9ce77626325b516f8447adacd8632c6c9e4efc8e134ddf99f1a506e8e8cc07ce

Analysis

max time kernel
120s
max time network
17s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
03/10/2024, 20:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9ce77626325b516f8447adacd8632c6c9e4efc8e134ddf99f1a506e8e8cc07ceN.exe
Size

468KB
MD5

42e2ad63835b4059581c66948c57a8d0
SHA1

35ee8c682318a802df0a7fbd3da559e4c92bf73b
SHA256

9ce77626325b516f8447adacd8632c6c9e4efc8e134ddf99f1a506e8e8cc07ce
SHA512

0d72479962bf132ebe609941f1dfc58fdea301bc48f6df9bedcf8a5869897517147b4540e320c1fbd7f0b0a12859ff4dd2434b92e7d2f6044ce4b1363fa2e164
SSDEEP

3072:1G3HogISIE5TtbYjHzcOcf8/zCcap0pkJVHeTV7yK6eLW7sgUqlh:1G3obMTtgH4OcfjY1IK6gksgU

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
1996	Unicorn-21948.exe
2376	Unicorn-20603.exe
660	Unicorn-5658.exe
1112	Unicorn-27231.exe
2780	Unicorn-62041.exe
2776	Unicorn-33352.exe
2672	Unicorn-19617.exe
2600	Unicorn-33344.exe
1604	Unicorn-27868.exe
1476	Unicorn-51818.exe
2312	Unicorn-5310.exe
1908	Unicorn-25176.exe
2992	Unicorn-56570.exe
2952	Unicorn-15372.exe
3040	Unicorn-62700.exe
1352	Unicorn-60069.exe
2840	Unicorn-46426.exe
2200	Unicorn-46447.exe
2500	Unicorn-25926.exe
2388	Unicorn-40225.exe
736	Unicorn-50339.exe
524	Unicorn-61200.exe
2084	Unicorn-19613.exe
1400	Unicorn-23697.exe
776	Unicorn-14766.exe
276	Unicorn-44864.exe
1892	Unicorn-3276.exe
2252	Unicorn-62683.exe
2228	Unicorn-11179.exe
2492	Unicorn-11444.exe
1740	Unicorn-32419.exe
1492	Unicorn-59851.exe
1592	Unicorn-8604.exe
1568	Unicorn-50292.exe
1688	Unicorn-14734.exe
1588	Unicorn-4620.exe
2892	Unicorn-37847.exe
828	Unicorn-20765.exe
2864	Unicorn-20499.exe
2696	Unicorn-344.exe
2664	Unicorn-60214.exe
2712	Unicorn-61605.exe
2924	Unicorn-25403.exe
1916	Unicorn-45269.exe
1192	Unicorn-40369.exe
2516	Unicorn-60235.exe
916	Unicorn-43899.exe
1712	Unicorn-37769.exe
2964	Unicorn-42315.exe
2948	Unicorn-52622.exe
2384	Unicorn-4904.exe
1992	Unicorn-11034.exe
1764	Unicorn-1697.exe
2764	Unicorn-728.exe
1844	Unicorn-728.exe
332	Unicorn-59633.exe
2128	Unicorn-50968.exe
1292	Unicorn-59898.exe
2428	Unicorn-34432.exe
588	Unicorn-40032.exe
2072	Unicorn-8751.exe
968	Unicorn-7168.exe
2016	Unicorn-61844.exe
860	Unicorn-20546.exe

Loads dropped DLL 64 IoCs

pid	Process
964	9ce77626325b516f8447adacd8632c6c9e4efc8e134ddf99f1a506e8e8cc07ceN.exe
964	9ce77626325b516f8447adacd8632c6c9e4efc8e134ddf99f1a506e8e8cc07ceN.exe
964	9ce77626325b516f8447adacd8632c6c9e4efc8e134ddf99f1a506e8e8cc07ceN.exe
1996	Unicorn-21948.exe
964	9ce77626325b516f8447adacd8632c6c9e4efc8e134ddf99f1a506e8e8cc07ceN.exe
1996	Unicorn-21948.exe
2376	Unicorn-20603.exe
660	Unicorn-5658.exe
2376	Unicorn-20603.exe
660	Unicorn-5658.exe
964	9ce77626325b516f8447adacd8632c6c9e4efc8e134ddf99f1a506e8e8cc07ceN.exe
964	9ce77626325b516f8447adacd8632c6c9e4efc8e134ddf99f1a506e8e8cc07ceN.exe
1996	Unicorn-21948.exe
1996	Unicorn-21948.exe
2780	Unicorn-62041.exe
2780	Unicorn-62041.exe
660	Unicorn-5658.exe
660	Unicorn-5658.exe
1112	Unicorn-27231.exe
1112	Unicorn-27231.exe
2376	Unicorn-20603.exe
2672	Unicorn-19617.exe
2672	Unicorn-19617.exe
2376	Unicorn-20603.exe
1996	Unicorn-21948.exe
964	9ce77626325b516f8447adacd8632c6c9e4efc8e134ddf99f1a506e8e8cc07ceN.exe
1996	Unicorn-21948.exe
2776	Unicorn-33352.exe
2776	Unicorn-33352.exe
964	9ce77626325b516f8447adacd8632c6c9e4efc8e134ddf99f1a506e8e8cc07ceN.exe
2600	Unicorn-33344.exe
2600	Unicorn-33344.exe
2780	Unicorn-62041.exe
2780	Unicorn-62041.exe
1604	Unicorn-27868.exe
1604	Unicorn-27868.exe
660	Unicorn-5658.exe
660	Unicorn-5658.exe
3040	Unicorn-62700.exe
3040	Unicorn-62700.exe
2776	Unicorn-33352.exe
2952	Unicorn-15372.exe
2776	Unicorn-33352.exe
2952	Unicorn-15372.exe
1908	Unicorn-25176.exe
1908	Unicorn-25176.exe
2312	Unicorn-5310.exe
2312	Unicorn-5310.exe
964	9ce77626325b516f8447adacd8632c6c9e4efc8e134ddf99f1a506e8e8cc07ceN.exe
964	9ce77626325b516f8447adacd8632c6c9e4efc8e134ddf99f1a506e8e8cc07ceN.exe
2672	Unicorn-19617.exe
2672	Unicorn-19617.exe
2376	Unicorn-20603.exe
2992	Unicorn-56570.exe
2992	Unicorn-56570.exe
2376	Unicorn-20603.exe
1996	Unicorn-21948.exe
1996	Unicorn-21948.exe
1476	Unicorn-51818.exe
1476	Unicorn-51818.exe
1112	Unicorn-27231.exe
1112	Unicorn-27231.exe
1352	Unicorn-60069.exe
1352	Unicorn-60069.exe

Program crash 64 IoCs

pid	pid_target	Process	procid_target
2204	1400	WerFault.exe	53
2724	2492	WerFault.exe	59
2148	1352	WerFault.exe	45
2552	2228	WerFault.exe	58
1168	2252	WerFault.exe	56
448	1764	WerFault.exe	84
2820	2372	WerFault.exe	101
1148	332	WerFault.exe	89
2688	1292	WerFault.exe	90
2364	524	WerFault.exe	50
2504	684	WerFault.exe	115
1864	588	WerFault.exe	94
1964	2516	WerFault.exe	75
2308	2916	WerFault.exe	102
2836	2748	WerFault.exe	138
3556	2960	WerFault.exe	109
3796	1488	WerFault.exe	123
3840	2856	WerFault.exe	135
3076	2912	WerFault.exe	125
3224	2948	WerFault.exe	81
3240	1688	WerFault.exe	64
3288	1992	WerFault.exe	83
3344	2084	WerFault.exe	52
3376	2128	WerFault.exe	88
3296	2384	WerFault.exe	82
3276	2964	WerFault.exe	80
3280	860	WerFault.exe	99
3496	2136	WerFault.exe	137
3484	2700	WerFault.exe	144
3476	340	WerFault.exe	120
3452	1316	WerFault.exe	132
3444	920	WerFault.exe	131
3236	1192	WerFault.exe	74
3916	2664	WerFault.exe	70
3888	3040	WerFault.exe	44
3924	2924	WerFault.exe	73
3524	276	WerFault.exe	55
4600	828	WerFault.exe	67
4324	1932	WerFault.exe	174
4860	1604	WerFault.exe	38
5000	1968	WerFault.exe	169
5044	932	WerFault.exe	108
5024	2636	WerFault.exe	114
4988	1000	WerFault.exe	173
4972	2160	WerFault.exe	163
4952	3060	WerFault.exe	159
4948	2864	WerFault.exe	68
4100	1468	WerFault.exe	121
4752	2860	WerFault.exe	124
4724	2544	WerFault.exe	142
4932	2376	WerFault.exe	31
4540	1796	WerFault.exe	107
4260	1496	WerFault.exe	122
4692	1652	WerFault.exe	100
3340	2072	WerFault.exe	95
5208	1892	WerFault.exe	57
5200	1008	WerFault.exe	139
5404	2052	WerFault.exe	149
5392	280	WerFault.exe	130
5380	2016	WerFault.exe	97
5456	1916	WerFault.exe	72
5480	2832	WerFault.exe	105
5488	968	WerFault.exe	96
5464	2892	WerFault.exe	66

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16047.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1521.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37505.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64677.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53479.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20499.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6125.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45729.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40369.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62975.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27644.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33010.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51187.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-311.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28134.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9269.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62398.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23801.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18356.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22958.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11179.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43899.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15300.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48820.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45862.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57670.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32225.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44408.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56141.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40982.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54468.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54189.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52195.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62700.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25926.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40032.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4345.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33352.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4048.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33095.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34121.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12491.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15544.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32862.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33612.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21948.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61605.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37240.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59362.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44864.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-531.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3276.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44086.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43339.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11789.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4620.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42380.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41791.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11844.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61164.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57130.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29912.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54994.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20452.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
964	9ce77626325b516f8447adacd8632c6c9e4efc8e134ddf99f1a506e8e8cc07ceN.exe
1996	Unicorn-21948.exe
2376	Unicorn-20603.exe
660	Unicorn-5658.exe
2780	Unicorn-62041.exe
1112	Unicorn-27231.exe
2776	Unicorn-33352.exe
2672	Unicorn-19617.exe
2600	Unicorn-33344.exe
1604	Unicorn-27868.exe
3040	Unicorn-62700.exe
1476	Unicorn-51818.exe
2312	Unicorn-5310.exe
1908	Unicorn-25176.exe
2992	Unicorn-56570.exe
2952	Unicorn-15372.exe
2840	Unicorn-46426.exe
1352	Unicorn-60069.exe
2200	Unicorn-46447.exe
2500	Unicorn-25926.exe
2388	Unicorn-40225.exe
524	Unicorn-61200.exe
736	Unicorn-50339.exe
2084	Unicorn-19613.exe
1400	Unicorn-23697.exe
776	Unicorn-14766.exe
276	Unicorn-44864.exe
2228	Unicorn-11179.exe
2492	Unicorn-11444.exe
2252	Unicorn-62683.exe
1892	Unicorn-3276.exe
1740	Unicorn-32419.exe
1492	Unicorn-59851.exe
1568	Unicorn-50292.exe
1592	Unicorn-8604.exe
1688	Unicorn-14734.exe
1588	Unicorn-4620.exe
2892	Unicorn-37847.exe
2864	Unicorn-20499.exe
828	Unicorn-20765.exe
2696	Unicorn-344.exe
2664	Unicorn-60214.exe
2712	Unicorn-61605.exe
1916	Unicorn-45269.exe
2924	Unicorn-25403.exe
1192	Unicorn-40369.exe
2516	Unicorn-60235.exe
916	Unicorn-43899.exe
1712	Unicorn-37769.exe
2948	Unicorn-52622.exe
2964	Unicorn-42315.exe
2384	Unicorn-4904.exe
1992	Unicorn-11034.exe
1764	Unicorn-1697.exe
2764	Unicorn-728.exe
1844	Unicorn-728.exe
2428	Unicorn-34432.exe
1292	Unicorn-59898.exe
332	Unicorn-59633.exe
588	Unicorn-40032.exe
2128	Unicorn-50968.exe
2072	Unicorn-8751.exe
968	Unicorn-7168.exe
2016	Unicorn-61844.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 964 wrote to memory of 1996	964	9ce77626325b516f8447adacd8632c6c9e4efc8e134ddf99f1a506e8e8cc07ceN.exe	30
PID 964 wrote to memory of 1996	964	9ce77626325b516f8447adacd8632c6c9e4efc8e134ddf99f1a506e8e8cc07ceN.exe	30
PID 964 wrote to memory of 1996	964	9ce77626325b516f8447adacd8632c6c9e4efc8e134ddf99f1a506e8e8cc07ceN.exe	30
PID 964 wrote to memory of 1996	964	9ce77626325b516f8447adacd8632c6c9e4efc8e134ddf99f1a506e8e8cc07ceN.exe	30
PID 964 wrote to memory of 2376	964	9ce77626325b516f8447adacd8632c6c9e4efc8e134ddf99f1a506e8e8cc07ceN.exe	31
PID 964 wrote to memory of 2376	964	9ce77626325b516f8447adacd8632c6c9e4efc8e134ddf99f1a506e8e8cc07ceN.exe	31
PID 964 wrote to memory of 2376	964	9ce77626325b516f8447adacd8632c6c9e4efc8e134ddf99f1a506e8e8cc07ceN.exe	31
PID 964 wrote to memory of 2376	964	9ce77626325b516f8447adacd8632c6c9e4efc8e134ddf99f1a506e8e8cc07ceN.exe	31
PID 1996 wrote to memory of 660	1996	Unicorn-21948.exe	32
PID 1996 wrote to memory of 660	1996	Unicorn-21948.exe	32
PID 1996 wrote to memory of 660	1996	Unicorn-21948.exe	32
PID 1996 wrote to memory of 660	1996	Unicorn-21948.exe	32
PID 2376 wrote to memory of 1112	2376	Unicorn-20603.exe	33
PID 2376 wrote to memory of 1112	2376	Unicorn-20603.exe	33
PID 2376 wrote to memory of 1112	2376	Unicorn-20603.exe	33
PID 2376 wrote to memory of 1112	2376	Unicorn-20603.exe	33
PID 660 wrote to memory of 2780	660	Unicorn-5658.exe	34
PID 660 wrote to memory of 2780	660	Unicorn-5658.exe	34
PID 660 wrote to memory of 2780	660	Unicorn-5658.exe	34
PID 660 wrote to memory of 2780	660	Unicorn-5658.exe	34
PID 964 wrote to memory of 2776	964	9ce77626325b516f8447adacd8632c6c9e4efc8e134ddf99f1a506e8e8cc07ceN.exe	35
PID 964 wrote to memory of 2776	964	9ce77626325b516f8447adacd8632c6c9e4efc8e134ddf99f1a506e8e8cc07ceN.exe	35
PID 964 wrote to memory of 2776	964	9ce77626325b516f8447adacd8632c6c9e4efc8e134ddf99f1a506e8e8cc07ceN.exe	35
PID 964 wrote to memory of 2776	964	9ce77626325b516f8447adacd8632c6c9e4efc8e134ddf99f1a506e8e8cc07ceN.exe	35
PID 1996 wrote to memory of 2672	1996	Unicorn-21948.exe	36
PID 1996 wrote to memory of 2672	1996	Unicorn-21948.exe	36
PID 1996 wrote to memory of 2672	1996	Unicorn-21948.exe	36
PID 1996 wrote to memory of 2672	1996	Unicorn-21948.exe	36
PID 2780 wrote to memory of 2600	2780	Unicorn-62041.exe	37
PID 2780 wrote to memory of 2600	2780	Unicorn-62041.exe	37
PID 2780 wrote to memory of 2600	2780	Unicorn-62041.exe	37
PID 2780 wrote to memory of 2600	2780	Unicorn-62041.exe	37
PID 660 wrote to memory of 1604	660	Unicorn-5658.exe	38
PID 660 wrote to memory of 1604	660	Unicorn-5658.exe	38
PID 660 wrote to memory of 1604	660	Unicorn-5658.exe	38
PID 660 wrote to memory of 1604	660	Unicorn-5658.exe	38
PID 1112 wrote to memory of 1476	1112	Unicorn-27231.exe	39
PID 1112 wrote to memory of 1476	1112	Unicorn-27231.exe	39
PID 1112 wrote to memory of 1476	1112	Unicorn-27231.exe	39
PID 1112 wrote to memory of 1476	1112	Unicorn-27231.exe	39
PID 2672 wrote to memory of 1908	2672	Unicorn-19617.exe	41
PID 2672 wrote to memory of 1908	2672	Unicorn-19617.exe	41
PID 2672 wrote to memory of 1908	2672	Unicorn-19617.exe	41
PID 2672 wrote to memory of 1908	2672	Unicorn-19617.exe	41
PID 2376 wrote to memory of 2312	2376	Unicorn-20603.exe	40
PID 2376 wrote to memory of 2312	2376	Unicorn-20603.exe	40
PID 2376 wrote to memory of 2312	2376	Unicorn-20603.exe	40
PID 2376 wrote to memory of 2312	2376	Unicorn-20603.exe	40
PID 1996 wrote to memory of 2992	1996	Unicorn-21948.exe	42
PID 1996 wrote to memory of 2992	1996	Unicorn-21948.exe	42
PID 1996 wrote to memory of 2992	1996	Unicorn-21948.exe	42
PID 1996 wrote to memory of 2992	1996	Unicorn-21948.exe	42
PID 2776 wrote to memory of 3040	2776	Unicorn-33352.exe	44
PID 2776 wrote to memory of 3040	2776	Unicorn-33352.exe	44
PID 2776 wrote to memory of 3040	2776	Unicorn-33352.exe	44
PID 2776 wrote to memory of 3040	2776	Unicorn-33352.exe	44
PID 964 wrote to memory of 2952	964	9ce77626325b516f8447adacd8632c6c9e4efc8e134ddf99f1a506e8e8cc07ceN.exe	43
PID 964 wrote to memory of 2952	964	9ce77626325b516f8447adacd8632c6c9e4efc8e134ddf99f1a506e8e8cc07ceN.exe	43
PID 964 wrote to memory of 2952	964	9ce77626325b516f8447adacd8632c6c9e4efc8e134ddf99f1a506e8e8cc07ceN.exe	43
PID 964 wrote to memory of 2952	964	9ce77626325b516f8447adacd8632c6c9e4efc8e134ddf99f1a506e8e8cc07ceN.exe	43
PID 2600 wrote to memory of 1352	2600	Unicorn-33344.exe	45
PID 2600 wrote to memory of 1352	2600	Unicorn-33344.exe	45
PID 2600 wrote to memory of 1352	2600	Unicorn-33344.exe	45
PID 2600 wrote to memory of 1352	2600	Unicorn-33344.exe	45

C:\Users\Admin\AppData\Local\Temp\9ce77626325b516f8447adacd8632c6c9e4efc8e134ddf99f1a506e8e8cc07ceN.exe
"C:\Users\Admin\AppData\Local\Temp\9ce77626325b516f8447adacd8632c6c9e4efc8e134ddf99f1a506e8e8cc07ceN.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:964
- C:\Users\Admin\AppData\Local\Temp\Unicorn-21948.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-21948.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1996
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5658.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5658.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62041.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62041.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33344.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60069.exe
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:1352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59851.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59898.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1292
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1292 -s 220
        9⤵
        Program crash
        
        PID:2688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64293.exe
        8⤵
        
        PID:2120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58362.exe
        9⤵
        
        PID:4844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18756.exe
        9⤵
        
        PID:5796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46384.exe
        9⤵
        
        PID:6924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46009.exe
        9⤵
        
        PID:7604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43561.exe
        9⤵
        
        PID:8560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6648.exe
        8⤵
        
        PID:3736
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1492 -s 248
        8⤵
        
        PID:5432
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1352 -s 236
        7⤵
        Program crash
        
        PID:2148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50292.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20812.exe
        7⤵
        
        PID:2512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18622.exe
        8⤵
        
        PID:2244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51310.exe
        9⤵
        
        PID:4980
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2244 -s 228
        9⤵
        
        PID:5152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27723.exe
        8⤵
        
        PID:3628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5849.exe
        8⤵
        
        PID:5692
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2512 -s 248
        8⤵
        
        PID:6840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62155.exe
        7⤵
        
        PID:3068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25498.exe
        8⤵
        
        PID:5008
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3068 -s 216
        8⤵
        
        PID:5876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31152.exe
        7⤵
        
        PID:3784
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1568 -s 248
        7⤵
        
        PID:5608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37240.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54994.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35996.exe
        8⤵
        
        PID:4808
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3008 -s 228
        8⤵
        
        PID:5544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55928.exe
        7⤵
        
        PID:3516
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1652 -s 240
        7⤵
        Program crash
        
        PID:4692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18356.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2160
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2160 -s 220
        7⤵
        Program crash
        
        PID:4972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3848.exe
        6⤵
        
        PID:3580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52051.exe
        6⤵
        
        PID:5660
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2600 -s 244
        6⤵
        
        PID:6896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46426.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4620.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8751.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24460.exe
        8⤵
        
        PID:2152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10640.exe
        9⤵
        
        PID:3192
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2152 -s 248
        9⤵
        
        PID:5528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2835.exe
        8⤵
        
        PID:3848
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2072 -s 240
        8⤵
        Program crash
        
        PID:3340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2456.exe
        7⤵
        
        PID:1884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41450.exe
        8⤵
        
        PID:4712
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1884 -s 228
        8⤵
        
        PID:5568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16570.exe
        7⤵
        
        PID:3832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31668.exe
        7⤵
        
        PID:4384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14720.exe
        7⤵
        
        PID:7088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11789.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29042.exe
        7⤵
        
        PID:7648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7168.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55762.exe
        7⤵
        
        PID:1272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27190.exe
        8⤵
        
        PID:4512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7978.exe
        8⤵
        
        PID:6644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21996.exe
        8⤵
        
        PID:7440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42475.exe
        8⤵
        
        PID:7652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21885.exe
        7⤵
        
        PID:4244
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 968 -s 244
        7⤵
        Program crash
        
        PID:5488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29787.exe
        6⤵
        
        PID:1380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63562.exe
        7⤵
        
        PID:4288
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1380 -s 228
        7⤵
        
        PID:6112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55876.exe
        6⤵
        
        PID:4276
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2840 -s 244
        6⤵
        
        PID:5624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8604.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61844.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-531.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17906.exe
        8⤵
        
        PID:4268
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2816 -s 228
        8⤵
        
        PID:1928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9825.exe
        7⤵
        
        PID:4124
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2016 -s 220
        7⤵
        Program crash
        
        PID:5380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64677.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40272.exe
        7⤵
        
        PID:4544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6826.exe
        7⤵
        
        PID:6048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53457.exe
        7⤵
        
        PID:7192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58536.exe
        7⤵
        
        PID:7808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6223.exe
        7⤵
        
        PID:7636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64401.exe
        6⤵
        
        PID:4172
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1592 -s 248
        6⤵
        
        PID:5448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20546.exe
        5⤵
        Executes dropped EXE
        
        PID:860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22047.exe
        6⤵
        
        PID:1468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40625.exe
        7⤵
        
        PID:4004
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1468 -s 228
        7⤵
        Program crash
        
        PID:4100
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 860 -s 248
        6⤵
        Program crash
        
        PID:3280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53957.exe
        5⤵
        
        PID:2860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44408.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3164
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2860 -s 248
        6⤵
        Program crash
        
        PID:4752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47722.exe
        5⤵
        
        PID:3368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30741.exe
        5⤵
        
        PID:4852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51005.exe
        5⤵
        
        PID:6672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35839.exe
        5⤵
        
        PID:7488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40262.exe
        5⤵
        
        PID:7848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27868.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27868.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:1604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46447.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14734.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23526.exe
        7⤵
        
        PID:2372
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2372 -s 240
        8⤵
        Program crash
        
        PID:2820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41459.exe
        7⤵
        
        PID:680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4143.exe
        8⤵
        
        PID:3896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58938.exe
        8⤵
        
        PID:4728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1677.exe
        8⤵
        
        PID:6900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9963.exe
        8⤵
        
        PID:7800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11791.exe
        8⤵
        
        PID:7332
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1688 -s 240
        7⤵
        Program crash
        
        PID:3240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1522.exe
        6⤵
        
        PID:2908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33723.exe
        7⤵
        
        PID:2636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3484.exe
        8⤵
        
        PID:3660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-856.exe
        9⤵
        
        PID:7868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-311.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:8940
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2636 -s 228
        8⤵
        Program crash
        
        PID:5024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26597.exe
        7⤵
        
        PID:3768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33612.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:7976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45180.exe
        7⤵
        
        PID:4864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26427.exe
        7⤵
        
        PID:5188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50657.exe
        7⤵
        
        PID:7232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33335.exe
        7⤵
        
        PID:7776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6753.exe
        7⤵
        
        PID:8220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41791.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15544.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19383.exe
        8⤵
        
        PID:7412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48941.exe
        8⤵
        
        PID:1392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26052.exe
        7⤵
        
        PID:4196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47204.exe
        7⤵
        
        PID:5932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49208.exe
        7⤵
        
        PID:2560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4946.exe
        7⤵
        
        PID:7572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55225.exe
        7⤵
        
        PID:8204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-697.exe
        6⤵
        
        PID:3436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64582.exe
        7⤵
        
        PID:8072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52195.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51762.exe
        6⤵
        
        PID:4456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1226.exe
        6⤵
        
        PID:5196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51187.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28870.exe
        6⤵
        
        PID:7676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45424.exe
        6⤵
        
        PID:9172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37847.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4558.exe
        6⤵
        
        PID:2832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9275.exe
        7⤵
        
        PID:2944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8284.exe
        8⤵
        
        PID:4744
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2944 -s 228
        8⤵
        
        PID:5560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6125.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4440
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2832 -s 224
        7⤵
        Program crash
        
        PID:5480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62430.exe
        6⤵
        
        PID:3112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51149.exe
        7⤵
        
        PID:5284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40982.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34580.exe
        7⤵
        
        PID:7428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55791.exe
        7⤵
        
        PID:8980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36389.exe
        6⤵
        
        PID:4620
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2892 -s 248
        6⤵
        Program crash
        
        PID:5464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47629.exe
        5⤵
        
        PID:944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11844.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64172.exe
        7⤵
        
        PID:7352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13959.exe
        7⤵
        
        PID:8384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34604.exe
        6⤵
        
        PID:4596
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 944 -s 224
        6⤵
        
        PID:4144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29862.exe
        5⤵
        
        PID:3600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2610.exe
        6⤵
        
        PID:7792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45729.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8800
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1604 -s 244
        5⤵
        Program crash
        
        PID:4860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25926.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25926.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20765.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7189.exe
        6⤵
        
        PID:2916
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2916 -s 224
        7⤵
        Program crash
        
        PID:2308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6130.exe
        6⤵
        
        PID:2240
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2240 -s 244
        7⤵
        
        PID:5720
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 828 -s 240
        6⤵
        Program crash
        
        PID:4600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62975.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7931.exe
        6⤵
        
        PID:2348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33858.exe
        7⤵
        
        PID:4776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55705.exe
        7⤵
        
        PID:5552
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2348 -s 220
        7⤵
        
        PID:6776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11003.exe
        6⤵
        
        PID:3080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25802.exe
        6⤵
        
        PID:4208
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3012 -s 228
        6⤵
        
        PID:7016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26881.exe
        5⤵
        
        PID:3060
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3060 -s 220
        6⤵
        Program crash
        
        PID:4952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4345.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3544
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2500 -s 240
        5⤵
        
        PID:5640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20499.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20499.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11356.exe
        5⤵
        
        PID:2960
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2960 -s 244
        6⤵
        Program crash
        
        PID:3556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49156.exe
        5⤵
        
        PID:3632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27800.exe
        6⤵
        
        PID:7692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57130.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8644
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2864 -s 244
        5⤵
        Program crash
        
        PID:4948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41129.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41129.exe
      4⤵
      PID:2932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37911.exe
        5⤵
        
        PID:3356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3430.exe
        6⤵
        
        PID:7668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35666.exe
        6⤵
        
        PID:7748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63577.exe
        5⤵
        
        PID:4292
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2932 -s 224
        5⤵
        
        PID:1304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32865.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32865.exe
      4⤵
      PID:3464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10311.exe
        5⤵
        
        PID:6304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13191.exe
        5⤵
        
        PID:8260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62598.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62598.exe
      4⤵
      PID:4476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62298.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62298.exe
      4⤵
      PID:5300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24321.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24321.exe
      4⤵
      PID:6596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27735.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27735.exe
      4⤵
      PID:7716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21889.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21889.exe
      4⤵
      PID:9180
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19617.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19617.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25176.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25176.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:1908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19613.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61605.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39753.exe
        7⤵
        
        PID:992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44086.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2384.exe
        9⤵
        
        PID:4680
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 328 -s 248
        9⤵
        
        PID:6652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40935.exe
        8⤵
        
        PID:4428
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 992 -s 244
        8⤵
        
        PID:5576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55331.exe
        7⤵
        
        PID:3140
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3140 -s 244
        8⤵
        
        PID:5728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36389.exe
        7⤵
        
        PID:4612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9768.exe
        7⤵
        
        PID:5440
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2712 -s 240
        7⤵
        
        PID:6736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2181.exe
        6⤵
        
        PID:340
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 340 -s 224
        7⤵
        Program crash
        
        PID:3476
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2084 -s 244
        6⤵
        Program crash
        
        PID:3344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25403.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11631.exe
        6⤵
        
        PID:820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56141.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4304
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 820 -s 228
        7⤵
        
        PID:5600
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2924 -s 248
        6⤵
        Program crash
        
        PID:3924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38942.exe
        5⤵
        
        PID:892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60853.exe
        6⤵
        
        PID:3724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31967.exe
        7⤵
        
        PID:7308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52657.exe
        7⤵
        
        PID:9108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31444.exe
        6⤵
        
        PID:5028
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 892 -s 224
        6⤵
        
        PID:6064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16047.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57670.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42380.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4828
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1908 -s 248
        5⤵
        
        PID:5216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44864.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44864.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43899.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42742.exe
        6⤵
        
        PID:2876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19276.exe
        7⤵
        
        PID:5108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37505.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27115.exe
        7⤵
        
        PID:6964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22958.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27006.exe
        7⤵
        
        PID:8852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12949.exe
        6⤵
        
        PID:3252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25802.exe
        6⤵
        
        PID:4332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44299.exe
        6⤵
        
        PID:7008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9274.exe
        6⤵
        
        PID:7900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58655.exe
        6⤵
        
        PID:7720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64293.exe
        5⤵
        
        PID:2640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27828.exe
        6⤵
        
        PID:4660
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2640 -s 228
        6⤵
        
        PID:5220
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 276 -s 240
        5⤵
        Program crash
        
        PID:3524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4904.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4904.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54527.exe
        5⤵
        
        PID:920
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 920 -s 244
        6⤵
        Program crash
        
        PID:3444
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2384 -s 228
        5⤵
        Program crash
        
        PID:3296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22550.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22550.exe
      4⤵
      PID:2136
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2136 -s 224
        5⤵
        Program crash
        
        PID:3496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64258.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64258.exe
      4⤵
      PID:3332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29912.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13675.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13675.exe
      4⤵
      PID:4892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6999.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6999.exe
      4⤵
      PID:6708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41174.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41174.exe
      4⤵
      PID:7528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36062.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36062.exe
      4⤵
      PID:7820
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56570.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56570.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3276.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3276.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-728.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62311.exe
        6⤵
        
        PID:2608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60422.exe
        7⤵
        
        PID:2076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23381.exe
        8⤵
        
        PID:4404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53479.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4098.exe
        8⤵
        
        PID:7768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20456.exe
        8⤵
        
        PID:7324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58642.exe
        7⤵
        
        PID:4368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3903.exe
        7⤵
        
        PID:5472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52249.exe
        7⤵
        
        PID:6816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65356.exe
        7⤵
        
        PID:7476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12827.exe
        7⤵
        
        PID:8480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52617.exe
        6⤵
        
        PID:2896
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2896 -s 244
        7⤵
        
        PID:5736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21806.exe
        6⤵
        
        PID:4516
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1844 -s 248
        6⤵
        
        PID:5504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49244.exe
        5⤵
        
        PID:1496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30106.exe
        6⤵
        
        PID:2996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64885.exe
        7⤵
        
        PID:4480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55705.exe
        7⤵
        
        PID:5520
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2996 -s 240
        7⤵
        
        PID:6680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19171.exe
        6⤵
        
        PID:3656
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1496 -s 240
        6⤵
        Program crash
        
        PID:4260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59362.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42519.exe
        6⤵
        
        PID:4640
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2052 -s 236
        6⤵
        Program crash
        
        PID:5404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22436.exe
        5⤵
        
        PID:3872
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1892 -s 240
        5⤵
        Program crash
        
        PID:5208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40032.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40032.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:588
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 588 -s 244
        5⤵
        Program crash
        
        PID:1864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12491.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12491.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29582.exe
        5⤵
        
        PID:5036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52882.exe
        5⤵
        
        PID:5892
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2468 -s 220
        5⤵
        
        PID:6752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12513.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12513.exe
      4⤵
      PID:3732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3049.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3049.exe
      4⤵
      PID:5668
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2992 -s 248
      4⤵
      PID:6864
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11179.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11179.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2228
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2228 -s 244
      4⤵
      Program crash
      PID:2552
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50968.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50968.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5326.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5326.exe
      4⤵
      PID:1756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43339.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12970.exe
        5⤵
        
        PID:4348
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1756 -s 224
        5⤵
        
        PID:6124
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2128 -s 228
      4⤵
      Program crash
      PID:3376
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6887.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6887.exe
    3⤵
    PID:2856
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2856 -s 240
      4⤵
      Program crash
      PID:3840
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32225.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32225.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20670.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20670.exe
      4⤵
      PID:8772
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35769.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35769.exe
    3⤵
    PID:5100
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56962.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56962.exe
    3⤵
    PID:5280
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28521.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28521.exe
    3⤵
    PID:7224
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-65536.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-65536.exe
    3⤵
    PID:7684
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3688.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3688.exe
    3⤵
    PID:9208
- C:\Users\Admin\AppData\Local\Temp\Unicorn-20603.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-20603.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2376
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27231.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27231.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51818.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51818.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:1476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11444.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2492
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2492 -s 224
        6⤵
        Program crash
        
        PID:2724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52622.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7464.exe
        6⤵
        
        PID:2912
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2912 -s 224
        7⤵
        Program crash
        
        PID:3076
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2948 -s 236
        6⤵
        Program crash
        
        PID:3224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27976.exe
        5⤵
        
        PID:2788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60744.exe
        6⤵
        
        PID:3088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7324.exe
        6⤵
        
        PID:4472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20561.exe
        6⤵
        
        PID:6020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59322.exe
        6⤵
        
        PID:7204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49871.exe
        6⤵
        
        PID:7736
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2788 -s 216
        6⤵
        
        PID:9156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7386.exe
        5⤵
        
        PID:3380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30210.exe
        5⤵
        
        PID:4108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26882.exe
        5⤵
        
        PID:6804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21672.exe
        5⤵
        
        PID:7640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33229.exe
        5⤵
        
        PID:7600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32419.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32419.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11034.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34107.exe
        6⤵
        
        PID:2824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62114.exe
        7⤵
        
        PID:4032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21765.exe
        8⤵
        
        PID:8616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45835.exe
        7⤵
        
        PID:5096
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2824 -s 244
        7⤵
        
        PID:4968
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1992 -s 228
        6⤵
        Program crash
        
        PID:3288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6649.exe
        5⤵
        
        PID:1852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7651.exe
        6⤵
        
        PID:3428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10067.exe
        7⤵
        
        PID:7564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19275.exe
        6⤵
        
        PID:4740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9269.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5303.exe
        6⤵
        
        PID:7468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62398.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1521.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38876.exe
        5⤵
        
        PID:4976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6469.exe
        5⤵
        
        PID:6692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45639.exe
        5⤵
        
        PID:7500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62928.exe
        5⤵
        
        PID:7844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1697.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1697.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1764
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1764 -s 244
        5⤵
        Program crash
        
        PID:448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33458.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33458.exe
      4⤵
      PID:684
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 684 -s 244
        5⤵
        Program crash
        
        PID:2504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23889.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23889.exe
      4⤵
      PID:1968
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1968 -s 224
        5⤵
        Program crash
        
        PID:5000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63156.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63156.exe
      4⤵
      PID:3528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3579.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3579.exe
      4⤵
      PID:5676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22583.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22583.exe
      4⤵
      PID:6760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39020.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39020.exe
      4⤵
      PID:7408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7227.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7227.exe
      4⤵
      PID:8448
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5310.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5310.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23697.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23697.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1400
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1400 -s 224
        5⤵
        Program crash
        
        PID:2204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42315.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42315.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23801.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1316
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1316 -s 244
        6⤵
        Program crash
        
        PID:3452
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2964 -s 248
        5⤵
        Program crash
        
        PID:3276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4048.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4048.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2748
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2748 -s 240
        5⤵
        Program crash
        
        PID:2836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12601.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12601.exe
      4⤵
      PID:3196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13593.exe
        5⤵
        
        PID:6604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32905.exe
        5⤵
        
        PID:7484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9023.exe
        5⤵
        
        PID:8212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33095.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33095.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47281.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47281.exe
      4⤵
      PID:5836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44114.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44114.exe
      4⤵
      PID:6868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44355.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44355.exe
      4⤵
      PID:7388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3027.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3027.exe
      4⤵
      PID:8416
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62683.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62683.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2252
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2252 -s 244
      4⤵
      Program crash
      PID:1168
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59633.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59633.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:332
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 332 -s 240
      4⤵
      Program crash
      PID:1148
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5908.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5908.exe
    3⤵
    PID:2700
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2700 -s 224
      4⤵
      Program crash
      PID:3484
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27878.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27878.exe
    3⤵
    PID:3568
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2376 -s 244
    3⤵
    - Program crash
    PID:4932
- C:\Users\Admin\AppData\Local\Temp\Unicorn-33352.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-33352.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2776
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62700.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62700.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:3040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40225.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40225.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-344.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50059.exe
        6⤵
        
        PID:2508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17491.exe
        7⤵
        
        PID:3396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8557.exe
        8⤵
        
        PID:7292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65106.exe
        8⤵
        
        PID:8348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57355.exe
        7⤵
        
        PID:4396
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2508 -s 244
        7⤵
        
        PID:6076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45264.exe
        6⤵
        
        PID:3500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21604.exe
        7⤵
        
        PID:8116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60363.exe
        7⤵
        
        PID:7916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34141.exe
        6⤵
        
        PID:4528
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2696 -s 248
        6⤵
        
        PID:5184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30193.exe
        5⤵
        
        PID:1924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17060.exe
        6⤵
        
        PID:1000
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1000 -s 244
        7⤵
        Program crash
        
        PID:4988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17993.exe
        6⤵
        
        PID:3328
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1924 -s 244
        6⤵
        
        PID:5584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59938.exe
        5⤵
        
        PID:1932
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1932 -s 224
        6⤵
        Program crash
        
        PID:4324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29426.exe
        5⤵
        
        PID:4116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1103.exe
        5⤵
        
        PID:5616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27048.exe
        5⤵
        
        PID:6856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-349.exe
        5⤵
        
        PID:7432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8362.exe
        5⤵
        
        PID:8432
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60214.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60214.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22322.exe
        5⤵
        
        PID:2176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42026.exe
        6⤵
        
        PID:4940
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2176 -s 228
        6⤵
        
        PID:5904
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2664 -s 248
        5⤵
        Program crash
        
        PID:3916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22221.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22221.exe
      4⤵
      PID:868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35529.exe
        5⤵
        
        PID:4336
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 868 -s 248
        5⤵
        
        PID:5592
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3040 -s 248
      4⤵
      Program crash
      PID:3888
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61200.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61200.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60235.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60235.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2516
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2516 -s 224
        5⤵
        Program crash
        
        PID:1964
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 524 -s 248
      4⤵
      Program crash
      PID:2364
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37769.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37769.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5326.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5326.exe
      4⤵
      PID:280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28134.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10033.exe
        6⤵
        
        PID:5712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32648.exe
        6⤵
        
        PID:6792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40144.exe
        6⤵
        
        PID:7588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52226.exe
        6⤵
        
        PID:8572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61164.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4548
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 280 -s 220
        5⤵
        Program crash
        
        PID:5392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58538.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58538.exe
      4⤵
      PID:3212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32862.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50804.exe
        5⤵
        
        PID:7836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54010.exe
        5⤵
        
        PID:8880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35896.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35896.exe
      4⤵
      PID:4920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6945.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6945.exe
      4⤵
      PID:5856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43584.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43584.exe
      4⤵
      PID:6784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48820.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48820.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60619.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60619.exe
      4⤵
      PID:8460
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36172.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36172.exe
    3⤵
    PID:560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3292.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3292.exe
      4⤵
      PID:3260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48212.exe
        5⤵
        
        PID:6996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24545.exe
        5⤵
        
        PID:7544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40689.exe
        5⤵
        
        PID:8912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58917.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58917.exe
      4⤵
      PID:5068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1080.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1080.exe
      4⤵
      PID:5844
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 560 -s 248
      4⤵
      PID:6824
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41425.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41425.exe
    3⤵
    PID:3312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54468.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54468.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:8044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19522.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19522.exe
      4⤵
      PID:7920
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20452.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20452.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4168
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44934.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44934.exe
    3⤵
    PID:5920
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19542.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19542.exe
    3⤵
    PID:7148
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44147.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44147.exe
    3⤵
    PID:7576
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49624.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49624.exe
    3⤵
    PID:9200
- C:\Users\Admin\AppData\Local\Temp\Unicorn-15372.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-15372.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:2952
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50339.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50339.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45269.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45269.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52005.exe
        5⤵
        
        PID:268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16484.exe
        6⤵
        
        PID:2576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51310.exe
        7⤵
        
        PID:4996
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2576 -s 228
        7⤵
        
        PID:1216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17417.exe
        6⤵
        
        PID:3168
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 268 -s 244
        6⤵
        
        PID:5496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62731.exe
        5⤵
        
        PID:3032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-801.exe
        6⤵
        
        PID:4112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47428.exe
        6⤵
        
        PID:5964
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3032 -s 220
        6⤵
        
        PID:6912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27644.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3792
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1916 -s 228
        5⤵
        Program crash
        
        PID:5456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63442.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63442.exe
      4⤵
      PID:1488
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1488 -s 240
        5⤵
        Program crash
        
        PID:3796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24380.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24380.exe
      4⤵
      PID:3900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59315.exe
        5⤵
        
        PID:7744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51045.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51045.exe
      4⤵
      PID:4836
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 736 -s 244
      4⤵
      PID:5224
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40369.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40369.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63463.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63463.exe
      4⤵
      PID:2292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31637.exe
        5⤵
        
        PID:4216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55705.exe
        5⤵
        
        PID:5536
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2292 -s 220
        5⤵
        
        PID:6640
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1192 -s 216
      4⤵
      Program crash
      PID:3236
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26113.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26113.exe
    3⤵
    PID:2472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15300.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15300.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55705.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55705.exe
      4⤵
      PID:5512
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2472 -s 240
      4⤵
      PID:6700
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40910.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40910.exe
    3⤵
    PID:3548
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23002.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23002.exe
    3⤵
    PID:4564
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19098.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19098.exe
    3⤵
    PID:6988
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9804.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9804.exe
    3⤵
    PID:7856
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54189.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54189.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:7312
- C:\Users\Admin\AppData\Local\Temp\Unicorn-14766.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-14766.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:776
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-728.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-728.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53759.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53759.exe
      4⤵
      PID:1796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24569.exe
        5⤵
        
        PID:1008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22701.exe
        6⤵
        
        PID:3808
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1008 -s 236
        6⤵
        Program crash
        
        PID:5200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6343.exe
        5⤵
        
        PID:3220
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1796 -s 240
        5⤵
        Program crash
        
        PID:4540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42227.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42227.exe
      4⤵
      PID:2792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41092.exe
        5⤵
        
        PID:3776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37557.exe
        5⤵
        
        PID:4360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18205.exe
        5⤵
        
        PID:6832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22215.exe
        5⤵
        
        PID:7704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46602.exe
        5⤵
        
        PID:7752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61988.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61988.exe
      4⤵
      PID:3160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13001.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13001.exe
      4⤵
      PID:4700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64414.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64414.exe
      4⤵
      PID:6876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50300.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50300.exe
      4⤵
      PID:7784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12321.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12321.exe
      4⤵
      PID:7356
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57028.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57028.exe
    3⤵
    PID:932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16313.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16313.exe
      4⤵
      PID:3864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8360.exe
        5⤵
        
        PID:8292
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 932 -s 248
      4⤵
      Program crash
      PID:5044
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61137.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61137.exe
    3⤵
    PID:3944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32429.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32429.exe
      4⤵
      PID:9068
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-65435.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-65435.exe
    3⤵
    PID:5064
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17761.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17761.exe
    3⤵
    PID:1548
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34121.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34121.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:7216
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50401.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50401.exe
    3⤵
    PID:7760
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50759.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50759.exe
    3⤵
    PID:8232
- C:\Users\Admin\AppData\Local\Temp\Unicorn-34432.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-34432.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2428
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62093.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62093.exe
    3⤵
    PID:2544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44408.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44408.exe
      4⤵
      PID:3180
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2544 -s 228
      4⤵
      Program crash
      PID:4724
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53323.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53323.exe
    3⤵
    PID:3256
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33010.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33010.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5060
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15134.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15134.exe
    3⤵
    PID:6728
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62175.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62175.exe
    3⤵
    PID:7520
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45862.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45862.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:7852
- C:\Users\Admin\AppData\Local\Temp\Unicorn-59723.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-59723.exe
  2⤵
  PID:2620
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28731.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28731.exe
    3⤵
    PID:3616
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12067.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12067.exe
    3⤵
    PID:4696
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38434.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38434.exe
    3⤵
    PID:7032
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17939.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17939.exe
    3⤵
    PID:7872
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9653.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9653.exe
    3⤵
    PID:7212
- C:\Users\Admin\AppData\Local\Temp\Unicorn-25634.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-25634.exe
  2⤵
  PID:3608
- C:\Users\Admin\AppData\Local\Temp\Unicorn-62204.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-62204.exe
  2⤵
  PID:4720
- C:\Users\Admin\AppData\Local\Temp\Unicorn-13498.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-13498.exe
  2⤵
  PID:7000
- C:\Users\Admin\AppData\Local\Temp\Unicorn-24940.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-24940.exe
  2⤵
  PID:7888
- C:\Users\Admin\AppData\Local\Temp\Unicorn-7118.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-7118.exe
  2⤵
  PID:7960

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-27231.exe

Filesize
468KB

MD5
17c41fb5987ec892904c5eddf25dc923

SHA1
0a7e6c556e5cb8b15e01b420ba1ab3d0ca9c215b

SHA256
b4f9959e3257cf963fb37d6352db8469b32fce74033273033728c6639b586201

SHA512
4815951475e4f9cb760b649283c82bd5026b37eaed1e4f86d2e2b74486003cf01d56c3c76c77529b262c872241e60bbbe0d4382a1e82590ed18bc670605ddbbd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-32429.exe

Filesize
468KB

MD5
1ccdf1addd0f3bc7ad8bd8eb4917529d

SHA1
33b77ddb75e9964ddcacbb76c578d643b5d8095a

SHA256
03dccce621266416c75553a13612f143ffa25efac6a3c22fa0e35563fe9c3003

SHA512
2fcb747a62b8dfa7799b6b50987e81bdf8855aa5d8584783749ef9e82829ce25deb6dca3327e934acc0fda6c8b48479e53c3178e77b9412d68f770cfef959252

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-46447.exe

Filesize
468KB

MD5
f59046b25b1c4d41320461d8ca31c875

SHA1
2dded9c02ee38b305d4729e87962f9dc4e20eb0e

SHA256
328459bc02ff0d190770958a1cb13e9257b2a3b6bb9a9455dd1a0a5f9f434b2e

SHA512
97097f7fca0e05240c901f0bc6eaa33e1dc5a8127f9fdc4b8a0dab914cd76987d0960482514a719cb9681a1d39bed668115bee308b8f1a5a2770dcf132e8d9a7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5310.exe

Filesize
468KB

MD5
d302244af1e80751029eba6e97b12810

SHA1
ebd1a6660dad5bb77ebd06707c3441125921bcfd

SHA256
1ed79aad0e9cc4e3bf47896f77ba3992cfd847a8d42a2a3067cef6d3595fe774

SHA512
e0ea652b6e0f19980c735eddd7c370acefd0381b3faa8a748b6ca5fe9a15deb927be658d72a8024e45d99ff2a54e30cbef417d91c1075b4062b39c575168e538

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5658.exe

Filesize
468KB

MD5
71c32683364c7777f7aa9badb64d0ea0

SHA1
d4ac0b146ecd726c26cea586e460b8a6b0b05e1d

SHA256
de6be21e0b7487937d172c8f6864c4c4a18c26d797d7f5703e2a53ff8c0b5d08

SHA512
265338252abed4760448fe55f90f3d3bc13eed6931e8ef4f2e70bc0726791d14dfe77eb00f845e750d2db9d4d5147495ca0245b9485fde8fcd3c636e4c6841d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-62175.exe

Filesize
468KB

MD5
a6f11ea8eb5d1d824df2dda3f6873a49

SHA1
096c3511b596e72beab6ec45ef760576fa7d4d27

SHA256
10649cff7a4e5ab40fe25871616bae095f76f46ecedf1360345d191a03b01f1a

SHA512
21434d8344fc5638b33afa73c487a3c209be7745b59c7b000b9f69d4c5a1ae57287b4d87f329348cdde8364282dd4868bdfe384f397c04655a7e3cf54ae8d9c8

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-15372.exe

Filesize
468KB

MD5
2c7a05c0329afe1466761aaa489c8716

SHA1
f6ac74503fd5fdab867868a94496b56f77242791

SHA256
e112ed11626121c6cdb30dada6f7706ca4d927c5dc194e35be7fa5c3cb2cd719

SHA512
1bd657906bf028810a5cf8040e01a9b0b9f625af6cfb68d48790f95cb88906b0f20c548938b84eb4aad23d0213339159d2e6bddb949e8ca3ad9222f21bf81fdd

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-19617.exe

Filesize
468KB

MD5
b0376f5bd9371ecc7cec2b918b2240af

SHA1
6995c0c69b82035cee4a89dd1e9a2398b0696dc9

SHA256
592f2b7e15001155d38758efda1694993ebb3121a08315238e7a7061f9e5019e

SHA512
a4830ddfe890b79175a2588cf2d5f868094de19b04383bc34ee2d8142b27694a30fe21590d7c35061299434b4ffa5f5819adbace76323ab236a20b46eac69f65

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-20603.exe

Filesize
468KB

MD5
3373eee5d37a3b097ed867e04d1c25f0

SHA1
ecbf50b293c0b63dd581f11ec721f71ef1569b38

SHA256
1e81963c6ddfdf5f5e288effc3217487ae6fd024d8629a7f581b48f3abc0ce83

SHA512
e06d78f9db9a0b2090acf10365167f0acb5978efc50882c9824141faf87b27974db09902a98c7f2728183ab25d289b862d216183d53ead214683856eaf01677f

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-21948.exe

Filesize
468KB

MD5
30082d7563c5fc3d94e0ead5240d9389

SHA1
d73411d12345e1a0bd346ca96d73ea7f5bed1ec1

SHA256
041e8a4e48c364b0a505bab5f04e3a55d8a60dfcb379284b8ba8e3299be87def

SHA512
43aa8eef10b2bbb4f8aad3521e9ac456710735c178ea2d930e84692b562afc0f21e4ed5e82e076660d1d5e9e6f8eff191dfe4b46de356e3a769ae082e18b2879

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-25176.exe

Filesize
468KB

MD5
a8e4a356e425e6327281e90da5248fe3

SHA1
bae67ed31635cb4f25f9c0b4b1f695a894aa3227

SHA256
c9af604520b506114a340fb08e16e307ccf2a9ceb1f51e1b39206d434da6fc38

SHA512
7ff357567738db40097ac19e152cd0b90f76a3f8f539a1adca48aacc6d8c37a5c91f3c5b2166d946c8910709fd5b85929cbdf62243b3220c839756890eede51f

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-25926.exe

Filesize
468KB

MD5
61c7e0494fdb29f8bb5be2251566a6f0

SHA1
6d6b9d7a0e1015aaf6f38fd2af97ba9f26fb3ace

SHA256
c8b165e6fa822eb846bfb37b8ce2b8489be9b4cf8601b510d3df2c164ba89101

SHA512
40f93a394a332c6fd56e073d64d6694486c4a4699c449328e6249f8dc763926e843b5aa67f65e3f7bfbcf75fd25c4e7a5fda411ea5b1425bafe3892935d9bb62

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-27868.exe

Filesize
468KB

MD5
a9b854de82daeca1c00b9be5035679c8

SHA1
c9cd79f578b370987f602153c9d4325e730f593a

SHA256
77b0be61dc1f7309fc2e3d536e51fa9e365a22b2af8f95d0cd7d900b66e7d983

SHA512
593853a2123e0e0be58fcf4c11c02b0d62d5fbcb9765952c8787a687cc0aaefe966d2650ff4da3ce35a6c96a034c1d370cadcb69f9d5c70d0beab795ed2719d4

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-33344.exe

Filesize
468KB

MD5
e227cfcf77b216f9149729116a32f538

SHA1
da5bcc4db9f5b93f63a89c29968a266135aa1a77

SHA256
2729ed25799c3df87294d37db7db82a986704cc461149d775daeec34e19cf983

SHA512
61804b5190efdb7efb1be518e2a1cb66d330ed0b7ca479571b21eeabef79b539c1bd838d1dac3908c8952e319c5afe78f644d0d5bfa35cc6d1d1390cb9501ec1

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-33352.exe

Filesize
468KB

MD5
70860af6458f38156854b6efafc50757

SHA1
c29111613ed23a22786a4bbab65433180958232f

SHA256
6f5debaac9b64a78ff37fdb05611a2c07f5062feb7b6ac0277463348f827f1b2

SHA512
468ec07b97bf4b134d8410e890eb2fe64bbc5e5c373f60e9c92d8efac0e5f6fc55a0d2147f05a9eebcb81acd1cb9ac153a90c1c3c83e84d15075e4ee238ec69e

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-46426.exe

Filesize
468KB

MD5
685864fc1d06f6746b055a78f44efa38

SHA1
306986597e958fbe0c5220069f2b39486dfd4950

SHA256
2945be5c979365bbfb48d2db133890439e27ab78e259e1f8e1cedc4c61597da0

SHA512
26917e3f958a21c289d6ac2b5e2ae5b578298f4af90185d6a40d4a07944f196dd567e39a2420eaaa8c4021f453d4250a3711a9998adc7b50e3111ccf143af97d

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-51818.exe

Filesize
468KB

MD5
393d0c59d690021743de2e3b818bc3c4

SHA1
776ebf1b18e980a4380c022ec226ac0b15db575a

SHA256
434cc225ba21afb8653419a08d92fcf62c5eabd31ce676f8e10a499ba2bf535a

SHA512
a50a2f00206864b00323e8f0c22f8477b2ac3a18f1b23d210c8b955e2c5a62e956bf816963f9eeeccdf7a6ff14230a746048ff3724473903ece36dcf04ed3441

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-56570.exe

Filesize
468KB

MD5
dc8142bb93dab1862a949ca786118c73

SHA1
0bb65b25fae3cd9de59984ff52dae01fa8d674f3

SHA256
a1f0413fa629f3fb5f53581692ad797d02e49d52735c661f580d0508fb2924ae

SHA512
743969eb744be9e3d3f381d70793eb2dd80e01314a35629c7d529f384123e0b21a2bcfae97f9fa075773fb20c0817780abcdb6d3da3bf5340f249ab8e86ce41b

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-60069.exe

Filesize
468KB

MD5
7f3bdb714cefd2d68ccb34fbc1c6c98b

SHA1
0ecea3b6048325c589fbb61b224551fe719995fb

SHA256
e72483e661f06a578090e3255da51124a3ad2afa072f43abd5b972e6b0c5105e

SHA512
98c5557d6055d8e0a06a078ec3807a2728830e878a5fa3d2ba35f20db4328134a76eeb239526e0e6f46ab75e0ef48135d268c4b22b0f269aa78b6b869b6f0cbd

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-62041.exe

Filesize
468KB

MD5
5dacb2ccc9d9c3205090ed44bbcb4b96

SHA1
7151f46bce955772b56dc608ff15866a5f0750c3

SHA256
5b17d55854a3f929f0acc803f7e38cd1c709ca806c22938238d049f60d5e0a1c

SHA512
57c9693a5ec935a759a150a63b4f8bf97a986d0d268f66917753ec90c0ca59ab300c80cb884d5aec171f3e49188be902d233a6e04aebb7903d6f9be3bb6dc09d

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-62700.exe

Filesize
468KB

MD5
12c15014064881c213d6488bb991c40c

SHA1
d5631ddef43d9be5514ccbef769dd9f0739dbbac

SHA256
36c6b924c8ea4ae8c9a58410a2129dab2da0e2c67179f2ec86c8d8340db38185

SHA512
5c6d88ac4c6898333b79b232775e5211489f360e987ee1a35c510ad954909b9a0a48d13c1e08c1d811e6095a99be1574a0ca787a821093ae9348f914e84991bc

Download Submit