55b87943b36160fc3a1db751c1aa9f515d2b6fd43948d5d02f839afba1ecda71

Analysis

max time kernel
119s
max time network
17s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
29/09/2024, 10:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

55b87943b36160fc3a1db751c1aa9f515d2b6fd43948d5d02f839afba1ecda71N.exe
Size

468KB
MD5

ca486d4ae7a66239fd35e8d669348420
SHA1

698684eaddce025e390c79bf2c06cefd8cef9a07
SHA256

55b87943b36160fc3a1db751c1aa9f515d2b6fd43948d5d02f839afba1ecda71
SHA512

4bda8de859da0cf0e6723f065cd1452c0cc13e975151431f46c2830820b9a0d1a2a7d298ec47be745af2993f230580709307bd72c9eb8eefd8dbe690b79eb1ac
SSDEEP

3072:6G3HogISIEPTtbY2HzcOcf8/zCcap0pkJVHeTV7yKkeL57ggUql7:6G3obKTtxH4OcfjY1IKkgNggU

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
1348	Unicorn-9595.exe
2880	Unicorn-4608.exe
2696	Unicorn-46196.exe
2804	Unicorn-36534.exe
2928	Unicorn-64145.exe
2896	Unicorn-46326.exe
2628	Unicorn-4738.exe
2724	Unicorn-24256.exe
3028	Unicorn-46212.exe
636	Unicorn-26346.exe
1304	Unicorn-13082.exe
2024	Unicorn-59019.exe
1424	Unicorn-13347.exe
1264	Unicorn-19469.exe
2424	Unicorn-57525.exe
2580	Unicorn-29299.exe
1028	Unicorn-24469.exe
1616	Unicorn-6086.exe
1800	Unicorn-40805.exe
544	Unicorn-26092.exe
1612	Unicorn-44889.exe
1844	Unicorn-59179.exe
616	Unicorn-65309.exe
1480	Unicorn-24277.exe
1272	Unicorn-33249.exe
316	Unicorn-27598.exe
1244	Unicorn-55278.exe
2092	Unicorn-31328.exe
1652	Unicorn-19866.exe
3048	Unicorn-12252.exe
1732	Unicorn-28911.exe
1704	Unicorn-39117.exe
808	Unicorn-20551.exe
2800	Unicorn-28454.exe
2808	Unicorn-57307.exe
2760	Unicorn-45610.exe
2636	Unicorn-30063.exe
2844	Unicorn-46399.exe
3056	Unicorn-42869.exe
2660	Unicorn-29108.exe
3004	Unicorn-38039.exe
1372	Unicorn-40077.exe
2328	Unicorn-63098.exe
1924	Unicorn-5729.exe
1320	Unicorn-17427.exe
2888	Unicorn-28717.exe
1804	Unicorn-54183.exe
2152	Unicorn-27440.exe
2948	Unicorn-13705.exe
2416	Unicorn-49642.exe
1468	Unicorn-49907.exe
2572	Unicorn-2797.exe
1908	Unicorn-28200.exe
2480	Unicorn-20586.exe
1540	Unicorn-56788.exe
924	Unicorn-62910.exe
1764	Unicorn-60680.exe
2568	Unicorn-64499.exe
1776	Unicorn-27816.exe
1044	Unicorn-45652.exe
2528	Unicorn-53058.exe
748	Unicorn-9258.exe
2916	Unicorn-29124.exe
2812	Unicorn-33762.exe

Loads dropped DLL 64 IoCs

pid	Process
2340	55b87943b36160fc3a1db751c1aa9f515d2b6fd43948d5d02f839afba1ecda71N.exe
2340	55b87943b36160fc3a1db751c1aa9f515d2b6fd43948d5d02f839afba1ecda71N.exe
1348	Unicorn-9595.exe
2340	55b87943b36160fc3a1db751c1aa9f515d2b6fd43948d5d02f839afba1ecda71N.exe
1348	Unicorn-9595.exe
2340	55b87943b36160fc3a1db751c1aa9f515d2b6fd43948d5d02f839afba1ecda71N.exe
2696	Unicorn-46196.exe
2696	Unicorn-46196.exe
2340	55b87943b36160fc3a1db751c1aa9f515d2b6fd43948d5d02f839afba1ecda71N.exe
2340	55b87943b36160fc3a1db751c1aa9f515d2b6fd43948d5d02f839afba1ecda71N.exe
1348	Unicorn-9595.exe
2880	Unicorn-4608.exe
1348	Unicorn-9595.exe
2880	Unicorn-4608.exe
2804	Unicorn-36534.exe
2804	Unicorn-36534.exe
2628	Unicorn-4738.exe
2628	Unicorn-4738.exe
2696	Unicorn-46196.exe
2696	Unicorn-46196.exe
2340	55b87943b36160fc3a1db751c1aa9f515d2b6fd43948d5d02f839afba1ecda71N.exe
2928	Unicorn-64145.exe
2880	Unicorn-4608.exe
2928	Unicorn-64145.exe
2340	55b87943b36160fc3a1db751c1aa9f515d2b6fd43948d5d02f839afba1ecda71N.exe
1348	Unicorn-9595.exe
2880	Unicorn-4608.exe
1348	Unicorn-9595.exe
1316	WerFault.exe
1316	WerFault.exe
1316	WerFault.exe
1316	WerFault.exe
1316	WerFault.exe
3028	Unicorn-46212.exe
3028	Unicorn-46212.exe
2628	Unicorn-4738.exe
2628	Unicorn-4738.exe
2024	Unicorn-59019.exe
2024	Unicorn-59019.exe
2880	Unicorn-4608.exe
2880	Unicorn-4608.exe
2724	Unicorn-24256.exe
2724	Unicorn-24256.exe
2804	Unicorn-36534.exe
2804	Unicorn-36534.exe
636	Unicorn-26346.exe
636	Unicorn-26346.exe
2696	Unicorn-46196.exe
1264	Unicorn-19469.exe
2696	Unicorn-46196.exe
1264	Unicorn-19469.exe
1304	Unicorn-13082.exe
1304	Unicorn-13082.exe
1348	Unicorn-9595.exe
2340	55b87943b36160fc3a1db751c1aa9f515d2b6fd43948d5d02f839afba1ecda71N.exe
1348	Unicorn-9595.exe
2340	55b87943b36160fc3a1db751c1aa9f515d2b6fd43948d5d02f839afba1ecda71N.exe
1424	Unicorn-13347.exe
1424	Unicorn-13347.exe
2928	Unicorn-64145.exe
2928	Unicorn-64145.exe
2424	Unicorn-57525.exe
2424	Unicorn-57525.exe
3028	Unicorn-46212.exe

Program crash 64 IoCs

pid	pid_target	Process	procid_target
1316	2896	WerFault.exe	35
2684	1732	WerFault.exe	62
2644	2092	WerFault.exe	58
2676	616	WerFault.exe	53
2664	544	WerFault.exe	50
1604	1844	WerFault.exe	52
2284	2948	WerFault.exe	84
2976	1924	WerFault.exe	77
2080	2480	WerFault.exe	90
1752	236	WerFault.exe	116
2008	3020	WerFault.exe	132
2308	3056	WerFault.exe	71
2056	2580	WerFault.exe	46
660	2244	WerFault.exe	120
3300	2748	WerFault.exe	126
3376	1036	WerFault.exe	111
3364	3064	WerFault.exe	123
3352	2732	WerFault.exe	125
3508	2648	WerFault.exe	103
3500	2084	WerFault.exe	136
3540	2148	WerFault.exe	113
3948	2660	WerFault.exe	73
3800	2484	WerFault.exe	146
3344	2404	WerFault.exe	142
3316	572	WerFault.exe	149
3596	1852	WerFault.exe	150
3164	1760	WerFault.exe	151
3184	3108	WerFault.exe	191
3580	596	WerFault.exe	112
4028	1704	WerFault.exe	63
4004	548	WerFault.exe	121
3920	2916	WerFault.exe	99
3900	808	WerFault.exe	65
4084	1800	WerFault.exe	49
3120	924	WerFault.exe	92
3096	1764	WerFault.exe	93
3076	2808	WerFault.exe	67
3744	2932	WerFault.exe	117
4008	2616	WerFault.exe	157
4116	372	WerFault.exe	153
4124	2876	WerFault.exe	154
4108	2680	WerFault.exe	161
4100	1908	WerFault.exe	89
3564	1476	WerFault.exe	160
3772	2832	WerFault.exe	156
4904	1320	WerFault.exe	79
4912	1100	WerFault.exe	115
5012	2152	WerFault.exe	85
5004	1372	WerFault.exe	76
4992	1272	WerFault.exe	55
5040	2804	WerFault.exe	33
5092	2636	WerFault.exe	69
5084	1468	WerFault.exe	87
5076	2768	WerFault.exe	134
4292	1276	WerFault.exe	119
4560	3412	WerFault.exe	204
5376	1056	WerFault.exe	137
5412	2384	WerFault.exe	135
5512	2328	WerFault.exe	78
5560	2800	WerFault.exe	66
5552	1480	WerFault.exe	54
5544	2844	WerFault.exe	70
5536	2812	WerFault.exe	100
5588	2076	WerFault.exe	164

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17806.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10747.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29377.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27019.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63632.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56659.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31321.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2843.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52781.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62910.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45683.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20732.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5059.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33249.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22840.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11905.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29108.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37322.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16610.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46061.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60010.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9481.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30058.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49025.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20299.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24504.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65349.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42536.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38227.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19642.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-699.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33183.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5729.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19448.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59346.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35272.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13372.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51639.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39574.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41075.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54148.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1615.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49907.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58314.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51983.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61783.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19268.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63144.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43351.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53654.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1846.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9480.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28717.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55147.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28714.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11277.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56788.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11853.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59912.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50913.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21183.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12781.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57539.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5310.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2340	55b87943b36160fc3a1db751c1aa9f515d2b6fd43948d5d02f839afba1ecda71N.exe
1348	Unicorn-9595.exe
2880	Unicorn-4608.exe
2696	Unicorn-46196.exe
2804	Unicorn-36534.exe
2628	Unicorn-4738.exe
2928	Unicorn-64145.exe
2896	Unicorn-46326.exe
2724	Unicorn-24256.exe
3028	Unicorn-46212.exe
1424	Unicorn-13347.exe
636	Unicorn-26346.exe
1304	Unicorn-13082.exe
2024	Unicorn-59019.exe
1264	Unicorn-19469.exe
2424	Unicorn-57525.exe
2580	Unicorn-29299.exe
1028	Unicorn-24469.exe
1616	Unicorn-6086.exe
1800	Unicorn-40805.exe
544	Unicorn-26092.exe
1612	Unicorn-44889.exe
1844	Unicorn-59179.exe
616	Unicorn-65309.exe
1480	Unicorn-24277.exe
316	Unicorn-27598.exe
1272	Unicorn-33249.exe
2092	Unicorn-31328.exe
1244	Unicorn-55278.exe
1652	Unicorn-19866.exe
3048	Unicorn-12252.exe
1732	Unicorn-28911.exe
1704	Unicorn-39117.exe
808	Unicorn-20551.exe
2800	Unicorn-28454.exe
2808	Unicorn-57307.exe
2760	Unicorn-45610.exe
2636	Unicorn-30063.exe
2844	Unicorn-46399.exe
2660	Unicorn-29108.exe
3004	Unicorn-38039.exe
3056	Unicorn-42869.exe
1372	Unicorn-40077.exe
1924	Unicorn-5729.exe
1320	Unicorn-17427.exe
2328	Unicorn-63098.exe
1804	Unicorn-54183.exe
2888	Unicorn-28717.exe
2152	Unicorn-27440.exe
2416	Unicorn-49642.exe
1468	Unicorn-49907.exe
2948	Unicorn-13705.exe
2572	Unicorn-2797.exe
1908	Unicorn-28200.exe
1540	Unicorn-56788.exe
2480	Unicorn-20586.exe
924	Unicorn-62910.exe
1764	Unicorn-60680.exe
2568	Unicorn-64499.exe
1776	Unicorn-27816.exe
1044	Unicorn-45652.exe
2528	Unicorn-53058.exe
748	Unicorn-9258.exe
2916	Unicorn-29124.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2340 wrote to memory of 1348	2340	55b87943b36160fc3a1db751c1aa9f515d2b6fd43948d5d02f839afba1ecda71N.exe	30
PID 2340 wrote to memory of 1348	2340	55b87943b36160fc3a1db751c1aa9f515d2b6fd43948d5d02f839afba1ecda71N.exe	30
PID 2340 wrote to memory of 1348	2340	55b87943b36160fc3a1db751c1aa9f515d2b6fd43948d5d02f839afba1ecda71N.exe	30
PID 2340 wrote to memory of 1348	2340	55b87943b36160fc3a1db751c1aa9f515d2b6fd43948d5d02f839afba1ecda71N.exe	30
PID 1348 wrote to memory of 2880	1348	Unicorn-9595.exe	31
PID 1348 wrote to memory of 2880	1348	Unicorn-9595.exe	31
PID 1348 wrote to memory of 2880	1348	Unicorn-9595.exe	31
PID 1348 wrote to memory of 2880	1348	Unicorn-9595.exe	31
PID 2340 wrote to memory of 2696	2340	55b87943b36160fc3a1db751c1aa9f515d2b6fd43948d5d02f839afba1ecda71N.exe	32
PID 2340 wrote to memory of 2696	2340	55b87943b36160fc3a1db751c1aa9f515d2b6fd43948d5d02f839afba1ecda71N.exe	32
PID 2340 wrote to memory of 2696	2340	55b87943b36160fc3a1db751c1aa9f515d2b6fd43948d5d02f839afba1ecda71N.exe	32
PID 2340 wrote to memory of 2696	2340	55b87943b36160fc3a1db751c1aa9f515d2b6fd43948d5d02f839afba1ecda71N.exe	32
PID 2696 wrote to memory of 2804	2696	Unicorn-46196.exe	33
PID 2696 wrote to memory of 2804	2696	Unicorn-46196.exe	33
PID 2696 wrote to memory of 2804	2696	Unicorn-46196.exe	33
PID 2696 wrote to memory of 2804	2696	Unicorn-46196.exe	33
PID 2340 wrote to memory of 2928	2340	55b87943b36160fc3a1db751c1aa9f515d2b6fd43948d5d02f839afba1ecda71N.exe	34
PID 2340 wrote to memory of 2928	2340	55b87943b36160fc3a1db751c1aa9f515d2b6fd43948d5d02f839afba1ecda71N.exe	34
PID 2340 wrote to memory of 2928	2340	55b87943b36160fc3a1db751c1aa9f515d2b6fd43948d5d02f839afba1ecda71N.exe	34
PID 2340 wrote to memory of 2928	2340	55b87943b36160fc3a1db751c1aa9f515d2b6fd43948d5d02f839afba1ecda71N.exe	34
PID 1348 wrote to memory of 2896	1348	Unicorn-9595.exe	35
PID 1348 wrote to memory of 2896	1348	Unicorn-9595.exe	35
PID 1348 wrote to memory of 2896	1348	Unicorn-9595.exe	35
PID 1348 wrote to memory of 2896	1348	Unicorn-9595.exe	35
PID 2880 wrote to memory of 2628	2880	Unicorn-4608.exe	36
PID 2880 wrote to memory of 2628	2880	Unicorn-4608.exe	36
PID 2880 wrote to memory of 2628	2880	Unicorn-4608.exe	36
PID 2880 wrote to memory of 2628	2880	Unicorn-4608.exe	36
PID 2804 wrote to memory of 2724	2804	Unicorn-36534.exe	37
PID 2804 wrote to memory of 2724	2804	Unicorn-36534.exe	37
PID 2804 wrote to memory of 2724	2804	Unicorn-36534.exe	37
PID 2804 wrote to memory of 2724	2804	Unicorn-36534.exe	37
PID 2628 wrote to memory of 3028	2628	Unicorn-4738.exe	38
PID 2628 wrote to memory of 3028	2628	Unicorn-4738.exe	38
PID 2628 wrote to memory of 3028	2628	Unicorn-4738.exe	38
PID 2628 wrote to memory of 3028	2628	Unicorn-4738.exe	38
PID 2696 wrote to memory of 636	2696	Unicorn-46196.exe	39
PID 2696 wrote to memory of 636	2696	Unicorn-46196.exe	39
PID 2696 wrote to memory of 636	2696	Unicorn-46196.exe	39
PID 2696 wrote to memory of 636	2696	Unicorn-46196.exe	39
PID 2928 wrote to memory of 1424	2928	Unicorn-64145.exe	41
PID 2928 wrote to memory of 1424	2928	Unicorn-64145.exe	41
PID 2928 wrote to memory of 1424	2928	Unicorn-64145.exe	41
PID 2928 wrote to memory of 1424	2928	Unicorn-64145.exe	41
PID 2340 wrote to memory of 1304	2340	55b87943b36160fc3a1db751c1aa9f515d2b6fd43948d5d02f839afba1ecda71N.exe	40
PID 2340 wrote to memory of 1304	2340	55b87943b36160fc3a1db751c1aa9f515d2b6fd43948d5d02f839afba1ecda71N.exe	40
PID 2340 wrote to memory of 1304	2340	55b87943b36160fc3a1db751c1aa9f515d2b6fd43948d5d02f839afba1ecda71N.exe	40
PID 2340 wrote to memory of 1304	2340	55b87943b36160fc3a1db751c1aa9f515d2b6fd43948d5d02f839afba1ecda71N.exe	40
PID 2880 wrote to memory of 2024	2880	Unicorn-4608.exe	42
PID 2880 wrote to memory of 2024	2880	Unicorn-4608.exe	42
PID 2880 wrote to memory of 2024	2880	Unicorn-4608.exe	42
PID 2880 wrote to memory of 2024	2880	Unicorn-4608.exe	42
PID 1348 wrote to memory of 1264	1348	Unicorn-9595.exe	43
PID 1348 wrote to memory of 1264	1348	Unicorn-9595.exe	43
PID 1348 wrote to memory of 1264	1348	Unicorn-9595.exe	43
PID 1348 wrote to memory of 1264	1348	Unicorn-9595.exe	43
PID 2896 wrote to memory of 1316	2896	Unicorn-46326.exe	44
PID 2896 wrote to memory of 1316	2896	Unicorn-46326.exe	44
PID 2896 wrote to memory of 1316	2896	Unicorn-46326.exe	44
PID 2896 wrote to memory of 1316	2896	Unicorn-46326.exe	44
PID 3028 wrote to memory of 2424	3028	Unicorn-46212.exe	45
PID 3028 wrote to memory of 2424	3028	Unicorn-46212.exe	45
PID 3028 wrote to memory of 2424	3028	Unicorn-46212.exe	45
PID 3028 wrote to memory of 2424	3028	Unicorn-46212.exe	45

C:\Users\Admin\AppData\Local\Temp\55b87943b36160fc3a1db751c1aa9f515d2b6fd43948d5d02f839afba1ecda71N.exe
"C:\Users\Admin\AppData\Local\Temp\55b87943b36160fc3a1db751c1aa9f515d2b6fd43948d5d02f839afba1ecda71N.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2340
- C:\Users\Admin\AppData\Local\Temp\Unicorn-9595.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-9595.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1348
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4608.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4608.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4738.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4738.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46212.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57525.exe
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:2424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19866.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28200.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23556.exe
        9⤵
        
        PID:2520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22080.exe
        10⤵
        
        PID:5184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15930.exe
        10⤵
        
        PID:6788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8970.exe
        10⤵
        
        PID:7864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49740.exe
        10⤵
        
        PID:8612
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1908 -s 248
        9⤵
        Program crash
        
        PID:4100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33430.exe
        8⤵
        
        PID:1984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24504.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:6804
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1984 -s 228
        9⤵
        
        PID:7776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62760.exe
        8⤵
        
        PID:4456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20299.exe
        8⤵
        
        PID:6008
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1652 -s 240
        8⤵
        
        PID:6224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20586.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2480
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2480 -s 240
        8⤵
        Program crash
        
        PID:2080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44561.exe
        7⤵
        
        PID:3008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52061.exe
        8⤵
        
        PID:3588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-699.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62146.exe
        8⤵
        
        PID:6324
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3008 -s 216
        8⤵
        
        PID:8012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51796.exe
        7⤵
        
        PID:3972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11634.exe
        7⤵
        
        PID:5936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42810.exe
        7⤵
        
        PID:6328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11277.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33286.exe
        7⤵
        
        PID:9196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12252.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56788.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24324.exe
        8⤵
        
        PID:1052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19268.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:6820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65349.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:7276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57087.exe
        9⤵
        
        PID:9148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29720.exe
        8⤵
        
        PID:4564
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1540 -s 244
        8⤵
        
        PID:5792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45299.exe
        7⤵
        
        PID:276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39314.exe
        8⤵
        
        PID:6276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48411.exe
        8⤵
        
        PID:6332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13547.exe
        8⤵
        
        PID:7328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62952.exe
        8⤵
        
        PID:9184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25640.exe
        7⤵
        
        PID:4932
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3048 -s 248
        7⤵
        
        PID:6032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62910.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5766.exe
        7⤵
        
        PID:2832
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2832 -s 244
        8⤵
        Program crash
        
        PID:3772
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 924 -s 228
        7⤵
        Program crash
        
        PID:3120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50426.exe
        6⤵
        
        PID:2616
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2616 -s 244
        7⤵
        Program crash
        
        PID:4008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43131.exe
        6⤵
        
        PID:3776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60636.exe
        6⤵
        
        PID:5848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59876.exe
        6⤵
        
        PID:6264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55283.exe
        6⤵
        
        PID:8072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27951.exe
        6⤵
        
        PID:9156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29299.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28911.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1732
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1732 -s 200
        7⤵
        Program crash
        
        PID:2684
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2580 -s 248
        6⤵
        Program crash
        
        PID:2056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39117.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60680.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46607.exe
        7⤵
        
        PID:2668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60914.exe
        8⤵
        
        PID:4148
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2668 -s 228
        8⤵
        
        PID:5892
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1764 -s 248
        7⤵
        Program crash
        
        PID:3096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38801.exe
        6⤵
        
        PID:2680
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2680 -s 224
        7⤵
        Program crash
        
        PID:4108
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1704 -s 244
        6⤵
        Program crash
        
        PID:4028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64499.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17806.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49207.exe
        7⤵
        
        PID:3404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56128.exe
        8⤵
        
        PID:7852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52781.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:8896
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2384 -s 248
        7⤵
        Program crash
        
        PID:5412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53654.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18988.exe
        7⤵
        
        PID:8320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52781.exe
        7⤵
        
        PID:9212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12576.exe
        6⤵
        
        PID:5388
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2568 -s 248
        6⤵
        
        PID:6364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4599.exe
        5⤵
        
        PID:1056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5242.exe
        6⤵
        
        PID:3604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18988.exe
        7⤵
        
        PID:8312
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3604 -s 228
        7⤵
        
        PID:8364
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1056 -s 216
        6⤵
        Program crash
        
        PID:5376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8365.exe
        5⤵
        
        PID:3652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21209.exe
        6⤵
        
        PID:8444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25344.exe
        6⤵
        
        PID:8796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26451.exe
        5⤵
        
        PID:5448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63426.exe
        5⤵
        
        PID:5228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-447.exe
        5⤵
        
        PID:7656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55887.exe
        5⤵
        
        PID:8508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59019.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59019.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24469.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57307.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29124.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34848.exe
        8⤵
        
        PID:2620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48662.exe
        9⤵
        
        PID:4176
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2620 -s 248
        9⤵
        
        PID:5904
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2916 -s 248
        8⤵
        Program crash
        
        PID:3920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28578.exe
        7⤵
        
        PID:576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1628.exe
        8⤵
        
        PID:5168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1846.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20267.exe
        8⤵
        
        PID:7508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41691.exe
        8⤵
        
        PID:7876
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 576 -s 244
        8⤵
        
        PID:8988
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2808 -s 244
        7⤵
        Program crash
        
        PID:3076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33762.exe
        6⤵
        Executes dropped EXE
        
        PID:2812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36939.exe
        7⤵
        
        PID:2944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13218.exe
        8⤵
        
        PID:3784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-596.exe
        9⤵
        
        PID:8476
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3784 -s 228
        9⤵
        
        PID:8812
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2944 -s 228
        8⤵
        
        PID:5708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6482.exe
        7⤵
        
        PID:3976
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3976 -s 224
        8⤵
        
        PID:8720
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2812 -s 244
        7⤵
        Program crash
        
        PID:5536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30616.exe
        6⤵
        
        PID:2700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18180.exe
        7⤵
        
        PID:3892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33269.exe
        8⤵
        
        PID:8564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33320.exe
        8⤵
        
        PID:8832
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2700 -s 228
        7⤵
        
        PID:5692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5470.exe
        6⤵
        
        PID:4032
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4032 -s 224
        7⤵
        
        PID:8744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1224.exe
        6⤵
        
        PID:5680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2354.exe
        6⤵
        
        PID:6408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27313.exe
        6⤵
        
        PID:7708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57022.exe
        6⤵
        
        PID:8548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45610.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12595.exe
        6⤵
        
        PID:2744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45875.exe
        7⤵
        
        PID:572
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 572 -s 220
        8⤵
        Program crash
        
        PID:3316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60343.exe
        7⤵
        
        PID:3956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26269.exe
        8⤵
        
        PID:8688
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2744 -s 224
        7⤵
        
        PID:5732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9481.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1852
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1852 -s 220
        7⤵
        Program crash
        
        PID:3596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1525.exe
        6⤵
        
        PID:3292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46838.exe
        6⤵
        
        PID:5504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18889.exe
        6⤵
        
        PID:6540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10247.exe
        6⤵
        
        PID:7732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13016.exe
        6⤵
        
        PID:8500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47306.exe
        5⤵
        
        PID:2860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5574.exe
        6⤵
        
        PID:1476
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1476 -s 244
        7⤵
        Program crash
        
        PID:3564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32195.exe
        6⤵
        
        PID:3680
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2860 -s 244
        6⤵
        
        PID:5800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38859.exe
        5⤵
        
        PID:912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31008.exe
        6⤵
        
        PID:4060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27237.exe
        6⤵
        
        PID:5572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32872.exe
        6⤵
        
        PID:6392
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 912 -s 248
        6⤵
        
        PID:7624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6701.exe
        5⤵
        
        PID:3876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21637.exe
        5⤵
        
        PID:5596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19419.exe
        5⤵
        
        PID:6432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5782.exe
        5⤵
        
        PID:7704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51687.exe
        5⤵
        
        PID:8516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6086.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6086.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20551.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45652.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49767.exe
        7⤵
        
        PID:1760
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1760 -s 224
        8⤵
        Program crash
        
        PID:3164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11308.exe
        7⤵
        
        PID:3328
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1044 -s 224
        7⤵
        
        PID:5784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21349.exe
        6⤵
        
        PID:372
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 372 -s 224
        7⤵
        Program crash
        
        PID:4116
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 808 -s 244
        6⤵
        Program crash
        
        PID:3900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9258.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42310.exe
        6⤵
        
        PID:2084
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2084 -s 240
        7⤵
        Program crash
        
        PID:3500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33404.exe
        6⤵
        
        PID:3936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60928.exe
        7⤵
        
        PID:7296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51499.exe
        7⤵
        
        PID:8948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50913.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4408
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 748 -s 248
        6⤵
        
        PID:6304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57560.exe
        5⤵
        
        PID:1720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13903.exe
        6⤵
        
        PID:3116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46061.exe
        7⤵
        
        PID:8704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22171.exe
        7⤵
        
        PID:8912
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1720 -s 236
        6⤵
        
        PID:5668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34059.exe
        5⤵
        
        PID:3156
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3156 -s 224
        6⤵
        
        PID:8768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38173.exe
        5⤵
        
        PID:5520
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1616 -s 248
        5⤵
        
        PID:6548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28454.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28454.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27816.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6321.exe
        6⤵
        
        PID:1608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60561.exe
        7⤵
        
        PID:3788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30098.exe
        8⤵
        
        PID:7592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64275.exe
        8⤵
        
        PID:7660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65255.exe
        8⤵
        
        PID:8668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57790.exe
        7⤵
        
        PID:4272
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1608 -s 224
        7⤵
        
        PID:5776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54977.exe
        6⤵
        
        PID:3992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33108.exe
        7⤵
        
        PID:7400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30886.exe
        7⤵
        
        PID:9032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50529.exe
        6⤵
        
        PID:4424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39049.exe
        6⤵
        
        PID:6108
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1776 -s 220
        6⤵
        
        PID:968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40700.exe
        5⤵
        
        PID:2508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47728.exe
        6⤵
        
        PID:3632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57405.exe
        7⤵
        
        PID:8328
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2508 -s 228
        6⤵
        
        PID:5768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37322.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3904
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2800 -s 248
        5⤵
        Program crash
        
        PID:5560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53058.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53058.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45683.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14671.exe
        6⤵
        
        PID:4000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60010.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8792
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2440 -s 216
        6⤵
        
        PID:5656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61303.exe
        5⤵
        
        PID:3884
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2528 -s 244
        5⤵
        
        PID:5620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45837.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45837.exe
      4⤵
      PID:2876
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2876 -s 224
        5⤵
        Program crash
        
        PID:4124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43661.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43661.exe
      4⤵
      PID:3248
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2880 -s 248
      4⤵
      PID:5844
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46326.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46326.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2896
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2896 -s 244
      4⤵
      Loads dropped DLL
      Program crash
      PID:1316
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19469.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19469.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65309.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65309.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:616
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 616 -s 220
        5⤵
        Program crash
        
        PID:2676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63098.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63098.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23561.exe
        5⤵
        
        PID:1640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15943.exe
        6⤵
        
        PID:2604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47728.exe
        7⤵
        
        PID:3616
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2604 -s 228
        7⤵
        
        PID:5760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53327.exe
        6⤵
        
        PID:3320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40973.exe
        6⤵
        
        PID:5528
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1640 -s 236
        6⤵
        
        PID:6316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61614.exe
        5⤵
        
        PID:2484
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2484 -s 244
        6⤵
        Program crash
        
        PID:3800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7965.exe
        5⤵
        
        PID:3924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37353.exe
        6⤵
        
        PID:8624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3445.exe
        6⤵
        
        PID:4464
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2328 -s 248
        5⤵
        Program crash
        
        PID:5512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29490.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29490.exe
      4⤵
      PID:2244
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2244 -s 224
        5⤵
        Program crash
        
        PID:660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49715.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49715.exe
      4⤵
      PID:2776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32288.exe
        5⤵
        
        PID:6196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25432.exe
        5⤵
        
        PID:7892
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2776 -s 224
        5⤵
        
        PID:1104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22840.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22840.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4924
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1264 -s 228
      4⤵
      PID:5872
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33249.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33249.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46399.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46399.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38252.exe
        5⤵
        
        PID:1220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59606.exe
        6⤵
        
        PID:2392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46083.exe
        7⤵
        
        PID:3760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29377.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:8416
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3760 -s 228
        8⤵
        
        PID:8644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31321.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5488
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2392 -s 224
        7⤵
        
        PID:6444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50530.exe
        6⤵
        
        PID:3844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29185.exe
        7⤵
        
        PID:8596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4732.exe
        7⤵
        
        PID:8684
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1220 -s 244
        6⤵
        
        PID:5724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17073.exe
        5⤵
        
        PID:2404
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2404 -s 240
        6⤵
        Program crash
        
        PID:3344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37322.exe
        5⤵
        
        PID:3916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51458.exe
        6⤵
        
        PID:8852
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2844 -s 228
        5⤵
        Program crash
        
        PID:5544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27431.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27431.exe
      4⤵
      PID:856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38989.exe
        5⤵
        
        PID:3412
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3412 -s 244
        6⤵
        Program crash
        
        PID:4560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57790.exe
        5⤵
        
        PID:4220
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 856 -s 244
        5⤵
        
        PID:5688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46455.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46455.exe
      4⤵
      PID:3660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54410.exe
        5⤵
        
        PID:7388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16361.exe
        5⤵
        
        PID:7992
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3660 -s 224
        5⤵
        
        PID:8352
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1272 -s 248
      4⤵
      Program crash
      PID:4992
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29108.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29108.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15392.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15392.exe
      4⤵
      PID:2148
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2148 -s 224
        5⤵
        Program crash
        
        PID:3540
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2660 -s 248
      4⤵
      Program crash
      PID:3948
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63632.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63632.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:236
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 236 -s 240
      4⤵
      Program crash
      PID:1752
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12223.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12223.exe
    3⤵
    PID:280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62360.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62360.exe
      4⤵
      PID:6076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45147.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45147.exe
      4⤵
      PID:7252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65234.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65234.exe
      4⤵
      PID:8932
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14455.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14455.exe
    3⤵
    PID:4344
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50835.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50835.exe
    3⤵
    PID:5916
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37210.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37210.exe
    3⤵
    PID:6228
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26413.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26413.exe
    3⤵
    PID:7280
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51752.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51752.exe
    3⤵
    PID:9068
- C:\Users\Admin\AppData\Local\Temp\Unicorn-46196.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-46196.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2696
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36534.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36534.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24256.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24256.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40805.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54183.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31537.exe
        7⤵
        
        PID:548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30956.exe
        8⤵
        
        PID:1484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52554.exe
        9⤵
        
        PID:4396
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1484 -s 248
        9⤵
        
        PID:5928
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 548 -s 248
        8⤵
        Program crash
        
        PID:4004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54946.exe
        7⤵
        
        PID:1544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45310.exe
        8⤵
        
        PID:4624
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1544 -s 248
        8⤵
        
        PID:5884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45931.exe
        7⤵
        
        PID:3692
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1804 -s 236
        7⤵
        
        PID:5464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35983.exe
        6⤵
        
        PID:1960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5548.exe
        7⤵
        
        PID:1556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35277.exe
        8⤵
        
        PID:7256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50513.exe
        8⤵
        
        PID:7604
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1556 -s 224
        8⤵
        
        PID:8284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57790.exe
        7⤵
        
        PID:4216
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1960 -s 240
        7⤵
        
        PID:5384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44343.exe
        6⤵
        
        PID:3108
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3108 -s 224
        7⤵
        Program crash
        
        PID:3184
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1800 -s 248
        6⤵
        Program crash
        
        PID:4084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13705.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2948
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2948 -s 220
        6⤵
        Program crash
        
        PID:2284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17430.exe
        5⤵
        
        PID:2932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48444.exe
        6⤵
        
        PID:1352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56659.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19448.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62146.exe
        7⤵
        
        PID:2488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19412.exe
        7⤵
        
        PID:7248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54287.exe
        7⤵
        
        PID:8980
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2932 -s 228
        6⤵
        Program crash
        
        PID:3744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20358.exe
        5⤵
        
        PID:2764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57539.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62936.exe
        6⤵
        
        PID:7460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61150.exe
        6⤵
        
        PID:8924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35455.exe
        5⤵
        
        PID:4352
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2724 -s 248
        5⤵
        
        PID:5860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26092.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26092.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:544
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 544 -s 220
        5⤵
        Program crash
        
        PID:2664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27440.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27440.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55849.exe
        5⤵
        
        PID:3064
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3064 -s 224
        6⤵
        Program crash
        
        PID:3364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47712.exe
        5⤵
        
        PID:3480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39574.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51639.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62432.exe
        6⤵
        
        PID:8872
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2152 -s 240
        5⤵
        Program crash
        
        PID:5012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61012.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61012.exe
      4⤵
      PID:2732
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2732 -s 224
        5⤵
        Program crash
        
        PID:3352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30058.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30058.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28583.exe
        5⤵
        
        PID:7784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16610.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39080.exe
        5⤵
        
        PID:8836
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2804 -s 236
      4⤵
      Program crash
      PID:5040
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26346.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26346.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44889.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44889.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49907.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15392.exe
        6⤵
        
        PID:1100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56804.exe
        7⤵
        
        PID:2032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65344.exe
        8⤵
        
        PID:6288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13372.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:7768
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2032 -s 224
        8⤵
        
        PID:8288
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1100 -s 248
        7⤵
        Program crash
        
        PID:4912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35075.exe
        6⤵
        
        PID:1008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59781.exe
        7⤵
        
        PID:7284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9480.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7740
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1008 -s 224
        7⤵
        
        PID:8232
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1468 -s 244
        6⤵
        Program crash
        
        PID:5084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52704.exe
        5⤵
        
        PID:1276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26737.exe
        6⤵
        
        PID:3208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8738.exe
        7⤵
        
        PID:7976
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3208 -s 228
        7⤵
        
        PID:8752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57790.exe
        6⤵
        
        PID:4172
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1276 -s 240
        6⤵
        Program crash
        
        PID:4292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41027.exe
        5⤵
        
        PID:3200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4462.exe
        6⤵
        
        PID:7720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35878.exe
        6⤵
        
        PID:8344
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3200 -s 224
        6⤵
        
        PID:8540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11853.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4984
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1612 -s 240
        5⤵
        
        PID:5428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2797.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2797.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12076.exe
        5⤵
        
        PID:2036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64951.exe
        6⤵
        
        PID:2692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22072.exe
        7⤵
        
        PID:4092
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4092 -s 224
        8⤵
        
        PID:8728
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2692 -s 248
        7⤵
        
        PID:5752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3550.exe
        6⤵
        
        PID:3288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46061.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8712
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3288 -s 228
        7⤵
        
        PID:8776
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2036 -s 240
        6⤵
        
        PID:5640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30093.exe
        5⤵
        
        PID:1736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56088.exe
        6⤵
        
        PID:3464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34224.exe
        7⤵
        
        PID:9076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4378.exe
        6⤵
        
        PID:6092
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1736 -s 220
        6⤵
        
        PID:6344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29153.exe
        5⤵
        
        PID:3764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9138.exe
        6⤵
        
        PID:8440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9889.exe
        5⤵
        
        PID:5740
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2572 -s 244
        5⤵
        
        PID:6528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14799.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14799.exe
      4⤵
      PID:308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15767.exe
        5⤵
        
        PID:3268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63144.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7520
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3268 -s 236
        6⤵
        
        PID:9172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47300.exe
        5⤵
        
        PID:5144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15581.exe
        5⤵
        
        PID:6872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26133.exe
        5⤵
        
        PID:7524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33025.exe
        5⤵
        
        PID:7488
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 308 -s 228
        5⤵
        
        PID:9176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28714.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28714.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3035.exe
        5⤵
        
        PID:7800
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3332 -s 228
        5⤵
        
        PID:8424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58235.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58235.exe
      4⤵
      PID:4948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61783.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61783.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17997.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17997.exe
      4⤵
      PID:7464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64241.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64241.exe
      4⤵
      PID:7500
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 636 -s 240
      4⤵
      PID:8940
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59179.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59179.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1844
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1844 -s 244
      4⤵
      Program crash
      PID:1604
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49642.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49642.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55465.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55465.exe
      4⤵
      PID:1948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58314.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26201.exe
        6⤵
        
        PID:7556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5059.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12097.exe
        5⤵
        
        PID:4612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33183.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6052
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1948 -s 236
        5⤵
        
        PID:6252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50509.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50509.exe
      4⤵
      PID:3084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37898.exe
        5⤵
        
        PID:7428
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3084 -s 248
        5⤵
        
        PID:9164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61035.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61035.exe
      4⤵
      PID:5136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21446.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21446.exe
      4⤵
      PID:6892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17467.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17467.exe
      4⤵
      PID:7492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3169.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3169.exe
      4⤵
      PID:7684
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2416 -s 224
      4⤵
      PID:9016
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5310.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5310.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49980.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49980.exe
      4⤵
      PID:784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5344.exe
        5⤵
        
        PID:7180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42536.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7412
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 784 -s 224
        5⤵
        
        PID:8252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57790.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57790.exe
      4⤵
      PID:4204
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1980 -s 244
      4⤵
      PID:5628
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17031.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17031.exe
    3⤵
    PID:1972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-549.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-549.exe
      4⤵
      PID:7432
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58162.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58162.exe
      4⤵
      PID:7796
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1972 -s 224
      4⤵
      PID:8196
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3718.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3718.exe
    3⤵
    PID:5048
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56170.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56170.exe
    3⤵
    PID:5824
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33010.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33010.exe
    3⤵
    PID:6284
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54148.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54148.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:7300
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4415.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4415.exe
    3⤵
    PID:8964
- C:\Users\Admin\AppData\Local\Temp\Unicorn-64145.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-64145.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2928
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13347.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13347.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55278.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55278.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38039.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49160.exe
        6⤵
        
        PID:2648
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2648 -s 240
        7⤵
        Program crash
        
        PID:3508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49933.exe
        6⤵
        
        PID:3852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6683.exe
        7⤵
        
        PID:8032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47960.exe
        7⤵
        
        PID:8784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3042.exe
        7⤵
        
        PID:8864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5988.exe
        6⤵
        
        PID:5064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20299.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59346.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59749.exe
        6⤵
        
        PID:7356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54817.exe
        6⤵
        
        PID:9000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57883.exe
        5⤵
        
        PID:2612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4095.exe
        6⤵
        
        PID:2512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12251.exe
        7⤵
        
        PID:6204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58297.exe
        7⤵
        
        PID:7820
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2512 -s 224
        7⤵
        
        PID:8272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49025.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4428
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2612 -s 244
        6⤵
        
        PID:5676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55142.exe
        5⤵
        
        PID:3012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64960.exe
        6⤵
        
        PID:1728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45853.exe
        6⤵
        
        PID:8028
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3012 -s 224
        6⤵
        
        PID:8340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20732.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4532
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1244 -s 244
        5⤵
        
        PID:5948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5729.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5729.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1924
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1924 -s 224
        5⤵
        Program crash
        
        PID:2976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55147.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55147.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2748
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2748 -s 240
        5⤵
        Program crash
        
        PID:3300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63228.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63228.exe
      4⤵
      PID:3440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21183.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26195.exe
        5⤵
        
        PID:8672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35907.exe
        5⤵
        
        PID:4448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3188.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3188.exe
      4⤵
      PID:4144
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1424 -s 248
      4⤵
      PID:5868
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31328.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31328.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2092
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2092 -s 240
      4⤵
      Program crash
      PID:2644
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40077.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40077.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32497.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32497.exe
      4⤵
      PID:2624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2040.exe
        5⤵
        
        PID:3520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25651.exe
        6⤵
        
        PID:7884
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3520 -s 220
        6⤵
        
        PID:8660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57790.exe
        5⤵
        
        PID:4228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14434.exe
        5⤵
        
        PID:5484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2474.exe
        5⤵
        
        PID:6576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10747.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37751.exe
        5⤵
        
        PID:9048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40695.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40695.exe
      4⤵
      PID:3748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35272.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2843.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8820
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3748 -s 212
        5⤵
        
        PID:8808
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1372 -s 240
      4⤵
      Program crash
      PID:5004
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7343.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7343.exe
    3⤵
    PID:1992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47157.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47157.exe
      4⤵
      PID:3336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8738.exe
        5⤵
        
        PID:7960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50700.exe
        5⤵
        
        PID:8736
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3336 -s 224
        5⤵
        
        PID:4972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57790.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57790.exe
      4⤵
      PID:4188
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1992 -s 244
      4⤵
      PID:5748
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38227.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38227.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44919.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44919.exe
      4⤵
      PID:7812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62604.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62604.exe
      4⤵
      PID:8532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55416.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55416.exe
      4⤵
      PID:8876
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52190.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52190.exe
    3⤵
    PID:4136
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12164.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12164.exe
    3⤵
    PID:5408
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38345.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38345.exe
    3⤵
    PID:6292
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49948.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49948.exe
    3⤵
    PID:8140
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32151.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32151.exe
    3⤵
    PID:4044
- C:\Users\Admin\AppData\Local\Temp\Unicorn-13082.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-13082.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:1304
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24277.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24277.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1480
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30063.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30063.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10156.exe
        5⤵
        
        PID:1036
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1036 -s 244
        6⤵
        Program crash
        
        PID:3376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27291.exe
        5⤵
        
        PID:3236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8738.exe
        6⤵
        
        PID:7968
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3236 -s 228
        6⤵
        
        PID:8760
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2636 -s 244
        5⤵
        Program crash
        
        PID:5092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61064.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61064.exe
      4⤵
      PID:596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51376.exe
        5⤵
        
        PID:2076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12232.exe
        6⤵
        
        PID:3152
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2076 -s 248
        6⤵
        Program crash
        
        PID:5588
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 596 -s 236
        5⤵
        Program crash
        
        PID:3580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8297.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8297.exe
      4⤵
      PID:2828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35284.exe
        5⤵
        
        PID:3860
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2828 -s 228
        5⤵
        
        PID:5580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19642.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19642.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3628
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1480 -s 244
      4⤵
      Program crash
      PID:5552
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42869.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42869.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7608.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7608.exe
      4⤵
      PID:3020
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3020 -s 220
        5⤵
        Program crash
        
        PID:2008
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3056 -s 228
      4⤵
      Program crash
      PID:2308
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3699.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3699.exe
    3⤵
    PID:1328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49207.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49207.exe
      4⤵
      PID:3424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23264.exe
        5⤵
        
        PID:8244
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3424 -s 248
        5⤵
        
        PID:9208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64378.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64378.exe
      4⤵
      PID:5400
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45680.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45680.exe
      4⤵
      PID:6172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47835.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47835.exe
      4⤵
      PID:7336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49798.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49798.exe
      4⤵
      PID:9060
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7717.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7717.exe
    3⤵
    PID:3476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11011.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11011.exe
      4⤵
      PID:8216
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3476 -s 216
      4⤵
      PID:8976
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9776.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9776.exe
    3⤵
    PID:5360
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1304 -s 248
    3⤵
    PID:6552
- C:\Users\Admin\AppData\Local\Temp\Unicorn-27598.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-27598.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:316
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17427.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17427.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55465.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55465.exe
      4⤵
      PID:2640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49705.exe
        5⤵
        
        PID:2248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16336.exe
        6⤵
        
        PID:6880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29708.exe
        6⤵
        
        PID:7792
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2248 -s 224
        6⤵
        
        PID:8360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11905.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4888
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2640 -s 244
        5⤵
        
        PID:5616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30114.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30114.exe
      4⤵
      PID:2096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28204.exe
        5⤵
        
        PID:6200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21348.exe
        5⤵
        
        PID:7932
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2096 -s 224
        5⤵
        
        PID:8308
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1320 -s 240
      4⤵
      Program crash
      PID:4904
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59912.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59912.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57930.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57930.exe
      4⤵
      PID:3132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10971.exe
        5⤵
        
        PID:3496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-804.exe
        6⤵
        
        PID:8652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55826.exe
        5⤵
        
        PID:5700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21689.exe
        5⤵
        
        PID:6480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35448.exe
        5⤵
        
        PID:7632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41075.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51983.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51983.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4024.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4024.exe
      4⤵
      PID:5716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27555.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27555.exe
      4⤵
      PID:6352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26782.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26782.exe
      4⤵
      PID:7640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24539.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24539.exe
      4⤵
      PID:8592
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36232.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36232.exe
    3⤵
    PID:3196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33103.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33103.exe
      4⤵
      PID:7728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43351.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43351.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:9084
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1363.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1363.exe
    3⤵
    PID:5128
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12781.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12781.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6848
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 316 -s 236
    3⤵
    PID:7476
- C:\Users\Admin\AppData\Local\Temp\Unicorn-28717.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-28717.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2888
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7608.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7608.exe
    3⤵
    PID:1744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4261.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4261.exe
      4⤵
      PID:3868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60352.exe
        5⤵
        
        PID:3036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63751.exe
        5⤵
        
        PID:9004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57790.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57790.exe
      4⤵
      PID:4252
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1744 -s 224
      4⤵
      PID:5808
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18028.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18028.exe
    3⤵
    PID:4036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19185.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19185.exe
      4⤵
      PID:7808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30139.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30139.exe
      4⤵
      PID:8620
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22817.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22817.exe
    3⤵
    PID:4576
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2888 -s 236
    3⤵
    PID:6104
- C:\Users\Admin\AppData\Local\Temp\Unicorn-30018.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-30018.exe
  2⤵
  PID:2768
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29861.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29861.exe
    3⤵
    PID:3144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61831.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61831.exe
      4⤵
      PID:7692
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31986.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31986.exe
      4⤵
      PID:8276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-979.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-979.exe
      4⤵
      PID:8484
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2768 -s 216
    3⤵
    - Program crash
    PID:5076
- C:\Users\Admin\AppData\Local\Temp\Unicorn-17226.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-17226.exe
  2⤵
  PID:3220
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4270.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4270.exe
    3⤵
    PID:7756
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42375.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42375.exe
    3⤵
    PID:8376
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27019.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27019.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:8572
- C:\Users\Admin\AppData\Local\Temp\Unicorn-42389.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-42389.exe
  2⤵
  PID:3640
- C:\Users\Admin\AppData\Local\Temp\Unicorn-55035.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-55035.exe
  2⤵
  PID:5568
- C:\Users\Admin\AppData\Local\Temp\Unicorn-9474.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-9474.exe
  2⤵
  PID:6460
- C:\Users\Admin\AppData\Local\Temp\Unicorn-8212.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-8212.exe
  2⤵
  PID:7316
- C:\Users\Admin\AppData\Local\Temp\Unicorn-1615.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-1615.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:9040

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-26346.exe

Filesize
468KB

MD5
d5a36661e65e1259ee3206b700f5cd44

SHA1
ec79660284905827e86caca0233ab981a08f52a7

SHA256
502dd049863799221061c65a33c78006785c92bb3d8ff7260b1123eb1fe8d934

SHA512
2fbfd5e19770e94e0a3098249e54820a65d18619e85b42f6c491a52d82d31a72c5a5d445e49492e03f9c9cfe452f3830e0ef9a7db4b60c371d1565cbc1287ac1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-4599.exe

Filesize
468KB

MD5
768d31cd35dbe26fd1a9e4744a311fb0

SHA1
eb4bbe96b01f4fceddf140f1a1df5a1afc229b95

SHA256
c64d453462d1948ed8efd0caff24ebec5c2d778ce8f7a7ea814b30b3668f6b67

SHA512
cfbf5a34813c6e051a57539bf11f85108a420dda0cce1549c2a9d7c3e69d8776dae75ee6307b05ca825712c1e31838511cc9c4c5642ffdab822a0e3347a675d4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-47960.exe

Filesize
468KB

MD5
35341795ffe56cbb456c82339b8b97dd

SHA1
4fb1ee39a8c211928cca34fb88a5b45b677063ce

SHA256
881645256aac6b2918fa653c45d15d2e0bd9c93bcb0ead36bc28876e6056411b

SHA512
53baa07f786efb849a7d995b1bdb51046da4a7d8922053e96f533f4001c3ad6c59d64d3e6ec11f998fcd7382a4b6a0c0d6865a9d4f77faee6a7b838332cea96b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-57525.exe

Filesize
468KB

MD5
d44acaf6bd8562dcfa7a58a39822ffb7

SHA1
8d57da128abd1ca18b7abe090fe2cc8bd3d43ee3

SHA256
a69e7c8b0ca3fdbf88c96b716906c816cd3ac6e0e50839347b6f4c1219f3b5e5

SHA512
1066e729a5c68bb28736085b9a7b079f0206fa09ae521fbd605057faf23e77c7e60e545235de1736c8983cabbd6f10e7ad23ce973c65d47e8e3b1221931b5568

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-13082.exe

Filesize
468KB

MD5
6547fd0244a48452fc10a7c517631995

SHA1
7b4e9a58aca0f81012a4da90a615f48b77c67624

SHA256
2e72264026bafbe9901849cf1f5f7a423838200cb79298f5966419ef9c720923

SHA512
2e55a9abff97eb7412c8a6001ba4daa183d2b01809b9db6823c9ba497d81946383d39b4f9286241389f818c5637782ded7ac092e7a118741afb10286b628f9bc

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-13347.exe

Filesize
468KB

MD5
f45122b3d95b76a3ee395cb51bba50be

SHA1
d2f484c8fa560c71853fbd3b0cce2c1f3f527634

SHA256
fcd8e3f487db08357b162ffe8e462fff43a9bcdf6b955216067f88c41cfac85c

SHA512
ecca34a5bfc9d50208b43485fd435d0c0f7dfd92d130b83ae06d6d56f70b25fb9737401e08c9f5d41516dbc820e43731df89fc0edcd3fc616fd9d9d2fd8543d1

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-19469.exe

Filesize
468KB

MD5
7ef892376b72672d3af13aa8772e4e76

SHA1
927837c7feb5727fb2864825f57d9f95a812ce7b

SHA256
987e88b106ea54aea80031794b2dc99bb570fd1c2a397ca03b1bc97d3fee352c

SHA512
25b5f5ac1e4889660c075710b69815b365959783de4592f915a5e70efcbd8f1e0149b0280c2776770be5dc49186589be713e6c4312d5afe681374bcd7707ee04

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-24256.exe

Filesize
468KB

MD5
4a8a1e952b581248fdf6859c9ff055bc

SHA1
2e1d7cb32f80322bf130047cd02f91965f7b11f7

SHA256
130e2e406651ace0f4ee85756ae3771d6c27efa1336dcabcb7866023aea91efc

SHA512
01db412c7ef21f688b7c920a5a2d410b11ed4c84765ff798cfae8e2be8281dc9f49498d7f50aec26c66c02f54157e9c1b7c8b4fd54c20dfa72a0278dd98fc4e5

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-24469.exe

Filesize
468KB

MD5
772524132a9ea0a63c7af536ed3db3d9

SHA1
70958f74bce6ef2cb8e63af8a768cfc2bd83401a

SHA256
2b9d61e04c9330982623a14a4ff0473b78ca54c7ca16079e172494f12342405c

SHA512
b6c5fdeb3866b611e92433542b0ab7b81c154006a25f92ca286bf227fcaa22f7c4270edac0b3d0979074e0cbdd15799c438ed2ea97210922139cdb432f706f70

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-29299.exe

Filesize
468KB

MD5
e855bf4c5d11d67f1a71a7e0c324868b

SHA1
2db06a6c0bfae1c7cf2bcc2a2c667b70f79cd5b0

SHA256
c8e473ef376cf4cbc5c194cdb085c87c33a3f8028adcd5a5e439e0c5c52479a0

SHA512
7f9732f3bbcac439a2a1cd98504d4db4272a04c089ff2a805aefe48971d06a306ee8c154878e3112d6dbab78bb52c6962c29b8da8cbcbfd1ba7825eb7fd1ecf2

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-36534.exe

Filesize
468KB

MD5
46f9b72098fd8ccc480f968ac9ca7cef

SHA1
05d72d46d10f6f2ac7a75dc823d87c3460519410

SHA256
5001a33be65214dde6653fff483493868e1de7965e20e8105bced40e6439940b

SHA512
f4f414aab06ade10df273794e7d135855437a50a2fb1134886e033c43cb780e409b06a9733087da121ea7ee6a775dac262660b7c6fcd4b7747ac33a92103cef1

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-4608.exe

Filesize
468KB

MD5
337b5b91b49e85d337394e60a9ba271c

SHA1
2e730369b54a87ff26f72e33d0a4aac0fb48ec6a

SHA256
191f00a9f4fd55eabd7de0c38bd4c6ccdb93add3392bb1ac6432741219e29831

SHA512
acb6d23e357191552122d00cf57c606f4d511aabca3b98efda033d8ee758a49a7a21b105d7d5dbb74134fd970b9cdc8d3bf87315acb2b22db4dd9f4d97ef0942

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-46196.exe

Filesize
468KB

MD5
467d81be7d191799394752eff4b9db5f

SHA1
b987e29e8a8d9780d864b0d2d1721ad64ba5040d

SHA256
e27ee9c6f7aacac68aa45c98eec3c1078e395505c21acf3e409c5778edf4667c

SHA512
e1dfa5fb21cb56bb29485879c258c32ddc83d94d134754d759b61385af650e8dc5f415f7e6677fe314ff7a163095ba467a5ec52fd327c359821d5e581425f80f

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-46212.exe

Filesize
468KB

MD5
d404e26556bcae142150ed4f50e3be08

SHA1
e3c76204c543c9723eb4a60be09b72df3fbb19ce

SHA256
4d28c7fefc9bccaf8628b4fd68129062874c16e2a2f808bfd298bce21d846b79

SHA512
72a0810a54e02a3a6304318794a876aa026ccc448179fe68b4729ad26ac73bddd03a7433f7f29d9dac089612fa9d0389b314e0c973a31010180b229f143d80b3

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-46326.exe

Filesize
468KB

MD5
bcf4a13937b118c24e5557f689b62271

SHA1
b643aedaa504eb3b44e1b756d13d16d7395d801a

SHA256
21eae355d14710544eb735bf0e557ec90845350a9c43f65be562917ea7f583db

SHA512
2a6ec23a62397bd3c125ca6a5de821bc4598e1209203ced896e00ec1bdf91a994108530f35ac2d47429a23cfa52292e3b75db495d191ce68d088a1603396d818

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-4738.exe

Filesize
468KB

MD5
e06e134c8df01d400af102cfcf268199

SHA1
cefa777d12d8106d6b327498274e414680bf5970

SHA256
2af417fefeb32bd5e36ba536fdc0c77a958ad14d40f835d162bc6cc607264863

SHA512
ec2990e897ecb2f71d035bc835ccd6b069ef65e061c6f18bfdc1069c7edae8a6ce061088d77bbe29e65e09e63834399f464727fd62539a6160808b2702ec2855

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-59019.exe

Filesize
468KB

MD5
258e852a448e1ff9b77c67c1751859ca

SHA1
d1fa2cba8c52a3eaba527d401e649d4d6e4a7e89

SHA256
41bd7497cb6f9e8113cd47acd00a0f42f32d6f8fa9c80340d58116b85bb5a16d

SHA512
0030a48577d5f64cce5a77aeae0d5459b792f43f2fcc2cc6a021d68ca5069b76fb2a13fcf12c88b822fe542372853a30b6740009105e33abaaed2fb3e3c57bfe

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-64145.exe

Filesize
468KB

MD5
a7493af65cc65d31b98e0b10caba0e79

SHA1
275b1686aa042561fefc4a2df0b605c77d41855a

SHA256
be9a3ac96669c0754e3adc537a5f61ea096ddd2b0b42f208324dd23c5a62e4e2

SHA512
98160ca1c9432b5600bdd9df84fdb2dfbe4217b94f0a89f3f1ffd2f4bccd26e98d41cccd9d05c79bd921d9f757deb6c15c6ee84097bc38381b0e7bf8b6f6d439

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-9595.exe

Filesize
468KB

MD5
a9cf3c8cb36d0e89cce63fb183b98490

SHA1
0ac3cf74f33cbe49a3ed993ca5dad577b9333ba7

SHA256
2a465a9ba4e68d42e444e6972fb13e27e4820ebe4597e3a3c0e4beb767d80379

SHA512
110032c6bc46fb6c91b60002abd4f7f882a7d2a63041ccdde80a427bb883d8b09729cbdb22f807e4ae9b495f7eb2dff5f605e079dba51c52476a58aae9c3bf5f

Download Submit