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1636
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1636 -s 244
        8⤵
        Program crash
        
        PID:624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2848.exe
        7⤵
        
        PID:2396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45494.exe
        8⤵
        
        PID:4552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53650.exe
        8⤵
        
        PID:5692
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2396 -s 240
        8⤵
        
        PID:6252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5684.exe
        7⤵
        
        PID:3204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52596.exe
        7⤵
        
        PID:5548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48019.exe
        7⤵
        
        PID:7100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23381.exe
        7⤵
        
        PID:8012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35230.exe
        7⤵
        
        PID:7660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33412.exe
        7⤵
        
        PID:8604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64408.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30799.exe
        7⤵
        
        PID:1868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37606.exe
        8⤵
        
        PID:4392
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1868 -s 228
        8⤵
        
        PID:5260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52286.exe
        7⤵
        
        PID:3216
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 352 -s 244
        7⤵
        Program crash
        
        PID:4128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3808.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27238.exe
        7⤵
        
        PID:4488
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2712 -s 248
        7⤵
        Program crash
        
        PID:5272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4337.exe
        6⤵
        
        PID:3500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63581.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60116.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36897.exe
        6⤵
        
        PID:7932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55317.exe
        6⤵
        
        PID:7828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2620.exe
        6⤵
        
        PID:8784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5610.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64806.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2588.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45075.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:2024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11887.exe
        9⤵
        
        PID:4148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15635.exe
        9⤵
        
        PID:6064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20980.exe
        9⤵
        
        PID:6860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45085.exe
        9⤵
        
        PID:7808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49013.exe
        9⤵
        
        PID:8512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22561.exe
        8⤵
        
        PID:3084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53057.exe
        8⤵
        
        PID:5944
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2672 -s 248
        8⤵
        
        PID:6284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-596.exe
        7⤵
        
        PID:2444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56809.exe
        8⤵
        
        PID:6380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62391.exe
        8⤵
        
        PID:7360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54345.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:8612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55129.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3208
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2820 -s 248
        7⤵
        Program crash
        
        PID:5988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52017.exe
        6⤵
        
        PID:2148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53850.exe
        7⤵
        
        PID:748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55571.exe
        8⤵
        
        PID:3360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27022.exe
        8⤵
        
        PID:4480
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 748 -s 244
        8⤵
        
        PID:6736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2343.exe
        7⤵
        
        PID:3460
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2148 -s 224
        7⤵
        Program crash
        
        PID:5168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64523.exe
        6⤵
        
        PID:2260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35577.exe
        7⤵
        
        PID:4244
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2260 -s 248
        7⤵
        
        PID:5472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28763.exe
        6⤵
        
        PID:4024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43931.exe
        6⤵
        
        PID:5536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63964.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40447.exe
        6⤵
        
        PID:8056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10684.exe
        6⤵
        
        PID:7632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63957.exe
        6⤵
        
        PID:9144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25235.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21229.exe
        6⤵
        
        PID:1708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58359.exe
        7⤵
        
        PID:532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41084.exe
        8⤵
        
        PID:300
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 300 -s 220
        9⤵
        Program crash
        
        PID:3952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5638.exe
        8⤵
        
        PID:3628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31878.exe
        8⤵
        
        PID:4620
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 532 -s 248
        8⤵
        
        PID:6692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21109.exe
        7⤵
        
        PID:640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46760.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19441.exe
        8⤵
        
        PID:5236
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 640 -s 220
        8⤵
        
        PID:6224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33540.exe
        7⤵
        
        PID:4080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39472.exe
        7⤵
        
        PID:5200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33140.exe
        7⤵
        
        PID:6648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33007.exe
        7⤵
        
        PID:7760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61021.exe
        7⤵
        
        PID:7380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3031.exe
        7⤵
        
        PID:8420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40605.exe
        6⤵
        
        PID:1040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41814.exe
        7⤵
        
        PID:3816
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3816 -s 224
        8⤵
        
        PID:8224
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1040 -s 248
        7⤵
        Program crash
        
        PID:4452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35108.exe
        6⤵
        
        PID:3868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9466.exe
        6⤵
        
        PID:4312
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2176 -s 244
        6⤵
        
        PID:5640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36724.exe
        5⤵
        
        PID:2888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56984.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44860.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3148
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 680 -s 228
        7⤵
        Program crash
        
        PID:4544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45140.exe
        6⤵
        
        PID:3464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8993.exe
        6⤵
        
        PID:4744
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2888 -s 248
        6⤵
        
        PID:6152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48905.exe
        5⤵
        
        PID:1900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11995.exe
        6⤵
        
        PID:3288
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1900 -s 228
        6⤵
        Program crash
        
        PID:4508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29747.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6723.exe
        5⤵
        
        PID:4740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5570.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57381.exe
        5⤵
        
        PID:6856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14284.exe
        5⤵
        
        PID:7956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64678.exe
        5⤵
        
        PID:8504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57286.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57286.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22788.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9082.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37290.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9620.exe
        8⤵
        
        PID:2900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28140.exe
        9⤵
        
        PID:3332
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2900 -s 228
        9⤵
        Program crash
        
        PID:4704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51985.exe
        8⤵
        
        PID:3736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31442.exe
        8⤵
        
        PID:4328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30083.exe
        8⤵
        
        PID:5284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18180.exe
        8⤵
        
        PID:6276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19884.exe
        8⤵
        
        PID:7836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33015.exe
        8⤵
        
        PID:8432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39422.exe
        7⤵
        
        PID:708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6012.exe
        8⤵
        
        PID:3560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51532.exe
        8⤵
        
        PID:4872
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 708 -s 244
        8⤵
        
        PID:5680
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1856 -s 244
        7⤵
        Program crash
        
        PID:3840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50097.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27467.exe
        7⤵
        
        PID:1648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6370.exe
        8⤵
        
        PID:3240
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1648 -s 216
        8⤵
        Program crash
        
        PID:5056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35705.exe
        7⤵
        
        PID:3276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40758.exe
        7⤵
        
        PID:4356
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2284 -s 248
        7⤵
        
        PID:6744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20952.exe
        6⤵
        
        PID:2504
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2504 -s 220
        7⤵
        Program crash
        
        PID:3932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6105.exe
        6⤵
        
        PID:3184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37957.exe
        6⤵
        
        PID:3976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16605.exe
        6⤵
        
        PID:6712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50073.exe
        6⤵
        
        PID:7752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39490.exe
        6⤵
        
        PID:7496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63233.exe
        6⤵
        
        PID:8364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54370.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53050.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1492
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1492 -s 244
        7⤵
        Program crash
        
        PID:1336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15588.exe
        6⤵
        
        PID:2636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23510.exe
        7⤵
        
        PID:5496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4027.exe
        7⤵
        
        PID:7120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42717.exe
        7⤵
        
        PID:8036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43365.exe
        7⤵
        
        PID:7400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54413.exe
        7⤵
        
        PID:8652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36297.exe
        6⤵
        
        PID:3324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58922.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5936
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1604 -s 244
        6⤵
        
        PID:6356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30199.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41084.exe
        6⤵
        
        PID:1972
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1972 -s 224
        7⤵
        Program crash
        
        PID:3832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21372.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3392.exe
        7⤵
        
        PID:9036
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3052 -s 224
        6⤵
        Program crash
        
        PID:4560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8613.exe
        5⤵
        
        PID:2112
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2112 -s 224
        6⤵
        Program crash
        
        PID:3764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63932.exe
        5⤵
        
        PID:3924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14271.exe
        5⤵
        
        PID:4960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33671.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28542.exe
        5⤵
        
        PID:7708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34155.exe
        5⤵
        
        PID:7180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1896.exe
        5⤵
        
        PID:8356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35298.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35298.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:348
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 348 -s 240
        5⤵
        Program crash
        
        PID:2584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37645.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37645.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53517.exe
        5⤵
        
        PID:2588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8359.exe
        6⤵
        
        PID:2980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44284.exe
        7⤵
        
        PID:3340
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2980 -s 248
        7⤵
        Program crash
        
        PID:4760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1715.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48656.exe
        6⤵
        
        PID:4636
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2588 -s 248
        6⤵
        
        PID:5644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55567.exe
        5⤵
        
        PID:840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40911.exe
        6⤵
        
        PID:3124
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 840 -s 228
        6⤵
        Program crash
        
        PID:4336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58875.exe
        5⤵
        
        PID:3484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14858.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26570.exe
        5⤵
        
        PID:5512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1645.exe
        5⤵
        
        PID:6836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36950.exe
        5⤵
        
        PID:7928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28012.exe
        5⤵
        
        PID:8456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30554.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30554.exe
      4⤵
      PID:2288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23757.exe
        5⤵
        
        PID:3068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7772.exe
        6⤵
        
        PID:4932
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3068 -s 228
        6⤵
        
        PID:5564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27418.exe
        5⤵
        
        PID:3608
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2288 -s 244
        5⤵
        Program crash
        
        PID:5604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45846.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45846.exe
      4⤵
      PID:2972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50621.exe
        5⤵
        
        PID:4768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40549.exe
        5⤵
        
        PID:5568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6699.exe
        5⤵
        
        PID:6312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36128.exe
        5⤵
        
        PID:7368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1457.exe
        5⤵
        
        PID:8272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10980.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10980.exe
      4⤵
      PID:3164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55794.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55794.exe
      4⤵
      PID:5648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54163.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54163.exe
      4⤵
      PID:7164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17781.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17781.exe
      4⤵
      PID:8044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47350.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47350.exe
      4⤵
      PID:7648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22220.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22220.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1656
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52034.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52034.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18138.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18138.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40468.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1080
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1080 -s 224
        6⤵
        Program crash
        
        PID:1096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51350.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3020
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3020 -s 224
        6⤵
        Program crash
        
        PID:936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38945.exe
        5⤵
        
        PID:824
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 824 -s 224
        6⤵
        Program crash
        
        PID:4584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42162.exe
        5⤵
        
        PID:3400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50257.exe
        5⤵
        
        PID:6048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22864.exe
        5⤵
        
        PID:6332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63794.exe
        5⤵
        
        PID:7840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9102.exe
        5⤵
        
        PID:8868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22029.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22029.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22124.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52962.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41814.exe
        7⤵
        
        PID:3824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57559.exe
        8⤵
        
        PID:8752
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2852 -s 248
        7⤵
        Program crash
        
        PID:4484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21948.exe
        6⤵
        
        PID:3780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60579.exe
        7⤵
        
        PID:9108
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2212 -s 244
        6⤵
        Program crash
        
        PID:4516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31752.exe
        5⤵
        
        PID:2576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42255.exe
        6⤵
        
        PID:4016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55403.exe
        6⤵
        
        PID:4284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24217.exe
        6⤵
        
        PID:6096
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2576 -s 236
        6⤵
        
        PID:7188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34780.exe
        5⤵
        
        PID:4092
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 576 -s 236
        5⤵
        Program crash
        
        PID:4304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48282.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48282.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58468.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58731.exe
        6⤵
        
        PID:3448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49598.exe
        7⤵
        
        PID:8260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13820.exe
        7⤵
        
        PID:8804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5504.exe
        6⤵
        
        PID:4856
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2136 -s 224
        6⤵
        
        PID:5532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41662.exe
        5⤵
        
        PID:3516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2592.exe
        6⤵
        
        PID:8368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2960.exe
        5⤵
        
        PID:4964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35236.exe
        5⤵
        
        PID:6136
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2144 -s 244
        5⤵
        
        PID:7200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41099.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41099.exe
      4⤵
      PID:892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37073.exe
        5⤵
        
        PID:1532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41594.exe
        6⤵
        
        PID:7144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14202.exe
        6⤵
        
        PID:7684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32902.exe
        6⤵
        
        PID:8860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11134.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4136
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 892 -s 244
        5⤵
        
        PID:5504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12657.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12657.exe
      4⤵
      PID:3152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29314.exe
        5⤵
        
        PID:7452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36579.exe
        5⤵
        
        PID:7448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29659.exe
        5⤵
        
        PID:8892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42399.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42399.exe
      4⤵
      PID:4296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30907.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30907.exe
      4⤵
      PID:5208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18399.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18399.exe
      4⤵
      PID:6384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36928.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36928.exe
      4⤵
      PID:7812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7967.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7967.exe
      4⤵
      PID:8776
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13626.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13626.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6726.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6726.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37609.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11519.exe
        6⤵
        
        PID:2540
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2540 -s 244
        7⤵
        Program crash
        
        PID:2756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39422.exe
        6⤵
        
        PID:1660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40911.exe
        7⤵
        
        PID:3108
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1660 -s 228
        7⤵
        Program crash
        
        PID:4352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54874.exe
        6⤵
        
        PID:3168
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2640 -s 248
        6⤵
        Program crash
        
        PID:4384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7990.exe
        5⤵
        
        PID:2956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3549.exe
        6⤵
        
        PID:2920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16924.exe
        7⤵
        
        PID:6824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43636.exe
        7⤵
        
        PID:7628
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2920 -s 224
        7⤵
        
        PID:8744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57647.exe
        6⤵
        
        PID:3436
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2956 -s 224
        6⤵
        
        PID:5480
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 740 -s 224
        5⤵
        Program crash
        
        PID:2312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35314.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35314.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58499.exe
        5⤵
        
        PID:1524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33414.exe
        6⤵
        
        PID:3000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57050.exe
        7⤵
        
        PID:3964
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3000 -s 236
        7⤵
        Program crash
        
        PID:5064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6406.exe
        6⤵
        
        PID:3444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29190.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5036
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1524 -s 228
        6⤵
        
        PID:6728
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2188 -s 236
        5⤵
        Program crash
        
        PID:2116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54673.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54673.exe
      4⤵
      PID:1984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44084.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58717.exe
        6⤵
        
        PID:8156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14247.exe
        6⤵
        
        PID:8324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26787.exe
        6⤵
        
        PID:9044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1103.exe
        5⤵
        
        PID:4340
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1984 -s 244
        5⤵
        
        PID:5460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26523.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26523.exe
      4⤵
      PID:3228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49392.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40609.exe
        5⤵
        
        PID:8624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12147.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12147.exe
      4⤵
      PID:4436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13841.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13841.exe
      4⤵
      PID:5144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39930.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39930.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42263.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42263.exe
      4⤵
      PID:7788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3767.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3767.exe
      4⤵
      PID:8788
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41630.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41630.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20614.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20614.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39485.exe
        5⤵
        
        PID:2668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4400.exe
        6⤵
        
        PID:1640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7084.exe
        7⤵
        
        PID:6980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10554.exe
        7⤵
        
        PID:7656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54397.exe
        7⤵
        
        PID:8736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41310.exe
        6⤵
        
        PID:3420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33176.exe
        6⤵
        
        PID:5288
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2668 -s 248
        6⤵
        
        PID:6864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51691.exe
        5⤵
        
        PID:3096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29223.exe
        6⤵
        
        PID:7296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27596.exe
        6⤵
        
        PID:8128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53733.exe
        6⤵
        
        PID:2848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57542.exe
        5⤵
        
        PID:4168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39042.exe
        5⤵
        
        PID:5428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39400.exe
        5⤵
        
        PID:6344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46728.exe
        5⤵
        
        PID:7816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30633.exe
        5⤵
        
        PID:8832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18166.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18166.exe
      4⤵
      PID:2080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20410.exe
        5⤵
        
        PID:3008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46428.exe
        6⤵
        
        PID:4656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4833.exe
        6⤵
        
        PID:5672
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3008 -s 220
        6⤵
        
        PID:6236
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2080 -s 248
        5⤵
        Program crash
        
        PID:3564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14938.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14938.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2612
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2612 -s 224
        5⤵
        Program crash
        
        PID:5076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47403.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47403.exe
      4⤵
      PID:3264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11258.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11258.exe
      4⤵
      PID:5660
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 284 -s 248
      4⤵
      PID:6208
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31366.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31366.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26403.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26403.exe
      4⤵
      PID:2304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19746.exe
        5⤵
        
        PID:3268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13943.exe
        6⤵
        
        PID:8104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37610.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10610.exe
        5⤵
        
        PID:4612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35097.exe
        5⤵
        
        PID:5592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48065.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63264.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13567.exe
        5⤵
        
        PID:8820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33211.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33211.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12537.exe
        5⤵
        
        PID:920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32151.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9072
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61211.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61211.exe
      4⤵
      PID:4688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60150.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60150.exe
      4⤵
      PID:5572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53100.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53100.exe
      4⤵
      PID:6504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10927.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10927.exe
      4⤵
      PID:6536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1987.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1987.exe
      4⤵
      PID:8320
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-553.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-553.exe
    3⤵
    PID:1956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41084.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41084.exe
      4⤵
      PID:2660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57818.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17707.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29370.exe
        5⤵
        
        PID:5828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26846.exe
        5⤵
        
        PID:7208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36419.exe
        5⤵
        
        PID:7848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15949.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8664
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1956 -s 216
      4⤵
      Program crash
      PID:3140
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2308 -s 240
    3⤵
    - Program crash
    PID:2752
- C:\Users\Admin\AppData\Local\Temp\Unicorn-19802.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-19802.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2996
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39227.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39227.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18989.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18989.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24516.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55180.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56154.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62022.exe
        8⤵
        
        PID:4520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55757.exe
        8⤵
        
        PID:6076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7083.exe
        8⤵
        
        PID:6248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47695.exe
        8⤵
        
        PID:8180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48546.exe
        8⤵
        
        PID:7744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58939.exe
        7⤵
        
        PID:3552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17379.exe
        7⤵
        
        PID:5412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2714.exe
        7⤵
        
        PID:6924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57898.exe
        7⤵
        
        PID:7944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65118.exe
        7⤵
        
        PID:7740
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1896 -s 244
        7⤵
        
        PID:8724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53092.exe
        6⤵
        
        PID:1212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46428.exe
        7⤵
        
        PID:4664
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1212 -s 216
        7⤵
        
        PID:5684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25201.exe
        6⤵
        
        PID:3428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19923.exe
        6⤵
        
        PID:5632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14962.exe
        6⤵
        
        PID:6184
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 828 -s 248
        6⤵
        
        PID:8020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2258.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1073.exe
        6⤵
        
        PID:2832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52073.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44523.exe
        8⤵
        
        PID:8532
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2832 -s 248
        7⤵
        Program crash
        
        PID:5004
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 320 -s 248
        6⤵
        Program crash
        
        PID:3788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45488.exe
        5⤵
        
        PID:2652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5166.exe
        6⤵
        
        PID:3936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58903.exe
        7⤵
        
        PID:8816
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2652 -s 248
        6⤵
        Program crash
        
        PID:4432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9317.exe
        5⤵
        
        PID:4044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-801.exe
        5⤵
        
        PID:4368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10035.exe
        5⤵
        
        PID:5128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18710.exe
        5⤵
        
        PID:556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15419.exe
        5⤵
        
        PID:7856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22677.exe
        5⤵
        
        PID:8440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19533.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19533.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5678.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41084.exe
        6⤵
        
        PID:1724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57154.exe
        7⤵
        
        PID:3812
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1724 -s 228
        7⤵
        Program crash
        
        PID:5624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18295.exe
        6⤵
        
        PID:3544
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 844 -s 224
        6⤵
        Program crash
        
        PID:5068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38021.exe
        5⤵
        
        PID:2228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44668.exe
        6⤵
        
        PID:3244
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2228 -s 228
        6⤵
        Program crash
        
        PID:4536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49083.exe
        5⤵
        
        PID:3588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38460.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21417.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5716
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1204 -s 248
        5⤵
        
        PID:6528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47880.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47880.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-549.exe
        5⤵
        
        PID:2716
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2716 -s 224
        6⤵
        Program crash
        
        PID:3908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38201.exe
        5⤵
        
        PID:3504
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1036 -s 220
        5⤵
        Program crash
        
        PID:4948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7295.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7295.exe
      4⤵
      PID:1264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47860.exe
        5⤵
        
        PID:3960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-323.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34098.exe
        5⤵
        
        PID:7132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48582.exe
        5⤵
        
        PID:7996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34699.exe
        5⤵
        
        PID:6804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37877.exe
        5⤵
        
        PID:8632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59599.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59599.exe
      4⤵
      PID:3296
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2644 -s 248
      4⤵
      Program crash
      PID:5176
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64660.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64660.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41428.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41428.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1484
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1484 -s 244
        5⤵
        Program crash
        
        PID:2468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50673.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50673.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10938.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8425.exe
        6⤵
        
        PID:3916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62331.exe
        6⤵
        
        PID:4124
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1512 -s 224
        6⤵
        
        PID:6084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2649.exe
        5⤵
        
        PID:3392
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1220 -s 240
        5⤵
        Program crash
        
        PID:4972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27283.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27283.exe
      4⤵
      PID:2684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61528.exe
        5⤵
        
        PID:3532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57112.exe
        6⤵
        
        PID:8404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54762.exe
        5⤵
        
        PID:4984
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2684 -s 244
        5⤵
        
        PID:6164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44351.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44351.exe
      4⤵
      PID:3596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38747.exe
        5⤵
        
        PID:8464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-160.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-160.exe
      4⤵
      PID:4976
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2216 -s 248
      4⤵
      PID:5768
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18769.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18769.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1076
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1076 -s 224
      4⤵
      Program crash
      PID:1764
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22133.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22133.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6844.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6844.exe
      4⤵
      PID:1308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41955.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5048
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1308 -s 228
        5⤵
        
        PID:6128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32187.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32187.exe
      4⤵
      PID:4052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14058.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14058.exe
      4⤵
      PID:5596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23628.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23628.exe
      4⤵
      PID:7148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39917.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39917.exe
      4⤵
      PID:8028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18164.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18164.exe
      4⤵
      PID:8176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25286.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25286.exe
      4⤵
      PID:3872
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36144.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36144.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9731.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9731.exe
      4⤵
      PID:4572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10482.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10482.exe
      4⤵
      PID:5696
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1576 -s 244
      4⤵
      PID:6964
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16961.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16961.exe
    3⤵
    PID:3088
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50787.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50787.exe
    3⤵
    PID:5952
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2996 -s 248
    3⤵
    PID:6392
- C:\Users\Admin\AppData\Local\Temp\Unicorn-17445.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-17445.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2388
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53306.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53306.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24900.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24900.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22975.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7560.exe
        6⤵
        
        PID:2776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24046.exe
        7⤵
        
        PID:3740
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2776 -s 248
        7⤵
        Program crash
        
        PID:5220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48664.exe
        6⤵
        
        PID:3256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33606.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41806.exe
        6⤵
        
        PID:6636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49543.exe
        6⤵
        
        PID:7724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43955.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24561.exe
        6⤵
        
        PID:8348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51971.exe
        5⤵
        
        PID:1860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49193.exe
        6⤵
        
        PID:3632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12618.exe
        7⤵
        
        PID:8496
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1860 -s 228
        6⤵
        Program crash
        
        PID:5012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61319.exe
        5⤵
        
        PID:3744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8690.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7865.exe
        5⤵
        
        PID:3080
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2276 -s 244
        5⤵
        
        PID:5844
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1208 -s 248
      4⤵
      Program crash
      PID:3028
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20986.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20986.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55481.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55481.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43891.exe
        5⤵
        
        PID:876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6709.exe
        6⤵
        
        PID:2084
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2084 -s 220
        7⤵
        Program crash
        
        PID:3884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21782.exe
        6⤵
        
        PID:3712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15542.exe
        6⤵
        
        PID:4844
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 876 -s 248
        6⤵
        
        PID:6668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53232.exe
        5⤵
        
        PID:1612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31472.exe
        6⤵
        
        PID:4064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19871.exe
        6⤵
        
        PID:5136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35941.exe
        6⤵
        
        PID:6700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58208.exe
        6⤵
        
        PID:7776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60491.exe
        6⤵
        
        PID:6820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7496.exe
        6⤵
        
        PID:8248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62399.exe
        5⤵
        
        PID:3300
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2944 -s 248
        5⤵
        Program crash
        
        PID:5212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47269.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47269.exe
      4⤵
      PID:1680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26770.exe
        5⤵
        
        PID:3412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60542.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43477.exe
        6⤵
        
        PID:8728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21347.exe
        5⤵
        
        PID:4796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54285.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12564.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27462.exe
        5⤵
        
        PID:6808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50459.exe
        5⤵
        
        PID:8304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20997.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20997.exe
      4⤵
      PID:3476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32686.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8296
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3476 -s 216
        5⤵
        
        PID:8712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41249.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41249.exe
      4⤵
      PID:4904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51485.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51485.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52901.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52901.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27993.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27993.exe
      4⤵
      PID:6812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45993.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45993.exe
      4⤵
      PID:8344
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1961.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1961.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60471.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60471.exe
      4⤵
      PID:272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2296.exe
        5⤵
        
        PID:3716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9375.exe
        6⤵
        
        PID:8972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54186.exe
        5⤵
        
        PID:5084
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 272 -s 244
        5⤵
        
        PID:6124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21948.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21948.exe
      4⤵
      PID:3796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57284.exe
        5⤵
        
        PID:8216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3601.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3601.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4420
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3056 -s 236
      4⤵
      PID:6116
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26766.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26766.exe
    3⤵
    PID:2812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53077.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53077.exe
      4⤵
      PID:3316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46938.exe
        5⤵
        
        PID:7900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13480.exe
        5⤵
        
        PID:8204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47476.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47476.exe
      4⤵
      PID:4696
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2812 -s 244
      4⤵
      PID:5584
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31352.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31352.exe
    3⤵
    PID:3380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59172.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59172.exe
      4⤵
      PID:7220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10421.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10421.exe
      4⤵
      PID:8848
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25155.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25155.exe
    3⤵
    PID:4716
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52015.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52015.exe
    3⤵
    PID:5196
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48435.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48435.exe
    3⤵
    PID:6552
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1127.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1127.exe
    3⤵
    PID:7176
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44858.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44858.exe
    3⤵
    PID:8256
- C:\Users\Admin\AppData\Local\Temp\Unicorn-4032.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-4032.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1880
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1880 -s 224
    3⤵
    - Loads dropped DLL
    - Program crash
    PID:2352
- C:\Users\Admin\AppData\Local\Temp\Unicorn-31921.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-31921.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1340
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37884.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37884.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2936
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2936 -s 244
      4⤵
      Program crash
      PID:1872
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56750.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56750.exe
    3⤵
    PID:2380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5661.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5661.exe
      4⤵
      PID:2340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47260.exe
        5⤵
        
        PID:5984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7245.exe
        5⤵
        
        PID:6540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39220.exe
        5⤵
        
        PID:7952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57678.exe
        5⤵
        
        PID:8472
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2380 -s 236
      4⤵
      Program crash
      PID:3376
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63807.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63807.exe
    3⤵
    PID:2628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33120.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33120.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24145.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24145.exe
      4⤵
      PID:8072
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3904.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3904.exe
      4⤵
      PID:9012
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60911.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60911.exe
    3⤵
    PID:3584
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30376.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30376.exe
    3⤵
    PID:4944
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1340 -s 248
    3⤵
    PID:6376
- C:\Users\Admin\AppData\Local\Temp\Unicorn-31250.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-31250.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:888
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38396.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38396.exe
    3⤵
    PID:1372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41456.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41456.exe
      4⤵
      PID:3888
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1372 -s 228
      4⤵
      Program crash
      PID:5148
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 888 -s 236
    3⤵
    - Program crash
    PID:3440
- C:\Users\Admin\AppData\Local\Temp\Unicorn-478.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-478.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1992
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42427.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42427.exe
    3⤵
    PID:4060
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39321.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39321.exe
    3⤵
    PID:5976
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42200.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42200.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6432
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6392.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6392.exe
    3⤵
    PID:7768
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30102.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30102.exe
    3⤵
    PID:8808
- C:\Users\Admin\AppData\Local\Temp\Unicorn-42931.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-42931.exe
  2⤵
  PID:3928
- C:\Users\Admin\AppData\Local\Temp\Unicorn-4471.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-4471.exe
  2⤵
  PID:5188
- C:\Users\Admin\AppData\Local\Temp\Unicorn-11005.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-11005.exe
  2⤵
  PID:6656
- C:\Users\Admin\AppData\Local\Temp\Unicorn-65208.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-65208.exe
  2⤵
  PID:7716
- C:\Users\Admin\AppData\Local\Temp\Unicorn-57956.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-57956.exe
  2⤵
  PID:7408
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2892 -s 244
  2⤵
  PID:8280

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-15419.exe

Filesize
468KB

MD5
815350e7c5d8422c92f85982f7bcdf4e

SHA1
6c667bf52a8a35a20feb4369aeeda322866b6ce8

SHA256
6edf6b88eaa959077c2edcf731c4ebe980fc23524866d2b82dccd8a1a5521009

SHA512
d99efa4fb83914d138d3693ebea7538413ee4c6a03ea264c214439437e3009a4ac92da094a591d0967c184cbfc5fd1c265d0dde36568936b7eddd23ed0a8fbae

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-21521.exe

Filesize
468KB

MD5
338877607ef13082693fe614d64dfca4

SHA1
4264b0890b242db62d1457f8d7ceec5ccad08a92

SHA256
7d8090ae9aa2423daf99f36358b604f3b34529f36ff9f63295f33cc754a96f65

SHA512
f3b5c81df1e6fe80cefd9dc001e59e7a95889804c857977b0bb97daa871bbf34270f59729ddf0466434556e6d5a3db07632d525bd94ddc99e0fb7c74b5d7fc39

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-30102.exe

Filesize
468KB

MD5
09fef09e6c2d6b86d2dcfb5942406f4d

SHA1
b1ed852e8183732e95b97e0c3f44477c4db2dcfc

SHA256
b26386e29bcbddc05c44cca1beac891b901cb855cadc2a000acb3a51f3218cd0

SHA512
e752fedb6d5e240a6c90e721a7f28f58fbb3d94f723598494d46097f6bb2a80b35f50e3dec673d1b34c1fdcdb968426748a35734bff06ab822394379ba2d2dbc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-3549.exe

Filesize
468KB

MD5
7dfec7655acabadd80b5edce8e6a98f6

SHA1
0c6253e3212e14b9d83118afe974806e5220a8f0

SHA256
e2a5674faaa8745165b080d4d2f2aa86787e04f31e8b0b5daebca6a5c1c18520

SHA512
ba91a7eaef9834ec672e6964e3569582b7c49ccd5a7093b22c66475effe95f72acc12f155118a25b5f5b80645350615562118433572d8fa92f1d18594a19aeb6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39227.exe

Filesize
468KB

MD5
68545a8558e01286476fe01926ee880b

SHA1
908bdddb41ae316cbc15bf177dec068ea4c496a5

SHA256
8a0cc060bbc010a3bd8015e17c5f27834452c7386ca70bc1cca9cd5e140c26ff

SHA512
75d7d4b6af7dfa918ba0638b22053ab15a57c75ee7ea954c0e0740a450d9bf8f322aa6dee949aeb7017330bed99ac9fc48cf5ac760626a730ae8a580616953d7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-52034.exe

Filesize
468KB

MD5
937888e5361fa63e4970b19676a5ff27

SHA1
3d0642e54547dfe0edae0511c17df5a991e6e135

SHA256
1590754ef3ec45e36359fb244f693b8019bc32c5c9ebc614076ae25eaea37fb7

SHA512
4e2d78ab4c9050e67f2700c87454d90cbc2b89da4f521ea7bef2c3686aee2aad28c86562c22b97f32de45828fd699bb10ae4bc4a8376ae71f500e52019b96bb3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-8480.exe

Filesize
468KB

MD5
d11ef8626bdafebb77104ad657fa7c45

SHA1
8027dcbaf0ac61afcfce5e5e1b44c27d7487f47e

SHA256
4be85a0ca5ee565a9eba7301780e56dcca0b026dd56c1e92dee662a70f358627

SHA512
89a90d3dc5f59c7cbf645db5497f1b4bfb9d7aec9809a493a3b652bc3a8da1ddf8d292ac5bc67579e6220343bd4b6e412fb5019cad1e15b26e5d9d343917ce07

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-13626.exe

Filesize
468KB

MD5
d22ae8ffdf22574031e909b93f08736c

SHA1
8d5cc4c4db6cf6a302621fa52459d6a7c327dec0

SHA256
cdca85f765eada4fdb79cc2d64b7e64e887f9aec5a4ac2a65336d2a06f5a1fca

SHA512
79721996d392d03d4c8ccb35c9ebb13b856e2a553a81f094329d6d4bc29d682af95595aaed8dbbcb450acef959b90a0db3cff8053be97b0c3caebd80238f3ae8

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-16557.exe

Filesize
468KB

MD5
54291467e69e866f92d58f0eda567019

SHA1
2fe4076956b0c918581319af5cd7b43c52adf410

SHA256
bd6a1148ecdc76345b8f507c368069413f99134beaa2fb4083705ad49a3965b4

SHA512
1a77fe2369a5b2fce9577e27c908641f634c807f3d47f45bce96053566a789ce7857b7765a47c459796f1cca28fe883f54cc3ef624122175da9a2ba443249d09

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-17445.exe

Filesize
468KB

MD5
a2bb6dae7a1feede47150d47ffe68a36

SHA1
e604cdba6c731b99e16eee80dfa2a8243c71fea0

SHA256
53867cebd986d21748de83fa6cd3481caf8eff127bd9607b85e4d8f273e3b375

SHA512
646377cd1be8a2ee3ce0c826b84a5d212203d46cf8e986313e6472bbb856c18556a8a4814a9608b79bfd788dcca8955d4949e10c8fdadc6a7fe838718290ee46

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-18138.exe

Filesize
468KB

MD5
180ba8f47aca4f20aab0c54de50b318d

SHA1
c471824c665d942b82729529f8fc867c94237d07

SHA256
946bc4875cf3dfa2d388c185e26537aeb2578a3f55a6f2bd344f581af17585d6

SHA512
cb2ee3c06ca5d5d1a91a82f7e7d842a738321ace42e0a28fbfe7fb89057afd2b534fb8075a7bc5367fc4df6e102da9b44c366ed466b3fb3fe5a0b11042d4bc69

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-18989.exe

Filesize
468KB

MD5
caea432ef2a3643b5abda9a8c9008e2b

SHA1
2a0cb5928d4c9f70c0fa3dcbc1fbedd93fc4d8a3

SHA256
0177357be65c9fa20384556dd281b68a8ff814eae66988d44539bc3e83059735

SHA512
376ce0dd9e8a1d2f0285116b006b7be3a9f9013c682720d462580659ff02fcdf03113c56a7bca4f5d9fd055e20f23f8eb3e67fbb2e474d568cb71c989efacafe

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-19802.exe

Filesize
468KB

MD5
bf11ac19cd5a11403c6c40d08ba495a9

SHA1
57998fb9757beeb29fa16d7fe67e12ea40c9641e

SHA256
b2d570d89dbce651b68522fb6f77b18e3776a612a5479d42244de38603a92040

SHA512
b880ff8c2f9c21cee0c525059dea263a75f69bf5d68fa6f57021790ca8321a3a705f4f8e2d9fbccd69ef06f61f3878927ad1f13391f7bfbd04873af910bbd7ac

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-22788.exe

Filesize
468KB

MD5
844fed2fcd51233f94a8757c57a732de

SHA1
3b9b0c7743bdab7c39f861331de9a7a5dca275b1

SHA256
e8a9cf8eca2912614a00fc09dca6e769def7bd5a26fbe0acb4368af01bc19960

SHA512
831ee81a9723e48b18c1f1b73d88533eac3bbaca7a94a6f702fb5079b9935dc1f6595432fda2726284bcd1d25cf8308b9fbc91d8d4f4f9985ddddfa5576954a0

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-35050.exe

Filesize
468KB

MD5
54c25b3894cb29d8ba5a60713e84513b

SHA1
5e962abe1febe4c2c0f6d0f05b45cc3506aad8e1

SHA256
ee55922101ac4a51752e787c4911b91718b83cd4e479922f1e444f8c64095491

SHA512
a78a0845a4933ed70b5e12ef94b8674808890d0469ff99434c8bddba241d61aa55e021fd40b11edd52feb619137db1fd04b072b7eab94f6c041c4897b36db8f9

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-4032.exe

Filesize
468KB

MD5
cd6656de675768915b9f321b384f3c4c

SHA1
dcc35a3316d8752d2df4fa14a885a8f3912796e6

SHA256
0e08d4969812526a669909aa2053ff128cb34addccb72d36c1e870ae240afac7

SHA512
36f9051dbd24c4c11cb2cdb1e902acaa585ec9e9f852043384bb39bf0a8855ad1be4f9fa533981d46582500f07e47c2bacbbd48efc66bd72b2a9cdc19ae028df

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-40488.exe

Filesize
468KB

MD5
e59ed0bf44a74be5e318ace157e48094

SHA1
8884a605d67692932c5d1248be88b1531e0f8553

SHA256
a674a9c0e5f31074deac188dfefc264a9b292a96f48d45e2aaece08dff757f24

SHA512
f825de0d477146d27751a4375c5f4662f6daf197923ee1f415722ce0af5ed66544b23f0bbe139c5ef8aa45472b3761b05101b79fd716bc53e30394f3859129f7

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-53306.exe

Filesize
468KB

MD5
3f5f2d58e9e73f561dabade80e24be35

SHA1
9ecbfb96aff16c24acf395e281294679ba722e48

SHA256
0ee08fde46a290de151b27bd92c5d3262e63ba59be5eceb44e87ebab3ef6e3f2

SHA512
ff08997cf054bd42dc38f43988676cff05ee51da6cc8734d303f3fdae79cadcc07ce6c691a4656d4112682f827c5b8973722f2153412fa3840634bc8a515eaf3

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-5610.exe

Filesize
468KB

MD5
8cc6f193d2323825abe179b04fb4172f

SHA1
4b3f0e6664f4cf8e2c845c261fd84cdaff276ef6

SHA256
66c460f277647fcb3bd31ebf9e4bcb3cc5920f1c7522172034888a4b8e015eeb

SHA512
e76391f8eedd5598bdd0c155a4244c10255b569e310976170b22aeb66b87769a82f5e29fa3c27119f99f722200a473b8e7883c515248dfa811f5a96df9e043cc

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-57286.exe

Filesize
468KB

MD5
32e1b24834b0f15edc546b8b6ff4bfa9

SHA1
a0f131f3711d4d115390df8652be2cb25f3f4aac

SHA256
a405edc6efd80e649357c2fc23a3a14949e3ed0959fa073de33542efc199b8b1

SHA512
129f058214d240f4f6856b628daea889dad594e8a8ea8488a58d9976eb5cece4adbceb352683f403a1b9f790312bb9cf9bfb3b7bbace072edb232d1b89587bd4

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-64660.exe

Filesize
468KB

MD5
0b205f64e2e3ea64535886fb944a718b

SHA1
8738f22216862a9ef96260a885a146cc8bfa4bb8

SHA256
e15e39bf4f206f91c39bcd75f6d1e43cc928c94a3615c284aa88db0da8c8916c

SHA512
119f81809ecebef7b66d057f29ff35b44f3a781698825038484c4ac4f3ffb84f7d36ac938b5dcb0cd5bec15dd28f7299e4562ba275b4992b674bc898fc320d66

Download Submit