647a4c570eebf709400fae9f270e7bd77f060e6d4ebf579428ed592dffa5c695

Analysis

max time kernel
120s
max time network
118s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
13/09/2024, 17:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8a5dce624613608466191fbc16687190N.exe
Size

468KB
MD5

8a5dce624613608466191fbc16687190
SHA1

18d0d889a524bdf5a27d37ec5ceac8376e87108d
SHA256

647a4c570eebf709400fae9f270e7bd77f060e6d4ebf579428ed592dffa5c695
SHA512

fd9b54e2129448e9df4132e6bf1df385e4a092a4c9176cb78b1be650c6ddebce4086ac3fef3fd6b7c32f9e7aef7e222313560c29336a2f2c3e20ef3b71b88dde
SSDEEP

3072:1GcHogISIE5TtbYQHncOcf8/vChaP0p2JVHeTVPx97NLc7kgEEiL:1GkobMTtnHcOcfSYHT97pqkgE

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2796	Unicorn-52537.exe
2716	Unicorn-643.exe
2784	Unicorn-50399.exe
2568	Unicorn-21723.exe
2608	Unicorn-60709.exe
2032	Unicorn-51058.exe
2136	Unicorn-1302.exe
1188	Unicorn-34333.exe
2856	Unicorn-59584.exe
2732	Unicorn-30441.exe
112	Unicorn-22273.exe
2132	Unicorn-17923.exe
264	Unicorn-16142.exe
2740	Unicorn-14104.exe
1528	Unicorn-3367.exe
2004	Unicorn-43892.exe
1976	Unicorn-11774.exe
1100	Unicorn-23472.exe
2940	Unicorn-9173.exe
400	Unicorn-48936.exe
760	Unicorn-25178.exe
2780	Unicorn-32792.exe
840	Unicorn-12371.exe
1532	Unicorn-41706.exe
1816	Unicorn-37622.exe
1800	Unicorn-57488.exe
1620	Unicorn-48558.exe
2288	Unicorn-22001.exe
2100	Unicorn-40384.exe
548	Unicorn-23783.exe
1176	Unicorn-4286.exe
1580	Unicorn-1717.exe
2564	Unicorn-62615.exe
2876	Unicorn-26413.exe
2592	Unicorn-31980.exe
2552	Unicorn-29943.exe
2628	Unicorn-34027.exe
2172	Unicorn-5173.exe
2156	Unicorn-38857.exe
2308	Unicorn-33451.exe
864	Unicorn-62786.exe
2896	Unicorn-25558.exe
2536	Unicorn-1608.exe
2848	Unicorn-42086.exe
3056	Unicorn-33653.exe
2028	Unicorn-8452.exe
1900	Unicorn-16814.exe
2340	Unicorn-12729.exe
2452	Unicorn-57846.exe
2956	Unicorn-37980.exe
2456	Unicorn-61930.exe
1696	Unicorn-49678.exe
2868	Unicorn-17560.exe
2920	Unicorn-51908.exe
1060	Unicorn-35572.exe
924	Unicorn-13119.exe
860	Unicorn-11835.exe
1612	Unicorn-17966.exe
2256	Unicorn-54722.exe
1956	Unicorn-10352.exe
2092	Unicorn-62841.exe
700	Unicorn-49612.exe
772	Unicorn-27154.exe
2748	Unicorn-42914.exe

Loads dropped DLL 64 IoCs

pid	Process
2712	8a5dce624613608466191fbc16687190N.exe
2712	8a5dce624613608466191fbc16687190N.exe
2796	Unicorn-52537.exe
2796	Unicorn-52537.exe
2712	8a5dce624613608466191fbc16687190N.exe
2712	8a5dce624613608466191fbc16687190N.exe
2716	Unicorn-643.exe
2716	Unicorn-643.exe
2712	8a5dce624613608466191fbc16687190N.exe
2712	8a5dce624613608466191fbc16687190N.exe
2796	Unicorn-52537.exe
2784	Unicorn-50399.exe
2796	Unicorn-52537.exe
2784	Unicorn-50399.exe
2568	Unicorn-21723.exe
2568	Unicorn-21723.exe
2716	Unicorn-643.exe
2716	Unicorn-643.exe
2032	Unicorn-51058.exe
2032	Unicorn-51058.exe
2796	Unicorn-52537.exe
2608	Unicorn-60709.exe
2136	Unicorn-1302.exe
2608	Unicorn-60709.exe
2712	8a5dce624613608466191fbc16687190N.exe
2136	Unicorn-1302.exe
2796	Unicorn-52537.exe
2712	8a5dce624613608466191fbc16687190N.exe
2784	Unicorn-50399.exe
2784	Unicorn-50399.exe
1188	Unicorn-34333.exe
1188	Unicorn-34333.exe
2568	Unicorn-21723.exe
2568	Unicorn-21723.exe
2856	Unicorn-59584.exe
2856	Unicorn-59584.exe
2716	Unicorn-643.exe
2716	Unicorn-643.exe
2732	Unicorn-30441.exe
2732	Unicorn-30441.exe
2032	Unicorn-51058.exe
2032	Unicorn-51058.exe
2740	Unicorn-14104.exe
2740	Unicorn-14104.exe
112	Unicorn-22273.exe
112	Unicorn-22273.exe
2500	WerFault.exe
2500	WerFault.exe
2500	WerFault.exe
2500	WerFault.exe
2136	Unicorn-1302.exe
2136	Unicorn-1302.exe
1528	Unicorn-3367.exe
2608	Unicorn-60709.exe
1528	Unicorn-3367.exe
2608	Unicorn-60709.exe
2712	8a5dce624613608466191fbc16687190N.exe
2712	8a5dce624613608466191fbc16687190N.exe
264	Unicorn-16142.exe
2784	Unicorn-50399.exe
264	Unicorn-16142.exe
2784	Unicorn-50399.exe
2500	WerFault.exe
2796	Unicorn-52537.exe

Program crash 64 IoCs

pid	pid_target	Process	procid_target
2500	2132	WerFault.exe	43
2708	1100	WerFault.exe	47
2736	1620	WerFault.exe	57
1112	2592	WerFault.exe	66
2616	864	WerFault.exe	72
536	2172	WerFault.exe	69
2056	3028	WerFault.exe	101
916	2920	WerFault.exe	86
2312	1956	WerFault.exe	92
3176	3016	WerFault.exe	112
3480	2160	WerFault.exe	149
3516	2720	WerFault.exe	126
3644	2996	WerFault.exe	133
3952	2188	WerFault.exe	141
3956	2076	WerFault.exe	122
3612	2928	WerFault.exe	151
3624	2200	WerFault.exe	152
3756	2768	WerFault.exe	124
3424	860	WerFault.exe	87
4032	700	WerFault.exe	94
3096	2444	WerFault.exe	109
3228	2804	WerFault.exe	99
4156	2440	WerFault.exe	104
4176	3044	WerFault.exe	114
4168	840	WerFault.exe	52
4136	568	WerFault.exe	117
4292	2628	WerFault.exe	68
4300	2848	WerFault.exe	76
4368	1116	WerFault.exe	128
4480	1800	WerFault.exe	55
4496	296	WerFault.exe	121
4508	3032	WerFault.exe	148
4568	2424	WerFault.exe	175
4556	2800	WerFault.exe	172
4548	604	WerFault.exe	167
4604	2536	WerFault.exe	74
4644	2952	WerFault.exe	132
4652	1720	WerFault.exe	144
4880	2028	WerFault.exe	78
4900	2292	WerFault.exe	119
4936	2256	WerFault.exe	91
5024	3008	WerFault.exe	171
5016	3132	WerFault.exe	198
4164	1176	WerFault.exe	61
4124	1900	WerFault.exe	79
5116	2340	WerFault.exe	80
5508	1816	WerFault.exe	56
5484	560	WerFault.exe	138
5528	236	WerFault.exe	130
5548	1916	WerFault.exe	153
5580	2868	WerFault.exe	85
5736	2144	WerFault.exe	145
5756	2560	WerFault.exe	182
5844	2876	WerFault.exe	65
5860	2308	WerFault.exe	71
5868	2564	WerFault.exe	64
5948	1060	WerFault.exe	88
5932	1340	WerFault.exe	136
5920	2456	WerFault.exe	83
5956	2724	WerFault.exe	127
5972	772	WerFault.exe	95
6024	2136	WerFault.exe	36
6000	400	WerFault.exe	49
5992	2732	WerFault.exe	39

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61005.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14587.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23039.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35572.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63749.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56624.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29094.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47637.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48365.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4203.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40012.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7740.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56396.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45291.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63552.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13724.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36101.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9888.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49375.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65239.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57846.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55637.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2125.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30065.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38363.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44102.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58715.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26993.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11798.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62307.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62786.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27904.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5560.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23675.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43756.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26426.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45939.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59338.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12729.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10352.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25535.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16472.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23548.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28891.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34004.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55248.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9891.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59584.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34087.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64534.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10068.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37215.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19447.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15353.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23309.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50399.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1717.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-843.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47657.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48337.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65041.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10485.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15512.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60641.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2712	8a5dce624613608466191fbc16687190N.exe
2796	Unicorn-52537.exe
2716	Unicorn-643.exe
2784	Unicorn-50399.exe
2568	Unicorn-21723.exe
2032	Unicorn-51058.exe
2608	Unicorn-60709.exe
2136	Unicorn-1302.exe
1188	Unicorn-34333.exe
2856	Unicorn-59584.exe
2732	Unicorn-30441.exe
112	Unicorn-22273.exe
2132	Unicorn-17923.exe
2740	Unicorn-14104.exe
264	Unicorn-16142.exe
1528	Unicorn-3367.exe
2004	Unicorn-43892.exe
1976	Unicorn-11774.exe
1100	Unicorn-23472.exe
2940	Unicorn-9173.exe
400	Unicorn-48936.exe
2780	Unicorn-32792.exe
760	Unicorn-25178.exe
840	Unicorn-12371.exe
1532	Unicorn-41706.exe
1800	Unicorn-57488.exe
1816	Unicorn-37622.exe
1620	Unicorn-48558.exe
2288	Unicorn-22001.exe
2100	Unicorn-40384.exe
548	Unicorn-23783.exe
1176	Unicorn-4286.exe
1580	Unicorn-1717.exe
2564	Unicorn-62615.exe
2876	Unicorn-26413.exe
2592	Unicorn-31980.exe
2552	Unicorn-29943.exe
2172	Unicorn-5173.exe
2628	Unicorn-34027.exe
2156	Unicorn-38857.exe
2308	Unicorn-33451.exe
864	Unicorn-62786.exe
2536	Unicorn-1608.exe
2896	Unicorn-25558.exe
2848	Unicorn-42086.exe
2028	Unicorn-8452.exe
3056	Unicorn-33653.exe
1900	Unicorn-16814.exe
2340	Unicorn-12729.exe
2452	Unicorn-57846.exe
2956	Unicorn-37980.exe
2456	Unicorn-61930.exe
1696	Unicorn-49678.exe
2868	Unicorn-17560.exe
2920	Unicorn-51908.exe
1612	Unicorn-17966.exe
1060	Unicorn-35572.exe
924	Unicorn-13119.exe
860	Unicorn-11835.exe
2256	Unicorn-54722.exe
1956	Unicorn-10352.exe
2092	Unicorn-62841.exe
700	Unicorn-49612.exe
772	Unicorn-27154.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2712 wrote to memory of 2796	2712	8a5dce624613608466191fbc16687190N.exe	30
PID 2712 wrote to memory of 2796	2712	8a5dce624613608466191fbc16687190N.exe	30
PID 2712 wrote to memory of 2796	2712	8a5dce624613608466191fbc16687190N.exe	30
PID 2712 wrote to memory of 2796	2712	8a5dce624613608466191fbc16687190N.exe	30
PID 2796 wrote to memory of 2716	2796	Unicorn-52537.exe	31
PID 2796 wrote to memory of 2716	2796	Unicorn-52537.exe	31
PID 2796 wrote to memory of 2716	2796	Unicorn-52537.exe	31
PID 2796 wrote to memory of 2716	2796	Unicorn-52537.exe	31
PID 2712 wrote to memory of 2784	2712	8a5dce624613608466191fbc16687190N.exe	32
PID 2712 wrote to memory of 2784	2712	8a5dce624613608466191fbc16687190N.exe	32
PID 2712 wrote to memory of 2784	2712	8a5dce624613608466191fbc16687190N.exe	32
PID 2712 wrote to memory of 2784	2712	8a5dce624613608466191fbc16687190N.exe	32
PID 2716 wrote to memory of 2568	2716	Unicorn-643.exe	33
PID 2716 wrote to memory of 2568	2716	Unicorn-643.exe	33
PID 2716 wrote to memory of 2568	2716	Unicorn-643.exe	33
PID 2716 wrote to memory of 2568	2716	Unicorn-643.exe	33
PID 2712 wrote to memory of 2608	2712	8a5dce624613608466191fbc16687190N.exe	34
PID 2712 wrote to memory of 2608	2712	8a5dce624613608466191fbc16687190N.exe	34
PID 2712 wrote to memory of 2608	2712	8a5dce624613608466191fbc16687190N.exe	34
PID 2712 wrote to memory of 2608	2712	8a5dce624613608466191fbc16687190N.exe	34
PID 2796 wrote to memory of 2032	2796	Unicorn-52537.exe	35
PID 2796 wrote to memory of 2032	2796	Unicorn-52537.exe	35
PID 2796 wrote to memory of 2032	2796	Unicorn-52537.exe	35
PID 2796 wrote to memory of 2032	2796	Unicorn-52537.exe	35
PID 2784 wrote to memory of 2136	2784	Unicorn-50399.exe	36
PID 2784 wrote to memory of 2136	2784	Unicorn-50399.exe	36
PID 2784 wrote to memory of 2136	2784	Unicorn-50399.exe	36
PID 2784 wrote to memory of 2136	2784	Unicorn-50399.exe	36
PID 2568 wrote to memory of 1188	2568	Unicorn-21723.exe	37
PID 2568 wrote to memory of 1188	2568	Unicorn-21723.exe	37
PID 2568 wrote to memory of 1188	2568	Unicorn-21723.exe	37
PID 2568 wrote to memory of 1188	2568	Unicorn-21723.exe	37
PID 2716 wrote to memory of 2856	2716	Unicorn-643.exe	38
PID 2716 wrote to memory of 2856	2716	Unicorn-643.exe	38
PID 2716 wrote to memory of 2856	2716	Unicorn-643.exe	38
PID 2716 wrote to memory of 2856	2716	Unicorn-643.exe	38
PID 2032 wrote to memory of 2732	2032	Unicorn-51058.exe	39
PID 2032 wrote to memory of 2732	2032	Unicorn-51058.exe	39
PID 2032 wrote to memory of 2732	2032	Unicorn-51058.exe	39
PID 2032 wrote to memory of 2732	2032	Unicorn-51058.exe	39
PID 2608 wrote to memory of 112	2608	Unicorn-60709.exe	41
PID 2608 wrote to memory of 112	2608	Unicorn-60709.exe	41
PID 2608 wrote to memory of 112	2608	Unicorn-60709.exe	41
PID 2608 wrote to memory of 112	2608	Unicorn-60709.exe	41
PID 2136 wrote to memory of 2740	2136	Unicorn-1302.exe	42
PID 2136 wrote to memory of 2740	2136	Unicorn-1302.exe	42
PID 2136 wrote to memory of 2740	2136	Unicorn-1302.exe	42
PID 2136 wrote to memory of 2740	2136	Unicorn-1302.exe	42
PID 2796 wrote to memory of 264	2796	Unicorn-52537.exe	40
PID 2796 wrote to memory of 264	2796	Unicorn-52537.exe	40
PID 2796 wrote to memory of 264	2796	Unicorn-52537.exe	40
PID 2796 wrote to memory of 264	2796	Unicorn-52537.exe	40
PID 2712 wrote to memory of 2132	2712	8a5dce624613608466191fbc16687190N.exe	43
PID 2712 wrote to memory of 2132	2712	8a5dce624613608466191fbc16687190N.exe	43
PID 2712 wrote to memory of 2132	2712	8a5dce624613608466191fbc16687190N.exe	43
PID 2712 wrote to memory of 2132	2712	8a5dce624613608466191fbc16687190N.exe	43
PID 2784 wrote to memory of 1528	2784	Unicorn-50399.exe	44
PID 2784 wrote to memory of 1528	2784	Unicorn-50399.exe	44
PID 2784 wrote to memory of 1528	2784	Unicorn-50399.exe	44
PID 2784 wrote to memory of 1528	2784	Unicorn-50399.exe	44
PID 1188 wrote to memory of 2004	1188	Unicorn-34333.exe	45
PID 1188 wrote to memory of 2004	1188	Unicorn-34333.exe	45
PID 1188 wrote to memory of 2004	1188	Unicorn-34333.exe	45
PID 1188 wrote to memory of 2004	1188	Unicorn-34333.exe	45

C:\Users\Admin\AppData\Local\Temp\8a5dce624613608466191fbc16687190N.exe
"C:\Users\Admin\AppData\Local\Temp\8a5dce624613608466191fbc16687190N.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2712
- C:\Users\Admin\AppData\Local\Temp\Unicorn-52537.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-52537.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2796
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-643.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-643.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21723.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21723.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34333.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43892.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4286.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54722.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63007.exe
        9⤵
        
        PID:2952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57631.exe
        10⤵
        
        PID:3164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18170.exe
        11⤵
        
        PID:8296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-899.exe
        11⤵
        
        PID:9040
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2952 -s 248
        10⤵
        Program crash
        
        PID:4644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9561.exe
        9⤵
        
        PID:3444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37300.exe
        10⤵
        
        PID:7188
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3444 -s 248
        10⤵
        
        PID:8076
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2256 -s 224
        9⤵
        Program crash
        
        PID:4936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7153.exe
        8⤵
        
        PID:2996
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2996 -s 244
        9⤵
        Program crash
        
        PID:3644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53421.exe
        8⤵
        
        PID:3836
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1176 -s 236
        8⤵
        Program crash
        
        PID:4164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10352.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1956
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1956 -s 224
        8⤵
        Program crash
        
        PID:2312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51698.exe
        7⤵
        
        PID:2428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60641.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25768.exe
        8⤵
        
        PID:5788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35254.exe
        8⤵
        
        PID:6808
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2428 -s 228
        8⤵
        
        PID:7172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25841.exe
        7⤵
        
        PID:3976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43756.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52291.exe
        7⤵
        
        PID:7072
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2004 -s 240
        7⤵
        
        PID:7844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1717.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62841.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-843.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:2144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43729.exe
        9⤵
        
        PID:3428
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2144 -s 216
        9⤵
        Program crash
        
        PID:5736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4403.exe
        8⤵
        
        PID:3704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43588.exe
        8⤵
        
        PID:5784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62307.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6788
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2092 -s 244
        8⤵
        
        PID:7180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1398.exe
        7⤵
        
        PID:2928
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2928 -s 220
        8⤵
        Program crash
        
        PID:3612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16794.exe
        7⤵
        
        PID:3832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64891.exe
        7⤵
        
        PID:5492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43772.exe
        7⤵
        
        PID:7140
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1580 -s 248
        7⤵
        
        PID:8052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49612.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36469.exe
        7⤵
        
        PID:1952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-122.exe
        8⤵
        
        PID:3652
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1952 -s 248
        8⤵
        
        PID:1560
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 700 -s 248
        7⤵
        Program crash
        
        PID:4032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53116.exe
        6⤵
        
        PID:2016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12566.exe
        7⤵
        
        PID:3688
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2016 -s 248
        7⤵
        
        PID:6104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52069.exe
        6⤵
        
        PID:4076
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1188 -s 236
        6⤵
        
        PID:6052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11774.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62615.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27154.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12540.exe
        8⤵
        
        PID:604
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 604 -s 220
        9⤵
        Program crash
        
        PID:4548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4377.exe
        8⤵
        
        PID:3288
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 772 -s 244
        8⤵
        Program crash
        
        PID:5972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37215.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7159.exe
        8⤵
        
        PID:4284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1072.exe
        8⤵
        
        PID:6016
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2520 -s 244
        8⤵
        
        PID:6960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60105.exe
        7⤵
        
        PID:3728
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2564 -s 248
        7⤵
        Program crash
        
        PID:5868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40152.exe
        6⤵
        
        PID:2196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3412.exe
        7⤵
        
        PID:1972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60828.exe
        8⤵
        
        PID:4192
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1972 -s 248
        8⤵
        
        PID:2112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47657.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38388.exe
        7⤵
        
        PID:5940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65239.exe
        7⤵
        
        PID:6832
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2196 -s 244
        7⤵
        
        PID:7968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50759.exe
        6⤵
        
        PID:940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3267.exe
        7⤵
        
        PID:3360
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 940 -s 248
        7⤵
        
        PID:5456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42753.exe
        6⤵
        
        PID:3868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39672.exe
        6⤵
        
        PID:1740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40038.exe
        6⤵
        
        PID:2116
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1976 -s 244
        6⤵
        
        PID:7952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31980.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2592
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2592 -s 224
        6⤵
        Program crash
        
        PID:1112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35825.exe
        5⤵
        
        PID:2908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12898.exe
        6⤵
        
        PID:2012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34714.exe
        7⤵
        
        PID:9008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29094.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14807.exe
        6⤵
        
        PID:6120
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2908 -s 248
        6⤵
        
        PID:7004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65037.exe
        5⤵
        
        PID:2588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45798.exe
        6⤵
        
        PID:9176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52539.exe
        6⤵
        
        PID:4784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47998.exe
        5⤵
        
        PID:4520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24078.exe
        5⤵
        
        PID:5652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42475.exe
        5⤵
        
        PID:7492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28373.exe
        5⤵
        
        PID:8304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31084.exe
        5⤵
        
        PID:9064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59584.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59584.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23472.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1100
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1100 -s 240
        6⤵
        Program crash
        
        PID:2708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26413.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10241.exe
        6⤵
        
        PID:2804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5633.exe
        7⤵
        
        PID:2148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62338.exe
        8⤵
        
        PID:4760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53428.exe
        8⤵
        
        PID:6992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10150.exe
        8⤵
        
        PID:8176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53.exe
        8⤵
        
        PID:8604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13142.exe
        8⤵
        
        PID:9316
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2804 -s 236
        7⤵
        Program crash
        
        PID:3228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22908.exe
        6⤵
        
        PID:2084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8135.exe
        7⤵
        
        PID:6948
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2084 -s 228
        7⤵
        
        PID:7200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50230.exe
        6⤵
        
        PID:4088
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2876 -s 248
        6⤵
        Program crash
        
        PID:5844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28807.exe
        5⤵
        
        PID:2676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-843.exe
        6⤵
        
        PID:3032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8430.exe
        7⤵
        
        PID:3140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55637.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:8996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42834.exe
        8⤵
        
        PID:8496
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3032 -s 216
        7⤵
        Program crash
        
        PID:4508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1777.exe
        6⤵
        
        PID:3232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34091.exe
        7⤵
        
        PID:7440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29840.exe
        7⤵
        
        PID:8988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1797.exe
        6⤵
        
        PID:4596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36298.exe
        6⤵
        
        PID:6244
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2676 -s 224
        6⤵
        
        PID:7724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58715.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2200
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2200 -s 224
        6⤵
        Program crash
        
        PID:3624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13994.exe
        5⤵
        
        PID:3820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39690.exe
        5⤵
        
        PID:5476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44302.exe
        5⤵
        
        PID:7124
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2856 -s 248
        5⤵
        
        PID:1748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9173.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9173.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29943.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42914.exe
        6⤵
        Executes dropped EXE
        
        PID:2748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20496.exe
        7⤵
        
        PID:2692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52281.exe
        8⤵
        
        PID:3256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49375.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30235.exe
        8⤵
        
        PID:6480
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2692 -s 236
        8⤵
        
        PID:7800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23863.exe
        7⤵
        
        PID:3368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38772.exe
        7⤵
        
        PID:5668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15353.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6360
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2748 -s 240
        7⤵
        
        PID:7856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-630.exe
        6⤵
        
        PID:1720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8430.exe
        7⤵
        
        PID:3132
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3132 -s 244
        8⤵
        Program crash
        
        PID:5016
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1720 -s 248
        7⤵
        Program crash
        
        PID:4652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48377.exe
        6⤵
        
        PID:3308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43001.exe
        7⤵
        
        PID:9056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7806.exe
        7⤵
        
        PID:9016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7662.exe
        6⤵
        
        PID:4532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23548.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5828
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2552 -s 248
        6⤵
        
        PID:7588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59997.exe
        5⤵
        
        PID:2820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7859.exe
        6⤵
        
        PID:2188
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2188 -s 224
        7⤵
        Program crash
        
        PID:3952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12550.exe
        6⤵
        
        PID:3276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55248.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7491.exe
        6⤵
        
        PID:7016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26426.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48365.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13672.exe
        6⤵
        
        PID:9348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14365.exe
        5⤵
        
        PID:2884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21664.exe
        6⤵
        
        PID:3744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45291.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46572.exe
        6⤵
        
        PID:7116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10068.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6053.exe
        6⤵
        
        PID:9160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17999.exe
        5⤵
        
        PID:3940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56226.exe
        5⤵
        
        PID:5556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10900.exe
        5⤵
        
        PID:6672
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2940 -s 244
        5⤵
        
        PID:7960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5173.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5173.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2172
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2172 -s 244
        5⤵
        Program crash
        
        PID:536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47772.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47772.exe
      4⤵
      PID:3016
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3016 -s 224
        5⤵
        Program crash
        
        PID:3176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57822.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57822.exe
      4⤵
      PID:3404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33160.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33160.exe
      4⤵
      PID:4740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2548.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2548.exe
      4⤵
      PID:5656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37140.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37140.exe
      4⤵
      PID:7508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32573.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32573.exe
      4⤵
      PID:8324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3348.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3348.exe
      4⤵
      PID:9168
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51058.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51058.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30441.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30441.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48936.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34027.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23646.exe
        7⤵
        
        PID:712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39074.exe
        8⤵
        
        PID:2384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19127.exe
        9⤵
        
        PID:6888
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2384 -s 228
        9⤵
        
        PID:8032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4014.exe
        8⤵
        
        PID:4128
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 712 -s 244
        8⤵
        
        PID:5596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4024.exe
        7⤵
        
        PID:1820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51579.exe
        8⤵
        
        PID:8516
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1820 -s 228
        8⤵
        
        PID:8972
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2628 -s 244
        7⤵
        Program crash
        
        PID:4292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36836.exe
        6⤵
        
        PID:1760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34476.exe
        7⤵
        
        PID:1928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1985.exe
        8⤵
        
        PID:3464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24652.exe
        8⤵
        
        PID:5964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59374.exe
        8⤵
        
        PID:6148
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1928 -s 248
        8⤵
        
        PID:7892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9940.exe
        7⤵
        
        PID:3104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50640.exe
        7⤵
        
        PID:5876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11954.exe
        7⤵
        
        PID:7108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1403.exe
        7⤵
        
        PID:7912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1059.exe
        7⤵
        
        PID:8348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36130.exe
        6⤵
        
        PID:2332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45623.exe
        7⤵
        
        PID:3364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28736.exe
        7⤵
        
        PID:6132
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2332 -s 244
        7⤵
        
        PID:1624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9888.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3416
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 400 -s 240
        6⤵
        Program crash
        
        PID:6000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38857.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34938.exe
        6⤵
        
        PID:3028
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3028 -s 240
        7⤵
        Program crash
        
        PID:2056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44102.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38363.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28891.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:7620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19679.exe
        8⤵
        
        PID:8824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56396.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4388
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2448 -s 240
        7⤵
        
        PID:6188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21241.exe
        6⤵
        
        PID:4092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55000.exe
        6⤵
        
        PID:4856
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2156 -s 244
        6⤵
        
        PID:6100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4303.exe
        5⤵
        
        PID:2108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30138.exe
        6⤵
        
        PID:2424
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2424 -s 240
        7⤵
        Program crash
        
        PID:4568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11030.exe
        6⤵
        
        PID:3540
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2108 -s 244
        6⤵
        
        PID:5680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30065.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43766.exe
        6⤵
        
        PID:6956
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2388 -s 228
        6⤵
        
        PID:8168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21965.exe
        5⤵
        
        PID:3936
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2732 -s 236
        5⤵
        Program crash
        
        PID:5992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25178.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25178.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49678.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6790.exe
        6⤵
        
        PID:2904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13090.exe
        7⤵
        
        PID:3508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14403.exe
        7⤵
        
        PID:4944
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2904 -s 240
        7⤵
        
        PID:5712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42617.exe
        6⤵
        
        PID:3672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40012.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50645.exe
        7⤵
        
        PID:8504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28138.exe
        6⤵
        
        PID:4928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36298.exe
        6⤵
        
        PID:6252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38972.exe
        6⤵
        
        PID:7716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39242.exe
        6⤵
        
        PID:8476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37414.exe
        6⤵
        
        PID:8416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43717.exe
        5⤵
        
        PID:328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4922.exe
        6⤵
        
        PID:3528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14403.exe
        6⤵
        
        PID:4960
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 328 -s 240
        6⤵
        
        PID:5772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16472.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61797.exe
        6⤵
        
        PID:8412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63552.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27632.exe
        5⤵
        
        PID:5896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46940.exe
        5⤵
        
        PID:7480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55239.exe
        5⤵
        
        PID:8360
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 760 -s 248
        5⤵
        
        PID:9132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11835.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11835.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26993.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45239.exe
        6⤵
        
        PID:3292
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2824 -s 248
        6⤵
        
        PID:4232
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 860 -s 248
        5⤵
        Program crash
        
        PID:3424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56624.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56624.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11798.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3792
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1584 -s 228
        5⤵
        
        PID:1692
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34087.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34087.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19052.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19052.exe
      4⤵
      PID:6064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57104.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57104.exe
      4⤵
      PID:7136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45939.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45939.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24834.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24834.exe
      4⤵
      PID:8460
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16142.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16142.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40384.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40384.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16814.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8077.exe
        6⤵
        
        PID:1652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13858.exe
        7⤵
        
        PID:3944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44144.exe
        7⤵
        
        PID:4452
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1652 -s 240
        7⤵
        
        PID:6224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4382.exe
        6⤵
        
        PID:3296
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1900 -s 244
        6⤵
        Program crash
        
        PID:4124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29436.exe
        5⤵
        
        PID:2104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29427.exe
        6⤵
        
        PID:3472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61439.exe
        7⤵
        
        PID:8400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14403.exe
        6⤵
        
        PID:4952
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2104 -s 240
        6⤵
        
        PID:6200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6960.exe
        5⤵
        
        PID:3496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34004.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4916
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2100 -s 244
        5⤵
        
        PID:5644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37980.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37980.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57444.exe
        5⤵
        
        PID:1496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53028.exe
        6⤵
        
        PID:3344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41512.exe
        6⤵
        
        PID:5108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1626.exe
        6⤵
        
        PID:6976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35092.exe
        6⤵
        
        PID:7996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64901.exe
        6⤵
        
        PID:8512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62144.exe
        6⤵
        
        PID:9340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17366.exe
        5⤵
        
        PID:3556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2923.exe
        5⤵
        
        PID:4516
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2956 -s 228
        5⤵
        
        PID:7024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1729.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1729.exe
      4⤵
      PID:1332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23309.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57133.exe
        5⤵
        
        PID:5764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62197.exe
        5⤵
        
        PID:1364
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1332 -s 228
        5⤵
        
        PID:5852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56676.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56676.exe
      4⤵
      PID:3656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35971.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35971.exe
      4⤵
      PID:5684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55690.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55690.exe
      4⤵
      PID:5792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1933.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1933.exe
      4⤵
      PID:7896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30169.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30169.exe
      4⤵
      PID:8488
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23783.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23783.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17966.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17966.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13806.exe
        5⤵
        
        PID:236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37424.exe
        6⤵
        
        PID:3632
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 236 -s 248
        6⤵
        Program crash
        
        PID:5528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3059.exe
        5⤵
        
        PID:3800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63110.exe
        5⤵
        
        PID:5564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36101.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6636
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1612 -s 240
        5⤵
        
        PID:7832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59478.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59478.exe
      4⤵
      PID:1864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5882.exe
        5⤵
        
        PID:3116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27231.exe
        5⤵
        
        PID:4968
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1864 -s 240
        5⤵
        
        PID:5724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26093.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26093.exe
      4⤵
      PID:3492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16956.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16956.exe
      4⤵
      PID:4336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64363.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64363.exe
      4⤵
      PID:6968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9891.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9891.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:8012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65431.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65431.exe
      4⤵
      PID:8536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57678.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57678.exe
      4⤵
      PID:9300
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13119.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13119.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2125.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2125.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40792.exe
        5⤵
        
        PID:4376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54357.exe
        5⤵
        
        PID:5588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64418.exe
        5⤵
        
        PID:6964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10068.exe
        5⤵
        
        PID:7944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59338.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54346.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54346.exe
      4⤵
      PID:3980
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 924 -s 224
      4⤵
      PID:5620
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8756.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8756.exe
    3⤵
    PID:2296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35229.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35229.exe
      4⤵
      PID:4316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16697.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16697.exe
      4⤵
      PID:6208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41772.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41772.exe
      4⤵
      PID:7692
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2296 -s 248
      4⤵
      PID:8464
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22495.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22495.exe
    3⤵
    PID:3812
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14587.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14587.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6072
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30238.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30238.exe
    3⤵
    PID:7052
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44804.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44804.exe
    3⤵
    PID:8096
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21719.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21719.exe
    3⤵
    PID:8332
- C:\Users\Admin\AppData\Local\Temp\Unicorn-50399.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-50399.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2784
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1302.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1302.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14104.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14104.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32792.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33451.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6349.exe
        7⤵
        
        PID:1064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58980.exe
        8⤵
        
        PID:1916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60449.exe
        9⤵
        
        PID:3088
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1916 -s 228
        9⤵
        Program crash
        
        PID:5548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60620.exe
        8⤵
        
        PID:3328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19446.exe
        8⤵
        
        PID:5632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3101.exe
        8⤵
        
        PID:6652
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1064 -s 244
        8⤵
        
        PID:7976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55643.exe
        7⤵
        
        PID:2220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26106.exe
        8⤵
        
        PID:4028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36904.exe
        8⤵
        
        PID:5884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6089.exe
        8⤵
        
        PID:5824
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2220 -s 248
        8⤵
        
        PID:8072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64708.exe
        7⤵
        
        PID:3780
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2308 -s 248
        7⤵
        Program crash
        
        PID:5860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3780.exe
        6⤵
        
        PID:2440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52094.exe
        7⤵
        
        PID:2532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63817.exe
        8⤵
        
        PID:5100
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2532 -s 216
        8⤵
        
        PID:6152
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2440 -s 248
        7⤵
        Program crash
        
        PID:4156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24967.exe
        6⤵
        
        PID:2544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57362.exe
        7⤵
        
        PID:7060
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2544 -s 224
        7⤵
        
        PID:8100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23615.exe
        6⤵
        
        PID:4148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35587.exe
        6⤵
        
        PID:6044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56375.exe
        6⤵
        
        PID:2216
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2780 -s 244
        6⤵
        
        PID:7048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62786.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:864
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 864 -s 224
        6⤵
        Program crash
        
        PID:2616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1179.exe
        5⤵
        
        PID:2444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13801.exe
        6⤵
        
        PID:1868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4440.exe
        7⤵
        
        PID:6216
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1868 -s 228
        7⤵
        
        PID:8116
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2444 -s 236
        6⤵
        Program crash
        
        PID:3096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5560.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48234.exe
        6⤵
        
        PID:6816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50769.exe
        6⤵
        
        PID:7568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39497.exe
        6⤵
        
        PID:9036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50746.exe
        5⤵
        
        PID:3892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23136.exe
        5⤵
        
        PID:5516
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2740 -s 244
        5⤵
        
        PID:6688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41706.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41706.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61930.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63749.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15883.exe
        7⤵
        
        PID:3320
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2632 -s 248
        7⤵
        
        PID:5604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55825.exe
        6⤵
        
        PID:3420
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2456 -s 240
        6⤵
        Program crash
        
        PID:5920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3043.exe
        5⤵
        
        PID:1752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32219.exe
        6⤵
        
        PID:3720
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1752 -s 228
        6⤵
        
        PID:5676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61392.exe
        5⤵
        
        PID:3576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48337.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5576
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1532 -s 224
        5⤵
        
        PID:5800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35572.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35572.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44829.exe
        5⤵
        
        PID:1888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34269.exe
        6⤵
        
        PID:5008
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1888 -s 236
        6⤵
        
        PID:6168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21865.exe
        5⤵
        
        PID:4084
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1060 -s 244
        5⤵
        Program crash
        
        PID:5948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49800.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49800.exe
      4⤵
      PID:2800
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2800 -s 220
        5⤵
        Program crash
        
        PID:4556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61005.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61005.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3984
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2136 -s 236
      4⤵
      Program crash
      PID:6024
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3367.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3367.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57488.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57488.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12729.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49302.exe
        6⤵
        
        PID:2076
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2076 -s 224
        7⤵
        Program crash
        
        PID:3956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16634.exe
        6⤵
        
        PID:3244
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2340 -s 240
        6⤵
        Program crash
        
        PID:5116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43333.exe
        5⤵
        
        PID:1412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8430.exe
        6⤵
        
        PID:3148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45798.exe
        7⤵
        
        PID:9188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55492.exe
        7⤵
        
        PID:9440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53599.exe
        6⤵
        
        PID:4612
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1412 -s 220
        6⤵
        
        PID:5804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15512.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37438.exe
        6⤵
        
        PID:9144
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3192 -s 216
        6⤵
        
        PID:8964
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1800 -s 216
        5⤵
        Program crash
        
        PID:4480
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17560.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17560.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63199.exe
        5⤵
        
        PID:2768
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2768 -s 224
        6⤵
        Program crash
        
        PID:3756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1798.exe
        5⤵
        
        PID:3696
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2868 -s 244
        5⤵
        Program crash
        
        PID:5580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27904.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27904.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25151.exe
        5⤵
        
        PID:1540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44902.exe
        6⤵
        
        PID:5716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48462.exe
        6⤵
        
        PID:920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4203.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14718.exe
        6⤵
        
        PID:8264
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1116 -s 248
        5⤵
        Program crash
        
        PID:4368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8165.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8165.exe
      4⤵
      PID:3076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27044.exe
        5⤵
        
        PID:9068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64534.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64534.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11097.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11097.exe
      4⤵
      PID:5708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2553.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2553.exe
      4⤵
      PID:7540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33708.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33708.exe
      4⤵
      PID:8372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26884.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26884.exe
      4⤵
      PID:9212
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22001.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22001.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42086.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42086.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16246.exe
        5⤵
        
        PID:568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10485.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1013.exe
        7⤵
        
        PID:7604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25761.exe
        7⤵
        
        PID:9032
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 568 -s 248
        6⤵
        Program crash
        
        PID:4136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45057.exe
        5⤵
        
        PID:2600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31133.exe
        6⤵
        
        PID:9024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51963.exe
        6⤵
        
        PID:8300
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2848 -s 244
        5⤵
        Program crash
        
        PID:4300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50926.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50926.exe
      4⤵
      PID:2292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25535.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3636
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2292 -s 216
        5⤵
        Program crash
        
        PID:4900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61589.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61589.exe
      4⤵
      PID:3824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39048.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39048.exe
      4⤵
      PID:4184
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2288 -s 244
      4⤵
      PID:5856
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33653.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33653.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11201.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11201.exe
      4⤵
      PID:2504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44502.exe
        5⤵
        
        PID:1808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23292.exe
        6⤵
        
        PID:8592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13888.exe
        6⤵
        
        PID:9004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52831.exe
        5⤵
        
        PID:4276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2555.exe
        5⤵
        
        PID:2244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4746.exe
        5⤵
        
        PID:2240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1403.exe
        5⤵
        
        PID:7936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55055.exe
        5⤵
        
        PID:9172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13453.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13453.exe
      4⤵
      PID:2284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15559.exe
        5⤵
        
        PID:9140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1029.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1029.exe
      4⤵
      PID:4268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20672.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20672.exe
      4⤵
      PID:6040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61618.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61618.exe
      4⤵
      PID:5988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50405.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50405.exe
      4⤵
      PID:7752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51700.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51700.exe
      4⤵
      PID:9204
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23651.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23651.exe
    3⤵
    PID:2352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59551.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59551.exe
      4⤵
      PID:3844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19447.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19447.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30432.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30432.exe
      4⤵
      PID:6280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47637.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47637.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7700
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2352 -s 244
      4⤵
      PID:8444
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46830.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46830.exe
    3⤵
    PID:4008
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14768.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14768.exe
    3⤵
    PID:4708
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6632.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6632.exe
    3⤵
    PID:6008
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41224.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41224.exe
    3⤵
    PID:7524
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2784 -s 248
    3⤵
    PID:8352
- C:\Users\Admin\AppData\Local\Temp\Unicorn-60709.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-60709.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2608
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22273.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22273.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12371.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12371.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25558.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60210.exe
        6⤵
        
        PID:1192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52997.exe
        7⤵
        
        PID:2044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7927.exe
        8⤵
        
        PID:4636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12613.exe
        8⤵
        
        PID:6236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49940.exe
        8⤵
        
        PID:7656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64443.exe
        8⤵
        
        PID:8452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40968.exe
        8⤵
        
        PID:8616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46370.exe
        7⤵
        
        PID:3864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42472.exe
        7⤵
        
        PID:5544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65239.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6836
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1192 -s 244
        7⤵
        
        PID:8008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62872.exe
        6⤵
        
        PID:3008
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3008 -s 244
        7⤵
        Program crash
        
        PID:5024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6436.exe
        6⤵
        
        PID:3608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44253.exe
        6⤵
        
        PID:6080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56574.exe
        6⤵
        
        PID:7036
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2896 -s 248
        6⤵
        
        PID:7812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65041.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15145.exe
        6⤵
        
        PID:1172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20912.exe
        7⤵
        
        PID:6676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38158.exe
        7⤵
        
        PID:7916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15739.exe
        7⤵
        
        PID:8440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53364.exe
        7⤵
        
        PID:8820
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3044 -s 248
        6⤵
        Program crash
        
        PID:4176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41304.exe
        5⤵
        
        PID:304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13724.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52440.exe
        6⤵
        
        PID:8104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2164.exe
        6⤵
        
        PID:8800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21807.exe
        6⤵
        
        PID:9308
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 840 -s 248
        5⤵
        Program crash
        
        PID:4168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1608.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1608.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49302.exe
        5⤵
        
        PID:296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57631.exe
        6⤵
        
        PID:3156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10001.exe
        7⤵
        
        PID:8344
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3156 -s 228
        7⤵
        
        PID:9096
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 296 -s 216
        6⤵
        Program crash
        
        PID:4496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14221.exe
        5⤵
        
        PID:3352
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2536 -s 244
        5⤵
        Program crash
        
        PID:4604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57069.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57069.exe
      4⤵
      PID:2304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60044.exe
        5⤵
        
        PID:4040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3303.exe
        5⤵
        
        PID:4700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26348.exe
        5⤵
        
        PID:6260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55805.exe
        5⤵
        
        PID:7644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55778.exe
        5⤵
        
        PID:8428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24432.exe
        5⤵
        
        PID:8420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56847.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56847.exe
      4⤵
      PID:3392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52448.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52448.exe
      4⤵
      PID:3816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47827.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47827.exe
      4⤵
      PID:6984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26957.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26957.exe
      4⤵
      PID:8024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43900.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43900.exe
      4⤵
      PID:8528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52343.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52343.exe
      4⤵
      PID:9292
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37622.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37622.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57846.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57846.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64159.exe
        5⤵
        
        PID:1340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23122.exe
        6⤵
        
        PID:1480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17783.exe
        7⤵
        
        PID:7000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56005.exe
        7⤵
        
        PID:8036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8853.exe
        7⤵
        
        PID:8212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3822.exe
        6⤵
        
        PID:3272
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1340 -s 244
        6⤵
        Program crash
        
        PID:5932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11616.exe
        5⤵
        
        PID:2560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7740.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3572
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2560 -s 248
        6⤵
        Program crash
        
        PID:5756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23675.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56505.exe
        5⤵
        
        PID:5832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3289.exe
        5⤵
        
        PID:7056
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2452 -s 248
        5⤵
        
        PID:7776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44787.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44787.exe
      4⤵
      PID:560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51129.exe
        5⤵
        
        PID:4048
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 560 -s 248
        5⤵
        Program crash
        
        PID:5484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58403.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58403.exe
      4⤵
      PID:3188
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1816 -s 248
      4⤵
      Program crash
      PID:5508
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51908.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51908.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2920
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2920 -s 224
      4⤵
      Program crash
      PID:916
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57563.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57563.exe
    3⤵
    PID:2160
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2160 -s 244
      4⤵
      Program crash
      PID:3480
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24772.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24772.exe
    3⤵
    PID:3584
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8803.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8803.exe
    3⤵
    PID:4976
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28163.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28163.exe
    3⤵
    PID:6268
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38391.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38391.exe
    3⤵
    PID:7624
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2608 -s 244
    3⤵
    PID:8336
- C:\Users\Admin\AppData\Local\Temp\Unicorn-17923.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-17923.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2132
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2132 -s 224
    3⤵
    - Loads dropped DLL
    - Program crash
    PID:2500
- C:\Users\Admin\AppData\Local\Temp\Unicorn-48558.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-48558.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1620
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1620 -s 244
    3⤵
    - Program crash
    PID:2736
- C:\Users\Admin\AppData\Local\Temp\Unicorn-8452.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-8452.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2028
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30527.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30527.exe
    3⤵
    PID:2720
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2720 -s 224
      4⤵
      Program crash
      PID:3516
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10713.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10713.exe
    3⤵
    PID:3708
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2028 -s 240
    3⤵
    - Program crash
    PID:4880
- C:\Users\Admin\AppData\Local\Temp\Unicorn-25635.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-25635.exe
  2⤵
  PID:2724
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32385.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32385.exe
    3⤵
    PID:1604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31856.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31856.exe
      4⤵
      PID:3716
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1604 -s 228
      4⤵
      PID:5616
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7584.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7584.exe
    3⤵
    PID:4000
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2724 -s 244
    3⤵
    - Program crash
    PID:5956
- C:\Users\Admin\AppData\Local\Temp\Unicorn-18214.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-18214.exe
  2⤵
  PID:1592
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10153.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10153.exe
    3⤵
    PID:3468
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1592 -s 248
    3⤵
    PID:6112
- C:\Users\Admin\AppData\Local\Temp\Unicorn-9781.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-9781.exe
  2⤵
  PID:3240
- C:\Users\Admin\AppData\Local\Temp\Unicorn-13452.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-13452.exe
  2⤵
  PID:6032
- C:\Users\Admin\AppData\Local\Temp\Unicorn-23039.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-23039.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2300
- C:\Users\Admin\AppData\Local\Temp\Unicorn-64405.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-64405.exe
  2⤵
  PID:7884
- C:\Users\Admin\AppData\Local\Temp\Unicorn-18919.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-18919.exe
  2⤵
  PID:9116

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-11835.exe

Filesize
468KB

MD5
ff0b8b8c6935d7ef15ff1c73fd1aa604

SHA1
c8a5d46afc20d3177bab2614b7fa629e1674b178

SHA256
a19a5af4c6ebfb64734ed99641ad0ed6285ffa8df2111331bd84eb0f8e66ec0a

SHA512
a348ca8d35bd567d9d9e4ead06b007b20c807607f101b9147659cd3c9a8409457c44dcbaa0093f1d09fcdc67942cd457691f69f82d6cb734dd53b7ecb19e65db

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-15739.exe

Filesize
468KB

MD5
1ed2ad7709fd006f3ef52451892bd6ad

SHA1
143f9b6b149adb626466db12c42caf0db2ba2548

SHA256
f8e1c95475b501dd13a7c7857baa7558f1235ab94a75d1db66cc1d5e0d582a47

SHA512
5ce9600b0721474d07c0526dfe64ea7dc4325b58b5930b66a30cea02afdd9af6cb75034a59e1e7ef0c7d4bf8202c56abc522186c16ca65e254d530fc9c7f25f7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-16142.exe

Filesize
468KB

MD5
9e114681c5da820d4f7f0bf7338e05b8

SHA1
8bc51bf0db2257fbf68ed55d610ff4f1b4104345

SHA256
86572b4715575793abcffb183ae7cca24cc09f93059355d62a0439dad98d5d2e

SHA512
7ad91921ce4c495f9003a336d6ba0b306c39f31e557dd7484809c908302a2dda5c97f26be77800366d28afd5fa173bd28db70419506c4491f4a3d77382a400a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-17923.exe

Filesize
468KB

MD5
a36da311a3995531d79fb3effb2baedc

SHA1
5f214ca5aaab6cecbf7c26863f0fdc16fa8bafdf

SHA256
261b90677fb6e618096e4a1f287db48a22331aa961120dbc78e889049bdbe09c

SHA512
6294e7474fed76ac825cd7f4173de6d083821d20b77c84128c8b570eb68764966e6c0bc5466496219f6435ef92ef7bad8693f798fc6b1093f0b99e3770521ecd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-22273.exe

Filesize
468KB

MD5
5502538395cd7e5090846eae6c0a3898

SHA1
71d38efbb3c29131c4db98e0a589a65ada61a917

SHA256
9d96b589cc4d3856b173cf7b705096f583ce29dd87d7fc0c537008836c83b4ee

SHA512
f3ec22aa7da57052b22aa413437b0476d6ef55accabf3ee9b6bc0f9984b050e9c4c7089616f7a51d224af0ffc9a8e0feb554730b1a6d5911bb1478e2bf9a7a60

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-34333.exe

Filesize
468KB

MD5
18524134cc9415db10657beda498d098

SHA1
a5066826a2175019d6fc6605a10bfaa4eb2c7bb6

SHA256
9c4561452e7ae68d027a74b95773ec85831f2921c11bcce2fb01b46574d46094

SHA512
894c8e8d148df2bd5a362c1118d4a5a393774852947d06cfaa6e2932ce66bfad7d75c8fb3c2a1561e4d38c362c6bd9286de56bf84de276332d2c57ea9be94c7e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-40152.exe

Filesize
468KB

MD5
3818f11e62f3f7951cef70184fe1a8e4

SHA1
fbc2f46595b857b3a35c7cf322b139fe48906121

SHA256
8ff3ed0ccff0974acfa63f04cbb54c8f3354ebcc5edcaff9ec0bfb0fae3b22c6

SHA512
bb87d7afcf28957eae61b4100c1350c81fe082ba01e799257eff76ce012acb9fd8e7e71a86d1e87002fc8e3e94eee83fe772d6289b6bb6d9652b008e5a6d252c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5633.exe

Filesize
468KB

MD5
5e68f3ce4a402948251c27bbe17480e2

SHA1
db5ff2aafd54d67c8583bf1b780e8ad98760db39

SHA256
a9f00d8eadd1444156c91ac7cd053e95406ef238aaa5498e2531270a16e569c0

SHA512
02f0964d59815096decb3333fe5c9c38555aca308f01e8288a27ac7c6b7b08f45dea5a65c0f3bb341555bd04fb7db940c2f8afe0b0ce1c9f440e2651df318842

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-60709.exe

Filesize
468KB

MD5
8eb2b46c8c0c237f4bc70b2f0355fd1c

SHA1
1034d3fbbb96910c97fd586197fdf557a6ef84af

SHA256
4b82707927ceef79b7f63e338888bfb4d896f1e0da48aa241a90312af99d9070

SHA512
66089663fb184aa4cf20111ec22d85480a6ec46f69252619ee718c11383b5b3f12af277a75fe2cb4249a9f56cbd542bfb45e50ac68f37f4796e85e8d116d31d2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-643.exe

Filesize
468KB

MD5
fffceb934cd5355ffbcabc86b158185e

SHA1
dc2105456748ddd78da2c1990e3221ce7689a82c

SHA256
aff53059b973b6989993a37ff8033079b4d3055999b47e3a0221925454ed9e16

SHA512
4cf3367175a5fa541bb2b059360ce7e38adf8128803a80b4a45b6f26a2b0b5a1bfaf7f942428fdb463a9d75115403dd3816742a6aeb7b9c16e4a57b688b15bf7

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-11774.exe

Filesize
468KB

MD5
1d43bcc8e18d0c78d142162c63542dab

SHA1
b2f8588eded6641fe2eb70a33a9204c29607587c

SHA256
80cd6dad983cfac678c16a7bd9815add6aa9f21d8166740ae1776245e2d06e3b

SHA512
bc6218d297d41b8a1c1131799a2c58ba555e4f2a515873a24088b9d864d025e2a1d756607c4961cd6759be53c636835e4942e8064ccc15987c6160dd2f197d6b

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-1302.exe

Filesize
468KB

MD5
b4a8dda22a0e9a314ff865f32cc01bb1

SHA1
ae930a9468a25fb14b26ff10fa7f048e40a618ca

SHA256
a69abed25488c0540191ac58ef023414ae83babf6a80824551e9aab5e4b775ee

SHA512
bb3bfd30dffaa771854276754e634e7561e12de965227c931cbdccfc7ae2c9216420975647c35206da975d087f3f559fd3843609b56fa8143818e12b18f2fa85

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-14104.exe

Filesize
468KB

MD5
6b56500ea5a752a21ac0452d04c8c55f

SHA1
60ce58e6f30bdc49e5b533af46fa585c351c82d6

SHA256
699c355d10025a45b37da0e7ae1b4f5a53b53f86cadd2c642d215f669faae238

SHA512
6e21a9f85c0f8180df12b87b76495c69c686fa305f3d6d9b5034e8f605e97617a6420e48e47d1af64a3ecbbf07daa68a3e467995171e6b20eecbdb211bbb075c

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-21723.exe

Filesize
468KB

MD5
b356117e8b983a9ece7b3fbff5f75180

SHA1
0e635b9a5fd47130c25db5595245034dc1dc8e31

SHA256
ad4a1d7e313003ffe7190ebcd1b643aa0400ed4a9d50bf068c55aa14fd6c5479

SHA512
5c73839b88056b235c1292fb1cb83d5ad9846c9262ff56b33bb3af09e054fb7fcd850010b0c386145de7eafaa638d867f70ab6a9f4512612d6c62acd3046bb61

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-23472.exe

Filesize
468KB

MD5
f07027e5c81d7db1c729d7b082a452c6

SHA1
919d6c6904c1f6561e2e27a82f6ae1b8b1001331

SHA256
af48232e6bf507cd851f9d7c140e56490238d02c11c588e7e09fa453dfd44995

SHA512
c9f0012f114bcddf92b4577478b99630397f04a0f8acc19b376ccc2795677283107211409c6e45410c2f237795dab9c59be72b597a5808e245b504436b5b4dbf

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-30441.exe

Filesize
468KB

MD5
e6748209e16f29e4c245a9a5205cdc7b

SHA1
4e33809efc1e06879949b2e0bc8248f47fe1f67d

SHA256
7386034db024a3b031cd4ce28a3d7935b1f10018b605225861f34359e2dbbb80

SHA512
d19e456736d256994aac5c909a505d9c08ac311019aeba93c3f2282a703a42dadea32085bf40a6c83ac3bae89feb0d8414661f0a6418e2fde88a8e1207428efc

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-3367.exe

Filesize
468KB

MD5
286c555288029e207174a5e7354ca45c

SHA1
95b944470667f7015d644909134e762b58715f15

SHA256
3c739e01a9c01237433b9833b0d88512351272a09c41709cb556ede670fa6831

SHA512
8491391bd55a5107941a5210159c4b1e702a6169b34f3e3490470e33feec872d9df39f4a193756fe145c5631a2b024c973f3e55c292c7d8404d625ca3aae7cb9

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-43892.exe

Filesize
468KB

MD5
4bedfff0ca29b8eabff591b0533eb7f4

SHA1
33170fabf79dbd0d81644f8a736ddafd08673dea

SHA256
d0f2c2b2c8b45db79848facb0fa4005d3f7e6f537fb7830bb9cfbe8540f87060

SHA512
26082c49b9949b7ddcef607e094cfd3573e631abfe16178dba850e5b85e8e22379bd183337ec7513f8eac5a2f383a9c1b6889a1d81eb95244c213da41fbd353d

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-50399.exe

Filesize
468KB

MD5
c6b3f75ea86518ab7d288e3e55517739

SHA1
22e70550b8f2dabdafe573062b5f888ebbc70995

SHA256
85a4109ca4198a3c5032337bbb26cfe39a238b2ebbba27c52ba7796a55339952

SHA512
665f5335ec92ac1f98eee23078929b5b04de805400efc0d6ca8fe27c6bdfd4a955ae4ccbbc919fd7849ef779314279e0e980828571babf6afda6a0652bb8ad90

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-51058.exe

Filesize
468KB

MD5
09557417f68c058c601ab8335468d7b0

SHA1
f904c573f58d3eac9775283fff84e654f39da318

SHA256
ea41b15f9818eafb93ea3f0caee64a4f95eaa26b660757d046679785d79c33e9

SHA512
c18d47eca698c38ece91c7ed852f2b9663726220acd78ca496453df68b692111cb3e14ca24158b4b520ffd6412f15d97fc707329b2f6ee951fe84fee6d6c4023

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-52537.exe

Filesize
468KB

MD5
b7b30abe4dc23764efd0d4a9713c2323

SHA1
a2572983695d26f2f5f599f661a0354be72fcd36

SHA256
c6133b33e41048fa3b9d107e4aecbd9c9b9e5d281c1ae983350e3d53f4efca45

SHA512
4e7560285e57004a524862c3d741da874766e809ac5da11c9eb2e745d9260373d9e4c7fabfe98b1b5f010fcc416e93b0a1e52ecb43471180d91b9ff679a47971

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-59584.exe

Filesize
468KB

MD5
521d84876f719f0d735d301793a98932

SHA1
a7af41d6cbb8e9f25c49db45c4bca82609360fdb

SHA256
b306f466fdf0220b331d51ed1e5a54d3522bd2a2be84914d48b77636d7a3f8c4

SHA512
3e8ea23c9ef8c965f628033f66de3f05af94c205ba20664266bb2370ddcc23175a38a2809ab5f8b6656b8aedbc4af469a4d0c0cc3dd9e551d36dd0a26bc8e0eb

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-9173.exe

Filesize
468KB

MD5
dd948be3c96c79edf04477929e22eb6a

SHA1
129de213af8f94a567ad82accc6b2d7cc3cbe2ca

SHA256
c152930849ce97900e5f78d524d46b1fb8dacea7acfb9e25f411b6c5e7d1e582

SHA512
90c347feb265612cc8a8dd133eb9b02cbca63fcffca5b093594654b0de9e4823953f4c49c103f33c6ef0e0e584244c7abc16f8591b31def063db79e07f49aca5

Download Submit