f70fe224ca6ad94a84e03b53883abdfd384db485dffb7ca34f2ede0bae9138d9

Analysis

max time kernel
119s
max time network
17s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
05-09-2024 12:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c0e68d3ae0891970b8bef5ffe7cbd8f0N.exe
Size

468KB
MD5

c0e68d3ae0891970b8bef5ffe7cbd8f0
SHA1

ab9a5dd0400b18d1acb1494550e52f2c4c76d2c1
SHA256

f70fe224ca6ad94a84e03b53883abdfd384db485dffb7ca34f2ede0bae9138d9
SHA512

f17179e9be5484f33d1e82dd44285ed4a48bd7cab496e4170557d8412dbfe9fa006494c6fab3f87aab66cf264bc91acfa28a7a5682d2d6ea1bc32a8e9d0aa1fe
SSDEEP

3072:mUz7oggxjz8YFbYWPz3yqf8/Eptj7ApgPmHxKlOrEls0AcI1SDl5:mUfoXAYF1PDyqf/8tNElVJI1S

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2472	Unicorn-62787.exe
2024	Unicorn-29958.exe
3056	Unicorn-45740.exe
2088	Unicorn-789.exe
2988	Unicorn-23247.exe
2668	Unicorn-1344.exe
2108	Unicorn-29378.exe
2144	Unicorn-57027.exe
2776	Unicorn-42589.exe
2884	Unicorn-13446.exe
2504	Unicorn-5278.exe
2756	Unicorn-61998.exe
1728	Unicorn-42397.exe
1976	Unicorn-62263.exe
2772	Unicorn-56133.exe
1808	Unicorn-52232.exe
2876	Unicorn-41878.exe
3064	Unicorn-49492.exe
3060	Unicorn-8822.exe
596	Unicorn-20136.exe
1276	Unicorn-41817.exe
1500	Unicorn-41817.exe
936	Unicorn-41817.exe
1496	Unicorn-21951.exe
2204	Unicorn-21786.exe
812	Unicorn-24586.exe
2232	Unicorn-30452.exe
2492	Unicorn-30717.exe
1444	Unicorn-10851.exe
1672	Unicorn-45007.exe
768	Unicorn-48745.exe
2620	Unicorn-37178.exe
2556	Unicorn-9558.exe
2548	Unicorn-36301.exe
2196	Unicorn-16435.exe
1952	Unicorn-41816.exe
2940	Unicorn-20458.exe
1232	Unicorn-26579.exe
2764	Unicorn-12289.exe
2952	Unicorn-5636.exe
1724	Unicorn-62450.exe
2912	Unicorn-50753.exe
2384	Unicorn-21226.exe
2136	Unicorn-51158.exe
3020	Unicorn-31292.exe
1848	Unicorn-22186.exe
1692	Unicorn-62257.exe
2168	Unicorn-21920.exe
2128	Unicorn-18656.exe
2148	Unicorn-18656.exe
2340	Unicorn-11002.exe
2216	Unicorn-11002.exe
1052	Unicorn-11002.exe
1056	Unicorn-10810.exe
2864	Unicorn-4680.exe
3044	Unicorn-1880.exe
2868	Unicorn-10545.exe
2560	Unicorn-38697.exe
1864	Unicorn-36467.exe
2916	Unicorn-64863.exe
2436	Unicorn-44998.exe
1736	Unicorn-41511.exe
2968	Unicorn-6792.exe
2372	Unicorn-670.exe

Loads dropped DLL 64 IoCs

pid	Process
2348	c0e68d3ae0891970b8bef5ffe7cbd8f0N.exe
2348	c0e68d3ae0891970b8bef5ffe7cbd8f0N.exe
2348	c0e68d3ae0891970b8bef5ffe7cbd8f0N.exe
2472	Unicorn-62787.exe
2348	c0e68d3ae0891970b8bef5ffe7cbd8f0N.exe
2472	Unicorn-62787.exe
2024	Unicorn-29958.exe
2024	Unicorn-29958.exe
2348	c0e68d3ae0891970b8bef5ffe7cbd8f0N.exe
2348	c0e68d3ae0891970b8bef5ffe7cbd8f0N.exe
3056	Unicorn-45740.exe
2472	Unicorn-62787.exe
2472	Unicorn-62787.exe
3056	Unicorn-45740.exe
2088	Unicorn-789.exe
2088	Unicorn-789.exe
2024	Unicorn-29958.exe
2024	Unicorn-29958.exe
2108	Unicorn-29378.exe
2108	Unicorn-29378.exe
2988	Unicorn-23247.exe
2988	Unicorn-23247.exe
2472	Unicorn-62787.exe
2348	c0e68d3ae0891970b8bef5ffe7cbd8f0N.exe
2668	Unicorn-1344.exe
3056	Unicorn-45740.exe
2472	Unicorn-62787.exe
2348	c0e68d3ae0891970b8bef5ffe7cbd8f0N.exe
2668	Unicorn-1344.exe
3056	Unicorn-45740.exe
2144	Unicorn-57027.exe
2144	Unicorn-57027.exe
2088	Unicorn-789.exe
2088	Unicorn-789.exe
2884	Unicorn-13446.exe
2884	Unicorn-13446.exe
2108	Unicorn-29378.exe
2108	Unicorn-29378.exe
1976	Unicorn-62263.exe
1976	Unicorn-62263.exe
2772	Unicorn-56133.exe
1728	Unicorn-42397.exe
2772	Unicorn-56133.exe
1728	Unicorn-42397.exe
2504	Unicorn-5278.exe
2504	Unicorn-5278.exe
2668	Unicorn-1344.exe
2668	Unicorn-1344.exe
3056	Unicorn-45740.exe
2348	c0e68d3ae0891970b8bef5ffe7cbd8f0N.exe
3056	Unicorn-45740.exe
2348	c0e68d3ae0891970b8bef5ffe7cbd8f0N.exe
2472	Unicorn-62787.exe
2988	Unicorn-23247.exe
2756	Unicorn-61998.exe
2472	Unicorn-62787.exe
2988	Unicorn-23247.exe
2756	Unicorn-61998.exe
2024	Unicorn-29958.exe
2024	Unicorn-29958.exe
2300	WerFault.exe
2300	WerFault.exe
2300	WerFault.exe
2300	WerFault.exe

Program crash 64 IoCs

pid	pid_target	Process	procid_target
2300	2776	WerFault.exe	39
112	2204	WerFault.exe	57
780	936	WerFault.exe	53
2700	1808	WerFault.exe	46
2656	1724	WerFault.exe	72
2140	2868	WerFault.exe	89
2628	1188	WerFault.exe	99
2004	3064	WerFault.exe	48
3296	3020	WerFault.exe	77
3408	1276	WerFault.exe	51
3424	1444	WerFault.exe	59
3440	484	WerFault.exe	141
3632	1564	WerFault.exe	102
3616	2340	WerFault.exe	84
3604	1056	WerFault.exe	88
3260	2560	WerFault.exe	91
3624	1436	WerFault.exe	119
4028	2196	WerFault.exe	66
3080	2876	WerFault.exe	47
3372	1596	WerFault.exe	124
4672	2900	WerFault.exe	118
4712	2948	WerFault.exe	135
4700	1032	WerFault.exe	104
4688	2912	WerFault.exe	73
5016	1028	WerFault.exe	146
4284	700	WerFault.exe	129
4484	1136	WerFault.exe	121
4492	2436	WerFault.exe	95
4528	2500	WerFault.exe	162
4504	1672	WerFault.exe	61
4796	2968	WerFault.exe	97
4880	2764	WerFault.exe	70
4876	2504	WerFault.exe	41
5128	2568	WerFault.exe	112
4668	3056	WerFault.exe	31
4636	2884	WerFault.exe	40
4624	2216	WerFault.exe	86
5220	2692	WerFault.exe	130
5312	2732	WerFault.exe	128
5304	824	WerFault.exe	116
5208	812	WerFault.exe	56
5460	2136	WerFault.exe	76
5496	1940	WerFault.exe	148
5588	2920	WerFault.exe	117
5620	2168	WerFault.exe	81
5736	1332	WerFault.exe	165
5848	2096	WerFault.exe	120
6024	2144	WerFault.exe	38
6176	2952	WerFault.exe	71
6188	2036	WerFault.exe	115
6208	2548	WerFault.exe	65
6800	1612	WerFault.exe	149
6980	1756	WerFault.exe	147
6952	2744	WerFault.exe	185
6428	2796	WerFault.exe	182
7504	3068	WerFault.exe	187
7952	1848	WerFault.exe	80
7960	1948	WerFault.exe	114
1280	2640	WerFault.exe	143
7808	1804	WerFault.exe	139
8040	1088	WerFault.exe	172
7412	596	WerFault.exe	50
7400	2620	WerFault.exe	64
7460	1908	WerFault.exe	101

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13472.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29626.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63236.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26614.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25774.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42884.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5636.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26258.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51471.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64993.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40195.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19145.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25414.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36512.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24622.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60031.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20174.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8214.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11817.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32853.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18214.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34990.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44484.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30349.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64339.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24248.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54160.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44085.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62310.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33858.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63056.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42325.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5548.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51815.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11623.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29496.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39355.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20911.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35026.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36211.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10545.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10120.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19783.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2349.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50975.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21920.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21079.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8783.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25414.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35526.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11004.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48550.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1170.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30953.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15945.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19283.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37735.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54591.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33650.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41679.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20545.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32853.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43150.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45618.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2348	c0e68d3ae0891970b8bef5ffe7cbd8f0N.exe
2472	Unicorn-62787.exe
2024	Unicorn-29958.exe
3056	Unicorn-45740.exe
2088	Unicorn-789.exe
2988	Unicorn-23247.exe
2668	Unicorn-1344.exe
2108	Unicorn-29378.exe
2144	Unicorn-57027.exe
2776	Unicorn-42589.exe
2884	Unicorn-13446.exe
2756	Unicorn-61998.exe
2504	Unicorn-5278.exe
1728	Unicorn-42397.exe
1976	Unicorn-62263.exe
2772	Unicorn-56133.exe
1808	Unicorn-52232.exe
2876	Unicorn-41878.exe
3064	Unicorn-49492.exe
3060	Unicorn-8822.exe
596	Unicorn-20136.exe
1276	Unicorn-41817.exe
1500	Unicorn-41817.exe
1672	Unicorn-45007.exe
1444	Unicorn-10851.exe
2232	Unicorn-30452.exe
812	Unicorn-24586.exe
2204	Unicorn-21786.exe
2492	Unicorn-30717.exe
936	Unicorn-41817.exe
1496	Unicorn-21951.exe
768	Unicorn-48745.exe
2620	Unicorn-37178.exe
2548	Unicorn-36301.exe
1952	Unicorn-41816.exe
2556	Unicorn-9558.exe
2940	Unicorn-20458.exe
2196	Unicorn-16435.exe
1232	Unicorn-26579.exe
2764	Unicorn-12289.exe
2952	Unicorn-5636.exe
1724	Unicorn-62450.exe
2912	Unicorn-50753.exe
2384	Unicorn-21226.exe
2136	Unicorn-51158.exe
3020	Unicorn-31292.exe
1848	Unicorn-22186.exe
1692	Unicorn-62257.exe
2216	Unicorn-11002.exe
2168	Unicorn-21920.exe
2128	Unicorn-18656.exe
2340	Unicorn-11002.exe
1052	Unicorn-11002.exe
2148	Unicorn-18656.exe
1056	Unicorn-10810.exe
2864	Unicorn-4680.exe
2868	Unicorn-10545.exe
3044	Unicorn-1880.exe
2560	Unicorn-38697.exe
2916	Unicorn-64863.exe
2436	Unicorn-44998.exe
1864	Unicorn-36467.exe
1736	Unicorn-41511.exe
2968	Unicorn-6792.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2348 wrote to memory of 2472	2348	c0e68d3ae0891970b8bef5ffe7cbd8f0N.exe	30
PID 2348 wrote to memory of 2472	2348	c0e68d3ae0891970b8bef5ffe7cbd8f0N.exe	30
PID 2348 wrote to memory of 2472	2348	c0e68d3ae0891970b8bef5ffe7cbd8f0N.exe	30
PID 2348 wrote to memory of 2472	2348	c0e68d3ae0891970b8bef5ffe7cbd8f0N.exe	30
PID 2348 wrote to memory of 2024	2348	c0e68d3ae0891970b8bef5ffe7cbd8f0N.exe	32
PID 2348 wrote to memory of 2024	2348	c0e68d3ae0891970b8bef5ffe7cbd8f0N.exe	32
PID 2348 wrote to memory of 2024	2348	c0e68d3ae0891970b8bef5ffe7cbd8f0N.exe	32
PID 2348 wrote to memory of 2024	2348	c0e68d3ae0891970b8bef5ffe7cbd8f0N.exe	32
PID 2472 wrote to memory of 3056	2472	Unicorn-62787.exe	31
PID 2472 wrote to memory of 3056	2472	Unicorn-62787.exe	31
PID 2472 wrote to memory of 3056	2472	Unicorn-62787.exe	31
PID 2472 wrote to memory of 3056	2472	Unicorn-62787.exe	31
PID 2024 wrote to memory of 2088	2024	Unicorn-29958.exe	34
PID 2024 wrote to memory of 2088	2024	Unicorn-29958.exe	34
PID 2024 wrote to memory of 2088	2024	Unicorn-29958.exe	34
PID 2024 wrote to memory of 2088	2024	Unicorn-29958.exe	34
PID 2348 wrote to memory of 2988	2348	c0e68d3ae0891970b8bef5ffe7cbd8f0N.exe	35
PID 2348 wrote to memory of 2988	2348	c0e68d3ae0891970b8bef5ffe7cbd8f0N.exe	35
PID 2348 wrote to memory of 2988	2348	c0e68d3ae0891970b8bef5ffe7cbd8f0N.exe	35
PID 2348 wrote to memory of 2988	2348	c0e68d3ae0891970b8bef5ffe7cbd8f0N.exe	35
PID 2472 wrote to memory of 2668	2472	Unicorn-62787.exe	37
PID 2472 wrote to memory of 2668	2472	Unicorn-62787.exe	37
PID 2472 wrote to memory of 2668	2472	Unicorn-62787.exe	37
PID 2472 wrote to memory of 2668	2472	Unicorn-62787.exe	37
PID 3056 wrote to memory of 2108	3056	Unicorn-45740.exe	36
PID 3056 wrote to memory of 2108	3056	Unicorn-45740.exe	36
PID 3056 wrote to memory of 2108	3056	Unicorn-45740.exe	36
PID 3056 wrote to memory of 2108	3056	Unicorn-45740.exe	36
PID 2088 wrote to memory of 2144	2088	Unicorn-789.exe	38
PID 2088 wrote to memory of 2144	2088	Unicorn-789.exe	38
PID 2088 wrote to memory of 2144	2088	Unicorn-789.exe	38
PID 2088 wrote to memory of 2144	2088	Unicorn-789.exe	38
PID 2024 wrote to memory of 2776	2024	Unicorn-29958.exe	39
PID 2024 wrote to memory of 2776	2024	Unicorn-29958.exe	39
PID 2024 wrote to memory of 2776	2024	Unicorn-29958.exe	39
PID 2024 wrote to memory of 2776	2024	Unicorn-29958.exe	39
PID 2108 wrote to memory of 2884	2108	Unicorn-29378.exe	40
PID 2108 wrote to memory of 2884	2108	Unicorn-29378.exe	40
PID 2108 wrote to memory of 2884	2108	Unicorn-29378.exe	40
PID 2108 wrote to memory of 2884	2108	Unicorn-29378.exe	40
PID 2988 wrote to memory of 2504	2988	Unicorn-23247.exe	41
PID 2988 wrote to memory of 2504	2988	Unicorn-23247.exe	41
PID 2988 wrote to memory of 2504	2988	Unicorn-23247.exe	41
PID 2988 wrote to memory of 2504	2988	Unicorn-23247.exe	41
PID 2472 wrote to memory of 2772	2472	Unicorn-62787.exe	42
PID 2472 wrote to memory of 2772	2472	Unicorn-62787.exe	42
PID 2472 wrote to memory of 2772	2472	Unicorn-62787.exe	42
PID 2472 wrote to memory of 2772	2472	Unicorn-62787.exe	42
PID 2348 wrote to memory of 2756	2348	c0e68d3ae0891970b8bef5ffe7cbd8f0N.exe	43
PID 2348 wrote to memory of 2756	2348	c0e68d3ae0891970b8bef5ffe7cbd8f0N.exe	43
PID 2348 wrote to memory of 2756	2348	c0e68d3ae0891970b8bef5ffe7cbd8f0N.exe	43
PID 2348 wrote to memory of 2756	2348	c0e68d3ae0891970b8bef5ffe7cbd8f0N.exe	43
PID 2668 wrote to memory of 1976	2668	Unicorn-1344.exe	44
PID 2668 wrote to memory of 1976	2668	Unicorn-1344.exe	44
PID 2668 wrote to memory of 1976	2668	Unicorn-1344.exe	44
PID 2668 wrote to memory of 1976	2668	Unicorn-1344.exe	44
PID 3056 wrote to memory of 1728	3056	Unicorn-45740.exe	45
PID 3056 wrote to memory of 1728	3056	Unicorn-45740.exe	45
PID 3056 wrote to memory of 1728	3056	Unicorn-45740.exe	45
PID 3056 wrote to memory of 1728	3056	Unicorn-45740.exe	45
PID 2144 wrote to memory of 1808	2144	Unicorn-57027.exe	46
PID 2144 wrote to memory of 1808	2144	Unicorn-57027.exe	46
PID 2144 wrote to memory of 1808	2144	Unicorn-57027.exe	46
PID 2144 wrote to memory of 1808	2144	Unicorn-57027.exe	46

C:\Users\Admin\AppData\Local\Temp\c0e68d3ae0891970b8bef5ffe7cbd8f0N.exe
"C:\Users\Admin\AppData\Local\Temp\c0e68d3ae0891970b8bef5ffe7cbd8f0N.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2348
- C:\Users\Admin\AppData\Local\Temp\Unicorn-62787.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-62787.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2472
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45740.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45740.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29378.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29378.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13446.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:2884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49492.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36301.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-286.exe
        8⤵
        
        PID:2316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4230.exe
        9⤵
        
        PID:2652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36512.exe
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:5972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49501.exe
        10⤵
        
        PID:7308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64954.exe
        10⤵
        
        PID:8580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35026.exe
        10⤵
        
        PID:9520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37735.exe
        9⤵
        
        PID:3832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23256.exe
        9⤵
        
        PID:5000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29496.exe
        9⤵
        
        PID:6412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44868.exe
        9⤵
        
        PID:7892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25774.exe
        9⤵
        
        PID:8788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36211.exe
        9⤵
        
        PID:9796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8485.exe
        8⤵
        
        PID:2808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33762.exe
        9⤵
        
        PID:7464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51219.exe
        9⤵
        
        PID:8492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29160.exe
        9⤵
        
        PID:9584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51471.exe
        8⤵
        
        PID:4064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29122.exe
        8⤵
        
        PID:5240
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2548 -s 240
        8⤵
        Program crash
        
        PID:6208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37405.exe
        7⤵
        
        PID:1604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24267.exe
        8⤵
        
        PID:2672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11623.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:1988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49501.exe
        9⤵
        
        PID:6748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2349.exe
        9⤵
        
        PID:7564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7013.exe
        9⤵
        
        PID:8336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37735.exe
        8⤵
        
        PID:3388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23256.exe
        8⤵
        
        PID:5164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29496.exe
        8⤵
        
        PID:6420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44868.exe
        8⤵
        
        PID:7844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25774.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:8828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36211.exe
        8⤵
        
        PID:9808
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3064 -s 240
        7⤵
        Program crash
        
        PID:2004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41816.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57655.exe
        7⤵
        
        PID:1784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32570.exe
        8⤵
        
        PID:1860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62832.exe
        9⤵
        
        PID:4644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28156.exe
        9⤵
        
        PID:5340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48571.exe
        9⤵
        
        PID:6900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56154.exe
        9⤵
        
        PID:8048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42806.exe
        9⤵
        
        PID:8984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14134.exe
        8⤵
        
        PID:3752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8783.exe
        8⤵
        
        PID:5040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51815.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60436.exe
        8⤵
        
        PID:7264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45618.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:8604
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1784 -s 220
        8⤵
        
        PID:9504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13472.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17135.exe
        8⤵
        
        PID:5396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9895.exe
        8⤵
        
        PID:6284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43584.exe
        8⤵
        
        PID:7616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50975.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:8896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64461.exe
        8⤵
        
        PID:10012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35654.exe
        7⤵
        
        PID:3916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14648.exe
        7⤵
        
        PID:4332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43150.exe
        7⤵
        
        PID:5152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43900.exe
        7⤵
        
        PID:7280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9399.exe
        7⤵
        
        PID:8356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5360.exe
        7⤵
        
        PID:9420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10684.exe
        6⤵
        
        PID:1564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63021.exe
        7⤵
        
        PID:1660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57601.exe
        8⤵
        
        PID:4124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9521.exe
        8⤵
        
        PID:5248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23630.exe
        8⤵
        
        PID:6340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49449.exe
        8⤵
        
        PID:7600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42310.exe
        8⤵
        
        PID:8796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19145.exe
        8⤵
        
        PID:9888
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1564 -s 216
        7⤵
        Program crash
        
        PID:3632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13555.exe
        6⤵
        
        PID:2732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64339.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63014.exe
        8⤵
        
        PID:6096
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2796 -s 216
        8⤵
        Program crash
        
        PID:6428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37735.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3808
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2732 -s 240
        7⤵
        Program crash
        
        PID:5312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19804.exe
        6⤵
        
        PID:2736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36128.exe
        7⤵
        
        PID:5632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13896.exe
        7⤵
        
        PID:7436
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2736 -s 220
        7⤵
        
        PID:8536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32135.exe
        6⤵
        
        PID:3184
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2884 -s 240
        6⤵
        Program crash
        
        PID:4636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8822.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20458.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46363.exe
        7⤵
        
        PID:2852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27391.exe
        8⤵
        
        PID:784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35573.exe
        9⤵
        
        PID:6776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11997.exe
        9⤵
        
        PID:7520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59775.exe
        9⤵
        
        PID:8328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37735.exe
        8⤵
        
        PID:4076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23256.exe
        8⤵
        
        PID:5144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29496.exe
        8⤵
        
        PID:6404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44868.exe
        8⤵
        
        PID:7852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25774.exe
        8⤵
        
        PID:8844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36211.exe
        8⤵
        
        PID:9816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7525.exe
        7⤵
        
        PID:1000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34665.exe
        8⤵
        
        PID:6444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36553.exe
        8⤵
        
        PID:7360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29269.exe
        8⤵
        
        PID:7764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51471.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16869.exe
        7⤵
        
        PID:5324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20830.exe
        7⤵
        
        PID:6308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24248.exe
        7⤵
        
        PID:7608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42840.exe
        7⤵
        
        PID:8868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43460.exe
        7⤵
        
        PID:9976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55278.exe
        6⤵
        
        PID:2568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18455.exe
        7⤵
        
        PID:1088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63061.exe
        8⤵
        
        PID:6468
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1088 -s 216
        8⤵
        Program crash
        
        PID:8040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37735.exe
        7⤵
        
        PID:4000
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2568 -s 240
        7⤵
        Program crash
        
        PID:5128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21836.exe
        6⤵
        
        PID:2536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21847.exe
        7⤵
        
        PID:5216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61753.exe
        7⤵
        
        PID:6912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15945.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60106.exe
        7⤵
        
        PID:9304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57336.exe
        6⤵
        
        PID:3996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20456.exe
        6⤵
        
        PID:4468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4295.exe
        6⤵
        
        PID:6160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41314.exe
        6⤵
        
        PID:7548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21309.exe
        6⤵
        
        PID:8752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9345.exe
        6⤵
        
        PID:9760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26579.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41127.exe
        6⤵
        
        PID:1032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39472.exe
        7⤵
        
        PID:3120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65171.exe
        8⤵
        
        PID:8520
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1032 -s 236
        7⤵
        Program crash
        
        PID:4700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44111.exe
        6⤵
        
        PID:3108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56811.exe
        7⤵
        
        PID:8488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7636.exe
        6⤵
        
        PID:4744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39724.exe
        6⤵
        
        PID:5756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61339.exe
        6⤵
        
        PID:6836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30953.exe
        6⤵
        
        PID:7976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43336.exe
        6⤵
        
        PID:8704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21.exe
        5⤵
        
        PID:1888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42217.exe
        6⤵
        
        PID:1704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18214.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40195.exe
        7⤵
        
        PID:5672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55265.exe
        7⤵
        
        PID:6184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60025.exe
        7⤵
        
        PID:8172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53968.exe
        7⤵
        
        PID:9120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52694.exe
        6⤵
        
        PID:3972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38119.exe
        6⤵
        
        PID:4944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24898.exe
        6⤵
        
        PID:5700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44484.exe
        6⤵
        
        PID:5440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48550.exe
        6⤵
        
        PID:7484
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1888 -s 240
        6⤵
        
        PID:8524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16758.exe
        5⤵
        
        PID:2948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39472.exe
        6⤵
        
        PID:3128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5062.exe
        7⤵
        
        PID:9188
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2948 -s 216
        6⤵
        Program crash
        
        PID:4712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26258.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29074.exe
        6⤵
        
        PID:8644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5366.exe
        5⤵
        
        PID:4728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10058.exe
        5⤵
        
        PID:5800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35003.exe
        5⤵
        
        PID:6760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25353.exe
        5⤵
        
        PID:8148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50303.exe
        5⤵
        
        PID:9160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42397.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42397.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:1728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41817.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62450.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1724
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1724 -s 240
        7⤵
        Program crash
        
        PID:2656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35542.exe
        6⤵
        
        PID:1948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11817.exe
        7⤵
        
        PID:3488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16926.exe
        7⤵
        
        PID:4292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41892.exe
        7⤵
        
        PID:5480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38292.exe
        7⤵
        
        PID:6692
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1948 -s 220
        7⤵
        Program crash
        
        PID:7960
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1276 -s 240
        6⤵
        Program crash
        
        PID:3408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50753.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18844.exe
        6⤵
        
        PID:1288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51724.exe
        7⤵
        
        PID:3092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29759.exe
        8⤵
        
        PID:9104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59438.exe
        7⤵
        
        PID:4752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33858.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4467.exe
        7⤵
        
        PID:6796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47489.exe
        7⤵
        
        PID:7968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26270.exe
        7⤵
        
        PID:8692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34463.exe
        6⤵
        
        PID:3312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63056.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2000.exe
        7⤵
        
        PID:9000
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2912 -s 240
        6⤵
        Program crash
        
        PID:4688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56377.exe
        5⤵
        
        PID:2036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27391.exe
        6⤵
        
        PID:3048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13766.exe
        7⤵
        
        PID:4776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62666.exe
        7⤵
        
        PID:5936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47284.exe
        7⤵
        
        PID:6684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8214.exe
        7⤵
        
        PID:8200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34912.exe
        7⤵
        
        PID:9232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37735.exe
        6⤵
        
        PID:3192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23256.exe
        6⤵
        
        PID:4472
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2036 -s 236
        6⤵
        Program crash
        
        PID:6188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64074.exe
        5⤵
        
        PID:1120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-648.exe
        6⤵
        
        PID:6860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36553.exe
        6⤵
        
        PID:7372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45606.exe
        6⤵
        
        PID:8696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48671.exe
        5⤵
        
        PID:3220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3921.exe
        5⤵
        
        PID:5284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21360.exe
        5⤵
        
        PID:6228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19783.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15974.exe
        5⤵
        
        PID:8932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42325.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24586.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24586.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11002.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36135.exe
        6⤵
        
        PID:2824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28147.exe
        7⤵
        
        PID:6624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36553.exe
        7⤵
        
        PID:7304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29269.exe
        7⤵
        
        PID:8256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37735.exe
        6⤵
        
        PID:3856
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2216 -s 240
        6⤵
        Program crash
        
        PID:4624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7525.exe
        5⤵
        
        PID:2200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39081.exe
        6⤵
        
        PID:6500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64550.exe
        6⤵
        
        PID:8100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-870.exe
        6⤵
        
        PID:9152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31710.exe
        6⤵
        
        PID:10128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51471.exe
        5⤵
        
        PID:3144
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 812 -s 236
        5⤵
        Program crash
        
        PID:5208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10545.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10545.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2868
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2868 -s 240
        5⤵
        Program crash
        
        PID:2140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34028.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34028.exe
      4⤵
      PID:2768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2692.exe
        5⤵
        
        PID:5680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37445.exe
        5⤵
        
        PID:6264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54160.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29577.exe
        5⤵
        
        PID:9204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19691.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19691.exe
      4⤵
      PID:3820
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3056 -s 240
      4⤵
      Program crash
      PID:4668
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1344.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1344.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62263.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62263.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:1976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20136.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12289.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57655.exe
        7⤵
        
        PID:1908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33338.exe
        8⤵
        
        PID:2112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64882.exe
        9⤵
        
        PID:4664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24622.exe
        9⤵
        
        PID:5992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63236.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:7240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5282.exe
        9⤵
        
        PID:8452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26360.exe
        9⤵
        
        PID:9496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21918.exe
        8⤵
        
        PID:3868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8783.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51815.exe
        8⤵
        
        PID:932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60436.exe
        8⤵
        
        PID:6792
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1908 -s 216
        8⤵
        Program crash
        
        PID:7460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14240.exe
        7⤵
        
        PID:2056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35526.exe
        8⤵
        
        PID:4280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24622.exe
        8⤵
        
        PID:5728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63236.exe
        8⤵
        
        PID:7176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8214.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:7588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26744.exe
        8⤵
        
        PID:8892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20469.exe
        7⤵
        
        PID:4084
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2764 -s 216
        7⤵
        Program crash
        
        PID:4880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21261.exe
        6⤵
        
        PID:1600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32243.exe
        7⤵
        
        PID:2520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3829.exe
        8⤵
        
        PID:7380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51219.exe
        8⤵
        
        PID:8416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-764.exe
        8⤵
        
        PID:9392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37735.exe
        7⤵
        
        PID:3400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23256.exe
        7⤵
        
        PID:5136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29496.exe
        7⤵
        
        PID:6396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44868.exe
        7⤵
        
        PID:7836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25774.exe
        7⤵
        
        PID:8852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36211.exe
        7⤵
        
        PID:9840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33341.exe
        6⤵
        
        PID:3148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1170.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:9136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13501.exe
        6⤵
        
        PID:4736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31058.exe
        6⤵
        
        PID:5776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44803.exe
        6⤵
        
        PID:6752
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 596 -s 240
        6⤵
        Program crash
        
        PID:7412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5636.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17500.exe
        6⤵
        
        PID:2712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36711.exe
        7⤵
        
        PID:3068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47825.exe
        8⤵
        
        PID:6804
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3068 -s 216
        8⤵
        Program crash
        
        PID:7504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37735.exe
        7⤵
        
        PID:848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11004.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29496.exe
        7⤵
        
        PID:6380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44868.exe
        7⤵
        
        PID:7828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25774.exe
        7⤵
        
        PID:8836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36211.exe
        7⤵
        
        PID:9824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58755.exe
        6⤵
        
        PID:2064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14363.exe
        7⤵
        
        PID:5772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49501.exe
        7⤵
        
        PID:7248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64954.exe
        7⤵
        
        PID:8572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35026.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:9552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51471.exe
        6⤵
        
        PID:4024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29122.exe
        6⤵
        
        PID:5232
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2952 -s 240
        6⤵
        Program crash
        
        PID:6176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40233.exe
        5⤵
        
        PID:2848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64282.exe
        6⤵
        
        PID:1028
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1028 -s 240
        7⤵
        Program crash
        
        PID:5016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14134.exe
        6⤵
        
        PID:3744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8783.exe
        6⤵
        
        PID:4360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51815.exe
        6⤵
        
        PID:6080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60436.exe
        6⤵
        
        PID:7340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45618.exe
        6⤵
        
        PID:8596
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2848 -s 240
        6⤵
        
        PID:9436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32305.exe
        5⤵
        
        PID:1756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36792.exe
        6⤵
        
        PID:4396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28156.exe
        6⤵
        
        PID:5348
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1756 -s 220
        6⤵
        Program crash
        
        PID:6980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25069.exe
        5⤵
        
        PID:3728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54985.exe
        5⤵
        
        PID:4276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43680.exe
        5⤵
        
        PID:5228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39435.exe
        5⤵
        
        PID:7348
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1976 -s 240
        5⤵
        
        PID:8380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21951.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21951.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10810.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30349.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57601.exe
        7⤵
        
        PID:4132
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2692 -s 216
        7⤵
        Program crash
        
        PID:5220
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1056 -s 236
        6⤵
        Program crash
        
        PID:3604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6207.exe
        5⤵
        
        PID:2576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57601.exe
        6⤵
        
        PID:4140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9521.exe
        6⤵
        
        PID:5172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23630.exe
        6⤵
        
        PID:6316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49449.exe
        6⤵
        
        PID:7540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42310.exe
        6⤵
        
        PID:8760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19145.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41733.exe
        5⤵
        
        PID:3836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43984.exe
        5⤵
        
        PID:4968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16232.exe
        5⤵
        
        PID:5868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27948.exe
        5⤵
        
        PID:6156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-79.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-79.exe
        5⤵
        
        PID:7784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42884.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38697.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38697.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18097.exe
        5⤵
        
        PID:2352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36792.exe
        6⤵
        
        PID:4388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28156.exe
        6⤵
        
        PID:5372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28342.exe
        6⤵
        
        PID:6632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56154.exe
        6⤵
        
        PID:2660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26469.exe
        6⤵
        
        PID:8244
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2560 -s 236
        5⤵
        Program crash
        
        PID:3260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64017.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64017.exe
      4⤵
      PID:1932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58499.exe
        5⤵
        
        PID:4948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20123.exe
        5⤵
        
        PID:5808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64139.exe
        5⤵
        
        PID:6852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56154.exe
        5⤵
        
        PID:8004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42806.exe
        5⤵
        
        PID:8972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25069.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25069.exe
      4⤵
      PID:3688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54985.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54985.exe
      4⤵
      PID:4192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43680.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43680.exe
      4⤵
      PID:6084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39435.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39435.exe
      4⤵
      PID:6568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38750.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38750.exe
      4⤵
      PID:7408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41749.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41749.exe
      4⤵
      PID:8476
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56133.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56133.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41817.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41817.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21226.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2123.exe
        6⤵
        
        PID:824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36711.exe
        7⤵
        
        PID:1980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43746.exe
        8⤵
        
        PID:6132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47088.exe
        8⤵
        
        PID:6552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50289.exe
        8⤵
        
        PID:7984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51471.exe
        8⤵
        
        PID:8652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37735.exe
        7⤵
        
        PID:3380
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 824 -s 240
        7⤵
        Program crash
        
        PID:5304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20545.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10897.exe
        7⤵
        
        PID:7368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18144.exe
        7⤵
        
        PID:8220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51471.exe
        6⤵
        
        PID:3084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29122.exe
        6⤵
        
        PID:5192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20830.exe
        6⤵
        
        PID:6300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24248.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42840.exe
        6⤵
        
        PID:8744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14680.exe
        6⤵
        
        PID:9768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55771.exe
        5⤵
        
        PID:2920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63789.exe
        6⤵
        
        PID:1540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34550.exe
        7⤵
        
        PID:4540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40195.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51181.exe
        7⤵
        
        PID:6216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60025.exe
        7⤵
        
        PID:8164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53968.exe
        7⤵
        
        PID:9132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11277.exe
        6⤵
        
        PID:3212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33650.exe
        6⤵
        
        PID:5108
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2920 -s 236
        6⤵
        Program crash
        
        PID:5588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28878.exe
        5⤵
        
        PID:1804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1130.exe
        6⤵
        
        PID:4920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20123.exe
        6⤵
        
        PID:5792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64139.exe
        6⤵
        
        PID:6864
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1804 -s 216
        6⤵
        Program crash
        
        PID:7808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22710.exe
        5⤵
        
        PID:3348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22682.exe
        5⤵
        
        PID:4172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65234.exe
        5⤵
        
        PID:1688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45014.exe
        5⤵
        
        PID:6784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44085.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37549.exe
        5⤵
        
        PID:8348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31292.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31292.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30712.exe
        5⤵
        
        PID:2900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54329.exe
        6⤵
        
        PID:3320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55436.exe
        7⤵
        
        PID:1576
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2900 -s 236
        6⤵
        Program crash
        
        PID:4672
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3020 -s 236
        5⤵
        Program crash
        
        PID:3296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16221.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16221.exe
      4⤵
      PID:1436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32570.exe
        5⤵
        
        PID:1612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58499.exe
        6⤵
        
        PID:4980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11955.exe
        6⤵
        
        PID:5884
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1612 -s 240
        6⤵
        Program crash
        
        PID:6800
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1436 -s 216
        5⤵
        Program crash
        
        PID:3624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33265.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33265.exe
      4⤵
      PID:1420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48141.exe
        5⤵
        
        PID:4340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5297.exe
        5⤵
        
        PID:5768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47284.exe
        5⤵
        
        PID:6672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8214.exe
        5⤵
        
        PID:8028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34912.exe
        5⤵
        
        PID:9264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32853.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32853.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54985.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54985.exe
      4⤵
      PID:4168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43680.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43680.exe
      4⤵
      PID:6104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39435.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39435.exe
      4⤵
      PID:7296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35818.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35818.exe
      4⤵
      PID:8396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4225.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4225.exe
      4⤵
      PID:9528
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30452.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30452.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11002.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11002.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35009.exe
        5⤵
        
        PID:1664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9298.exe
        6⤵
        
        PID:5028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63761.exe
        6⤵
        
        PID:6064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62660.exe
        6⤵
        
        PID:6924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14929.exe
        6⤵
        
        PID:7536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18301.exe
        6⤵
        
        PID:9092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3109.exe
        5⤵
        
        PID:3332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25482.exe
        5⤵
        
        PID:4204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24898.exe
        5⤵
        
        PID:5692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44484.exe
        5⤵
        
        PID:6492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48550.exe
        5⤵
        
        PID:7512
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1052 -s 240
        5⤵
        
        PID:8656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55792.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55792.exe
      4⤵
      PID:484
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 484 -s 240
        5⤵
        Program crash
        
        PID:3440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5687.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5687.exe
      4⤵
      PID:3460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36527.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36527.exe
      4⤵
      PID:4308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39092.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39092.exe
      4⤵
      PID:4608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13091.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13091.exe
      4⤵
      PID:7164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48019.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48019.exe
      4⤵
      PID:7420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5469.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5469.exe
      4⤵
      PID:8228
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1880.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1880.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50442.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50442.exe
      4⤵
      PID:2784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21079.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33548.exe
        5⤵
        
        PID:6740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2349.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7013.exe
        5⤵
        
        PID:3404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2458.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2458.exe
      4⤵
      PID:3792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23256.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23256.exe
      4⤵
      PID:4760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29496.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29496.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44868.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44868.exe
      4⤵
      PID:7820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25774.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25774.exe
      4⤵
      PID:8812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36211.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36211.exe
      4⤵
      PID:9848
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58526.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58526.exe
    3⤵
    PID:1700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22553.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22553.exe
      4⤵
      PID:6572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20741.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20741.exe
      4⤵
      PID:6920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39355.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39355.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:8292
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49201.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49201.exe
    3⤵
    PID:3164
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64993.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64993.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4812
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60031.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60031.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6292
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18648.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18648.exe
    3⤵
    PID:7648
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57975.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57975.exe
    3⤵
    PID:8768
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33145.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33145.exe
    3⤵
    PID:9752
- C:\Users\Admin\AppData\Local\Temp\Unicorn-29958.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-29958.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2024
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-789.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-789.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57027.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57027.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52232.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37178.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64863.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60836.exe
        8⤵
        
        PID:1596
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1596 -s 240
        9⤵
        Program crash
        
        PID:3372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5548.exe
        8⤵
        
        PID:3656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48726.exe
        8⤵
        
        PID:4572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47757.exe
        8⤵
        
        PID:5364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29626.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:2164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30953.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:7996
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2916 -s 240
        8⤵
        
        PID:8684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4214.exe
        7⤵
        
        PID:1020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57601.exe
        8⤵
        
        PID:3360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62806.exe
        8⤵
        
        PID:5268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23630.exe
        8⤵
        
        PID:6364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53533.exe
        8⤵
        
        PID:7812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42310.exe
        8⤵
        
        PID:8860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19145.exe
        8⤵
        
        PID:9832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19283.exe
        7⤵
        
        PID:3644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54591.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39092.exe
        7⤵
        
        PID:5180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41679.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6580
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2620 -s 240
        7⤵
        Program crash
        
        PID:7400
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1808 -s 236
        6⤵
        Program crash
        
        PID:2700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16435.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41511.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4749.exe
        7⤵
        
        PID:2528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35526.exe
        8⤵
        
        PID:4444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24622.exe
        8⤵
        
        PID:5956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63236.exe
        8⤵
        
        PID:7232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5282.exe
        8⤵
        
        PID:8504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26360.exe
        8⤵
        
        PID:9536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21918.exe
        7⤵
        
        PID:3960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8783.exe
        7⤵
        
        PID:4432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51815.exe
        7⤵
        
        PID:5836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60436.exe
        7⤵
        
        PID:6884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45618.exe
        7⤵
        
        PID:8612
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1736 -s 240
        7⤵
        
        PID:9512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14240.exe
        6⤵
        
        PID:2116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29387.exe
        7⤵
        
        PID:5376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9895.exe
        7⤵
        
        PID:6244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43584.exe
        7⤵
        
        PID:7592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50975.exe
        7⤵
        
        PID:8924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64461.exe
        7⤵
        
        PID:10004
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2196 -s 240
        6⤵
        Program crash
        
        PID:4028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6792.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32570.exe
        6⤵
        
        PID:2236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51099.exe
        7⤵
        
        PID:4184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28156.exe
        7⤵
        
        PID:5416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3454.exe
        7⤵
        
        PID:6432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56154.exe
        7⤵
        
        PID:8112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42806.exe
        7⤵
        
        PID:8976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14134.exe
        6⤵
        
        PID:3732
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2968 -s 240
        6⤵
        Program crash
        
        PID:4796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53877.exe
        5⤵
        
        PID:1960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23850.exe
        6⤵
        
        PID:4612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4202.exe
        6⤵
        
        PID:5456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63236.exe
        6⤵
        
        PID:7204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8214.exe
        6⤵
        
        PID:7556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34912.exe
        6⤵
        
        PID:9256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32853.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54985.exe
        5⤵
        
        PID:5104
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2144 -s 240
        5⤵
        Program crash
        
        PID:6024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41878.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41878.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48745.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36467.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10120.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30850.exe
        8⤵
        
        PID:4380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63958.exe
        8⤵
        
        PID:5504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14232.exe
        8⤵
        
        PID:6440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60025.exe
        8⤵
        
        PID:8188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20911.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:9164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3109.exe
        7⤵
        
        PID:3344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25482.exe
        7⤵
        
        PID:4208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24898.exe
        7⤵
        
        PID:648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44484.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48550.exe
        7⤵
        
        PID:7704
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1864 -s 240
        7⤵
        
        PID:8920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47432.exe
        6⤵
        
        PID:2640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25414.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34990.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41892.exe
        7⤵
        
        PID:5476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9319.exe
        7⤵
        
        PID:6172
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2640 -s 220
        7⤵
        Program crash
        
        PID:1280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21120.exe
        6⤵
        
        PID:4036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43984.exe
        6⤵
        
        PID:4992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16232.exe
        6⤵
        
        PID:5892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27948.exe
        6⤵
        
        PID:6496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-79.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-79.exe
        6⤵
        
        PID:7416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42884.exe
        6⤵
        
        PID:8460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44998.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11827.exe
        6⤵
        
        PID:1308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57601.exe
        7⤵
        
        PID:3224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62806.exe
        7⤵
        
        PID:5276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23630.exe
        7⤵
        
        PID:6356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53533.exe
        7⤵
        
        PID:7860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42310.exe
        7⤵
        
        PID:8876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47925.exe
        7⤵
        
        PID:9996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5548.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3668
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2436 -s 240
        6⤵
        Program crash
        
        PID:4492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54706.exe
        5⤵
        
        PID:1732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36711.exe
        6⤵
        
        PID:2744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36792.exe
        7⤵
        
        PID:3788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28156.exe
        7⤵
        
        PID:5424
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2744 -s 220
        7⤵
        Program crash
        
        PID:6952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37735.exe
        6⤵
        
        PID:3864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23256.exe
        6⤵
        
        PID:5156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29496.exe
        6⤵
        
        PID:6388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44868.exe
        6⤵
        
        PID:7884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25774.exe
        6⤵
        
        PID:8780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36211.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12818.exe
        5⤵
        
        PID:2680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35526.exe
        6⤵
        
        PID:4440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24622.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63236.exe
        6⤵
        
        PID:7196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8214.exe
        6⤵
        
        PID:7456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34912.exe
        6⤵
        
        PID:9240
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2876 -s 240
        5⤵
        Program crash
        
        PID:3080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9558.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9558.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-670.exe
        5⤵
        Executes dropped EXE
        
        PID:2372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29773.exe
        6⤵
        
        PID:1896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5598.exe
        7⤵
        
        PID:4852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20123.exe
        7⤵
        
        PID:5820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64139.exe
        7⤵
        
        PID:6824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56154.exe
        7⤵
        
        PID:8136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42806.exe
        7⤵
        
        PID:8960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19637.exe
        6⤵
        
        PID:4088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50371.exe
        6⤵
        
        PID:4884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24898.exe
        6⤵
        
        PID:320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44484.exe
        6⤵
        
        PID:6840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48550.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27275.exe
        6⤵
        
        PID:8680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15143.exe
        5⤵
        
        PID:956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30466.exe
        6⤵
        
        PID:4576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40195.exe
        6⤵
        
        PID:5664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55265.exe
        6⤵
        
        PID:6168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60025.exe
        6⤵
        
        PID:8180
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 956 -s 240
        6⤵
        
        PID:9100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16844.exe
        5⤵
        
        PID:3328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31348.exe
        5⤵
        
        PID:4104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16232.exe
        5⤵
        
        PID:5856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27948.exe
        5⤵
        
        PID:6224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-79.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-79.exe
        5⤵
        
        PID:7796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42884.exe
        5⤵
        
        PID:8324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45138.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45138.exe
      4⤵
      PID:1188
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1188 -s 240
        5⤵
        Program crash
        
        PID:2628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22544.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22544.exe
      4⤵
      PID:2428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59361.exe
        5⤵
        
        PID:6564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44530.exe
        5⤵
        
        PID:7664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8657.exe
        5⤵
        
        PID:8468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32135.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32135.exe
      4⤵
      PID:3200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8734.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8734.exe
      4⤵
      PID:5296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65367.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65367.exe
      4⤵
      PID:6276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14448.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14448.exe
      4⤵
      PID:7668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20174.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20174.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:8944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14589.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14589.exe
      4⤵
      PID:10044
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42589.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42589.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2776
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2776 -s 240
      4⤵
      Loads dropped DLL
      Program crash
      PID:2300
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45007.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45007.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51158.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51158.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19612.exe
        5⤵
        
        PID:2096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7022.exe
        6⤵
        
        PID:3944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24383.exe
        6⤵
        
        PID:5060
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2096 -s 220
        6⤵
        Program crash
        
        PID:5848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57489.exe
        5⤵
        
        PID:3452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30661.exe
        5⤵
        
        PID:4300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47757.exe
        5⤵
        
        PID:5440
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2136 -s 240
        5⤵
        Program crash
        
        PID:5460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56731.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56731.exe
      4⤵
      PID:1136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25414.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3696
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1136 -s 216
        5⤵
        Program crash
        
        PID:4484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19283.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19283.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3676
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1672 -s 216
      4⤵
      Program crash
      PID:4504
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21920.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21920.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5268.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5268.exe
      4⤵
      PID:2924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19275.exe
        5⤵
        
        PID:3928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24383.exe
        5⤵
        
        PID:5052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19032.exe
        5⤵
        
        PID:5872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53149.exe
        5⤵
        
        PID:6832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65086.exe
        5⤵
        
        PID:7772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10209.exe
        5⤵
        
        PID:9172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27997.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27997.exe
      4⤵
      PID:3824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38119.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38119.exe
      4⤵
      PID:4936
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2168 -s 236
      4⤵
      Program crash
      PID:5620
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21034.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21034.exe
    3⤵
    PID:2592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57601.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57601.exe
      4⤵
      PID:4108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9521.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9521.exe
      4⤵
      PID:5200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23630.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23630.exe
      4⤵
      PID:6348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53533.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53533.exe
      4⤵
      PID:7868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42310.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42310.exe
      4⤵
      PID:8820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19145.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19145.exe
      4⤵
      PID:9896
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55262.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55262.exe
    3⤵
    PID:3896
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35849.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35849.exe
    3⤵
    PID:5012
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60768.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60768.exe
    3⤵
    PID:640
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18148.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18148.exe
    3⤵
    PID:6816
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42950.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42950.exe
    3⤵
    PID:7432
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14013.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14013.exe
    3⤵
    PID:8412
- C:\Users\Admin\AppData\Local\Temp\Unicorn-23247.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-23247.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2988
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5278.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5278.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41817.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41817.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:936
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 936 -s 220
        5⤵
        Program crash
        
        PID:780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18656.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18656.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34106.exe
        5⤵
        
        PID:2500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38735.exe
        6⤵
        
        PID:3720
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2500 -s 236
        6⤵
        Program crash
        
        PID:4528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60670.exe
        5⤵
        
        PID:3176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33650.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24898.exe
        5⤵
        
        PID:400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44484.exe
        5⤵
        
        PID:6456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48550.exe
        5⤵
        
        PID:7492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64415.exe
        5⤵
        
        PID:9008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-456.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-456.exe
      4⤵
      PID:1332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52033.exe
        5⤵
        
        PID:4524
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1332 -s 216
        5⤵
        Program crash
        
        PID:5736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26335.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26335.exe
      4⤵
      PID:4044
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2504 -s 220
      4⤵
      Program crash
      PID:4876
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10851.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10851.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11002.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11002.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24957.exe
        5⤵
        
        PID:332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57601.exe
        6⤵
        
        PID:4116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9521.exe
        6⤵
        
        PID:5260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23630.exe
        6⤵
        
        PID:6372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53533.exe
        6⤵
        
        PID:7876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42310.exe
        6⤵
        
        PID:8804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19145.exe
        6⤵
        
        PID:9856
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2340 -s 236
        5⤵
        Program crash
        
        PID:3616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59492.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59492.exe
      4⤵
      PID:700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11817.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3476
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 700 -s 216
        5⤵
        Program crash
        
        PID:4284
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1444 -s 220
      4⤵
      Program crash
      PID:3424
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4680.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4680.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6586.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6586.exe
      4⤵
      PID:1740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29387.exe
        5⤵
        
        PID:5356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9895.exe
        5⤵
        
        PID:6236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43584.exe
        5⤵
        
        PID:7640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50975.exe
        5⤵
        
        PID:8912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64461.exe
        5⤵
        
        PID:10032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6734.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6734.exe
      4⤵
      PID:4056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8783.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8783.exe
      4⤵
      PID:4428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51815.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51815.exe
      4⤵
      PID:4988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60436.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60436.exe
      4⤵
      PID:7316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45618.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45618.exe
      4⤵
      PID:8588
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2864 -s 240
      4⤵
      PID:9444
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50177.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50177.exe
    3⤵
    PID:2184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14192.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14192.exe
      4⤵
      PID:6532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39853.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39853.exe
      4⤵
      PID:8140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29458.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29458.exe
      4⤵
      PID:9180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19457.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19457.exe
      4⤵
      PID:10216
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1141.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1141.exe
    3⤵
    PID:3340
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13760.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13760.exe
    3⤵
    PID:4512
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15667.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15667.exe
    3⤵
    PID:6016
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39435.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39435.exe
    3⤵
    PID:7224
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2988 -s 240
    3⤵
    PID:8372
- C:\Users\Admin\AppData\Local\Temp\Unicorn-61998.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-61998.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:2756
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30717.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30717.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22186.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22186.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53182.exe
        5⤵
        
        PID:1940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25414.exe
        6⤵
        
        PID:3712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34990.exe
        6⤵
        
        PID:4560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41892.exe
        6⤵
        
        PID:5468
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1940 -s 236
        6⤵
        Program crash
        
        PID:5496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23721.exe
        5⤵
        
        PID:2188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50371.exe
        5⤵
        
        PID:4904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19469.exe
        5⤵
        
        PID:5432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25542.exe
        5⤵
        
        PID:6608
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1848 -s 236
        5⤵
        Program crash
        
        PID:7952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42444.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42444.exe
      4⤵
      PID:2212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35526.exe
        5⤵
        
        PID:4260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24622.exe
        5⤵
        
        PID:5960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63236.exe
        5⤵
        
        PID:6896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5282.exe
        5⤵
        
        PID:8480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26360.exe
        5⤵
        
        PID:9560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35654.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35654.exe
      4⤵
      PID:3968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14648.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14648.exe
      4⤵
      PID:4348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43150.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43150.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43900.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43900.exe
      4⤵
      PID:7288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62684.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62684.exe
      4⤵
      PID:8512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5360.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5360.exe
      4⤵
      PID:9544
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18656.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18656.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62310.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62310.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60798.exe
        5⤵
        
        PID:4632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24622.exe
        5⤵
        
        PID:5928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63236.exe
        5⤵
        
        PID:7184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8214.exe
        5⤵
        
        PID:8208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34912.exe
        5⤵
        
        PID:9248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21918.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21918.exe
      4⤵
      PID:3924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8783.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8783.exe
      4⤵
      PID:4320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51815.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51815.exe
      4⤵
      PID:940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60436.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60436.exe
      4⤵
      PID:7324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45618.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45618.exe
      4⤵
      PID:8620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26891.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26891.exe
      4⤵
      PID:9600
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51712.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51712.exe
    3⤵
    PID:1792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17135.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17135.exe
      4⤵
      PID:5404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9895.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9895.exe
      4⤵
      PID:6268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43584.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43584.exe
      4⤵
      PID:7624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50975.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50975.exe
      4⤵
      PID:8904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64461.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64461.exe
      4⤵
      PID:10024
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41519.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41519.exe
    3⤵
    PID:3860
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5983.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5983.exe
    3⤵
    PID:4928
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26614.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26614.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5788
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60966.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60966.exe
    3⤵
    PID:7272
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41153.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41153.exe
    3⤵
    PID:8444
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25.exe
    3⤵
    PID:9464
- C:\Users\Admin\AppData\Local\Temp\Unicorn-21786.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-21786.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2204
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2204 -s 240
    3⤵
    - Program crash
    PID:112
- C:\Users\Admin\AppData\Local\Temp\Unicorn-62257.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-62257.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1692
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8833.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8833.exe
    3⤵
    PID:2908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35526.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35526.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24622.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24622.exe
      4⤵
      PID:5996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63236.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63236.exe
      4⤵
      PID:7256
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2908 -s 216
      4⤵
      PID:8424
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21918.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21918.exe
    3⤵
    PID:3892
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8783.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8783.exe
    3⤵
    PID:4972
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51815.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51815.exe
    3⤵
    PID:6060
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60436.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60436.exe
    3⤵
    PID:7216
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1692 -s 236
    3⤵
    PID:8560
- C:\Users\Admin\AppData\Local\Temp\Unicorn-63723.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-63723.exe
  2⤵
  PID:3008
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17135.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17135.exe
    3⤵
    PID:5388
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9895.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9895.exe
    3⤵
    PID:6252
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43584.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43584.exe
    3⤵
    PID:7632
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50975.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50975.exe
    3⤵
    PID:8884
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35680.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35680.exe
    3⤵
    PID:9876
- C:\Users\Admin\AppData\Local\Temp\Unicorn-62206.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-62206.exe
  2⤵
  PID:4068
- C:\Users\Admin\AppData\Local\Temp\Unicorn-45184.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-45184.exe
  2⤵
  PID:4272
- C:\Users\Admin\AppData\Local\Temp\Unicorn-21014.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-21014.exe
  2⤵
  PID:4640
- C:\Users\Admin\AppData\Local\Temp\Unicorn-10564.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-10564.exe
  2⤵
  PID:7332
- C:\Users\Admin\AppData\Local\Temp\Unicorn-59619.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-59619.exe
  2⤵
  PID:8436
- C:\Users\Admin\AppData\Local\Temp\Unicorn-39226.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-39226.exe
  2⤵
  PID:9480

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-32305.exe

Filesize
468KB

MD5
fd0399dcd5fb6e2f198cc3d87c93a10f

SHA1
5b147d85b97dbb5f9cf3bb5f93d8649590166852

SHA256
7c96bc4ba2a44bff6161b9dd27026383700aed568fb320f5f6b2f7a2144e691f

SHA512
ac1ea70453e31774b72d1d7b1d655c8c8a321ef2672fa39d652ab11e1f21c34e6272ad071402f26d9c8f53233feee917ccfecf606e029a3a13f070f5d046996e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-42397.exe

Filesize
468KB

MD5
32c4b66ec964d3df9df8e2a460679166

SHA1
dffff72fc463e1b94bf3f036dddbe9abda2415ce

SHA256
faa9fc8d0c7ed54f7766339dcb9c200572f7d5416297ebf7a4811f735a0a73ad

SHA512
11a4483ef7fc94f8bc862a43e3e8715a658c508763c3df3428401c02c1b8aacd5841d4b4a6ac775c433b6855832a66b322eb89d12c019f8cdb7156adad4c7990

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-48571.exe

Filesize
468KB

MD5
721e699251c7cd61c39cac5a076d5c4a

SHA1
85b6a5204e87456355da96b2a7492e23b4f4505b

SHA256
f0f800adfb39773c3e444e07a72520df59b4de0d1304612bace65a88135de873

SHA512
1e53be89212882332add9a9a75a5b36f3795bbf64f02193957903063353c82c30fc97aa61f7fc43bac72d88621ca91f271f08a659871a1cee74ec1c540bd36ae

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-61998.exe

Filesize
468KB

MD5
f844b5fcebaf6baf56f9da7bb25f949e

SHA1
9bd7acdc82ce932e112e22614047aab5f50990e1

SHA256
a30db9fe5ebeb1c71818b73edaab0e98ed43ba8f35ad86ebf092f87263e8d055

SHA512
cb6134907229fde06143a0c30e506daa365745e5667328fb9df1e0e1d1b9f9785dfe0596b16f62f889fb4ef2f870a333f68bf2b0ab16299910b14d6d57117b74

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-62263.exe

Filesize
468KB

MD5
e2017de4c7ac563643af3dbd2286f81f

SHA1
03dff0a6081d90efb7b4b61816bb29a550e6ce84

SHA256
1111604df14cb01b0e762613f456af36a6e6cda4da833dc084e54738e8105255

SHA512
feed4b5549c2387886c0a209d02c379aba8e81c1a1b8e6466cd0da0fab96e5b49796ddbf326b265d319e0f37f42b4a342540e5b45e0accf65711ae8d192e6462

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-1344.exe

Filesize
468KB

MD5
ebc5f603b3210928447040fa55e54d1e

SHA1
6c911242b0fc609c3a7b449dc9c8ac6a3bdaf480

SHA256
4ae35c05d5a70abd1947e7ca8d493b65dd18e853f5486fb741d58745e2db70fb

SHA512
c26296eb9ee1b4bd505fcc788b77e8f3d27a058b81274b6e1dde88f9c21514748e9ef836259b087a2d895d035a080587d5f401aeb87f754a75b4055d7b198514

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-13446.exe

Filesize
468KB

MD5
72ae6ccd22aa3d570090b55bb59fa412

SHA1
9362a27865457be91549b0720c6900385aa84f6b

SHA256
511fbb6aaa3d566a483b523cf6ea182eabc8cdd32c6643a0aeca24d96547e53e

SHA512
322551ed6c3a65f71023fb00066ef7237ef617322ee6158ec517e57010e4c1f8e49e1f8e2634cc0315114859a182daa5f50a8490a1685f7054878f383e5f43b9

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-23247.exe

Filesize
468KB

MD5
5111d757670cdae7dea91d9be35a356a

SHA1
177487a9615f99a344e187f07b91878c06e2b85a

SHA256
33bd46bffdba785d3d95caaef7cc3cf7a5e672657c69bda8abcecea6852ddc19

SHA512
7e5a9ca0b851d27dc1c796985fd17763258c4d26af7a4dc3b9a54b0838b30752c17634bfb92ef6dd39012a79d86e853df22172bff1bf66248f3aa6cb078dbe2e

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-29378.exe

Filesize
468KB

MD5
e33e6db4f8742c869ca26fd1ea12d554

SHA1
6e8782bf5ad43b83d3b06329faa670a5170acf89

SHA256
6b872c55d1aa43fefeda88212f47dceb36723a3016a86da7392d3e0a108dd768

SHA512
5fa3b6ca7b034d02e0b46a0c4ec0b6499b961ee6ad73b3d8ac9bd3c6540d216ca30c7db438c023ec94f53abfe7366792c207669978acc6fdd3e9c9d16282ab8c

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-29958.exe

Filesize
468KB

MD5
2b048c7004e0525de092ef2c5672d991

SHA1
f4ad57341702e867141379fb7fb6c6ea0b27007e

SHA256
586a46b9fd0a5aec9d42f6f9c65cbdf6363c2f69e4a8a148b3cae96a9d391d6c

SHA512
4e04fd6278c86c11dc65a927e4c8e8e749cd346125c31fa034b8405533d7672a8a072686c615e6700e0a3ed609fa55ae9725b5b9bd1bba39a70edc3e4301b6d9

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-41878.exe

Filesize
468KB

MD5
4e5c885ec3b215d344a14ec59ce664d4

SHA1
94f28326ba074d57212cbb9687d9f4f32e66ecea

SHA256
62cc4f22b9d9b70b651472a61e2e481b64ff30e5dee4c60eabaf3c756beaa749

SHA512
2a8174f695cb878955591db20bd8e11fd5c9be2e41e634f9df7d1340e816c7d6d706541083b8a58dae13ee458bab35917c8d7d9eaaaf096eb91d1d4e3c599d95

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-42589.exe

Filesize
468KB

MD5
2eeee98fe228dac7b962fcdc02ced4c3

SHA1
ac96f2ac47ff2e21d5e983d79794341565d0c231

SHA256
7fe272bb18a7ab291fb52b2acdd0a6f24dfc3a1b46440357df289c6e4e7427e5

SHA512
8b7e224dd6997dfe892c8f548fcecabdb94be81ee4f9db23d46e192b580f0a98ea646f2458208f8c63780f02fb91a0fd4186fb2b149f65ab34f7bec29a7f20de

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-45740.exe

Filesize
468KB

MD5
0425121fa6356d470227604958666409

SHA1
3e6d78d9919e97409a18c0fc1bcf5882f14b91ba

SHA256
964274a8550bad910c7febfaa52cbc951e1d43bf528fd6a16a492d2c204ca588

SHA512
34752396b0893ec85702d66aa541cdfe3ba3452100734225d0f80ae5e04c4feac9f437a7e4e1cfc8982c4b98a99b7095dd0fe1d286feb46beb291dbed234d267

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-49492.exe

Filesize
468KB

MD5
6eacc3f5b8b3463e6f498632060c5e30

SHA1
adf60cd32b43f7f33fd1b252b607b1314f0902aa

SHA256
b02d65f89eecb0ddcbf202bfe48f46ed38ebcfd223f135e41aca2f74179f8657

SHA512
67ac5bbb5f4b0292bc043a0c4436317ee495f4a20a234603f83c25aac1f0ef2e358081ce817d6849703eab2615b392ba1ef42b55c6aa04633fd120550602fffb

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-52232.exe

Filesize
468KB

MD5
28958d8c54a932ba5ae99498c414dafb

SHA1
d29a5b6aa530e6c7628cfade6340bfd6da64f993

SHA256
a60ee8206b4b9868f918c74995b1162084b1c2197f2a9a75e046b5824a6782bf

SHA512
f352c669035befebbeb3de88fadad2722ff2f746e639b9dbcf195cb0b2d9a05f411ebe4e7212adb0190ef38b35613e1524485635abe2c57dfb5680a1e58a884a

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-5278.exe

Filesize
468KB

MD5
58d4f4898ef66e875f5d6a18485c58b0

SHA1
96ae9e4b59c5e81b569703c355b4d82348263956

SHA256
2f7a956990514978b9faccda02ffe1f555b39d9c0fa963bdb0bc4daa1fcff121

SHA512
27b7b7205816b5c9c80b74a327d26aaf9857a5492a228977dd490fa675f19936ed71c855fd7d1cede3272d74ce5303d7f85cce84be192954948a8e8b901e5d00

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-56133.exe

Filesize
468KB

MD5
001daa9639560f2edf8ef67c52806f1d

SHA1
a78982645cffe4f42af586a8bf5e0fa3c68c8737

SHA256
75447ddf05cded3cf649988984aec081880d602ef1b489843ca8f8eceb7b25bc

SHA512
808821d3f6cdb0e6b5c915c7b2910601c881a9f3a84e5fddd8894e656ab01e8b257eedb19e73b993ff6d9edfac00badeadf144384545e367bb7700d93ccda009

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-57027.exe

Filesize
468KB

MD5
a8a9b88087cbd584c2b3331741060b73

SHA1
c53b2107385de31045e8399752152c5ace8aa127

SHA256
9289b429d867b25e377f0ee0de96c622d4e4f75723ef586351c1e03048a202e1

SHA512
ad09f418fc009d704d9553b39378a1d5255a0e845e7aa2dc6ebe0a6a0de0d77977ecb68a23778812425b6f645800caf7f5bc3f094313806d239adceed6261605

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-62787.exe

Filesize
468KB

MD5
5acb1405a0450507fd3ee5ef510e05c8

SHA1
a92e18431a3ad117ad8f7b964f0a2e67c7a02e26

SHA256
a92436e7c1fde558c8dbd8190acb58488f3fe13ecf0df73ef856b8a668fd986b

SHA512
3cb2ecd34df9af9f0a5ca425c996202fec0dfd4c6944f242aabcc1fd114fa67d7b0082425da3283ad7a6ba08132b0f89b93294f4c793930cefaaf9541b855182

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-789.exe

Filesize
468KB

MD5
f2c19bbbf0e20addf3be95cb47187183

SHA1
637b7fbdcd777c02f74d9ff191359718182cf0b1

SHA256
8c095df3aa2933c82493f4c9e7f265b0e5f9120ef87bd92935c6aaf3ee1b9280

SHA512
b4143562e957a083918d25bc5dfe53f9e8fa2ac3a97940afa25a1cc8d9f4363a363fa90a1c6af1dc173ae601fcb2086adc54567787bd54c68d2aa91936321bf0

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-8822.exe

Filesize
468KB

MD5
dc4a6fdca2d7b8b744bd0904ce149825

SHA1
4763d2399598d95440af4d25004f8f76e772540e

SHA256
f055c6b975b4d253c1410d1511e59788a07efeaae9f85bd6dad0d7dca830538a

SHA512
3567bab3ca549ce6760cb140232d1e23c09320e0481fa70a9b94ad3ffb262bda44661d74c6050dd3932515efcf3f55030a1d6aac036b8d4526aaac046949b112

Download Submit
memory/596-242-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/768-340-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/812-285-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1232-407-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1276-256-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1444-304-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1496-269-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1500-257-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1672-312-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1728-171-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1728-253-0x0000000000620000-0x0000000000695000-memory.dmp

Filesize
468KB

Download
memory/1728-250-0x0000000000620000-0x0000000000695000-memory.dmp

Filesize
468KB

Download
memory/1808-354-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/1808-353-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/1952-383-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1976-241-0x00000000025E0000-0x0000000002655000-memory.dmp

Filesize
468KB

Download
memory/1976-173-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1976-423-0x00000000025E0000-0x0000000002655000-memory.dmp

Filesize
468KB

Download
memory/1976-244-0x00000000025E0000-0x0000000002655000-memory.dmp

Filesize
468KB

Download
memory/2024-43-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2024-32-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2024-102-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2024-310-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2024-311-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2024-376-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2088-210-0x00000000023E0000-0x0000000002455000-memory.dmp

Filesize
468KB

Download
memory/2088-408-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2088-209-0x00000000023E0000-0x0000000002455000-memory.dmp

Filesize
468KB

Download
memory/2088-355-0x00000000023E0000-0x0000000002455000-memory.dmp

Filesize
468KB

Download
memory/2088-95-0x00000000023E0000-0x0000000002455000-memory.dmp

Filesize
468KB

Download
memory/2108-406-0x00000000023F0000-0x0000000002465000-memory.dmp

Filesize
468KB

Download
memory/2108-131-0x00000000023F0000-0x0000000002465000-memory.dmp

Filesize
468KB

Download
memory/2108-80-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2108-229-0x00000000023F0000-0x0000000002465000-memory.dmp

Filesize
468KB

Download
memory/2108-233-0x00000000023F0000-0x0000000002465000-memory.dmp

Filesize
468KB

Download
memory/2144-195-0x0000000001C80000-0x0000000001CF5000-memory.dmp

Filesize
468KB

Download
memory/2144-373-0x0000000001C80000-0x0000000001CF5000-memory.dmp

Filesize
468KB

Download
memory/2144-368-0x0000000001C80000-0x0000000001CF5000-memory.dmp

Filesize
468KB

Download
memory/2144-194-0x0000000001C80000-0x0000000001CF5000-memory.dmp

Filesize
468KB

Download
memory/2196-377-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2204-283-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2232-302-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2348-30-0x00000000024A0000-0x0000000002515000-memory.dmp

Filesize
468KB

Download
memory/2348-281-0x00000000024A0000-0x0000000002515000-memory.dmp

Filesize
468KB

Download
memory/2348-338-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2348-6-0x00000000024A0000-0x0000000002515000-memory.dmp

Filesize
468KB

Download
memory/2348-415-0x00000000024A0000-0x0000000002515000-memory.dmp

Filesize
468KB

Download
memory/2348-361-0x00000000024A0000-0x0000000002515000-memory.dmp

Filesize
468KB

Download
memory/2348-273-0x00000000024A0000-0x0000000002515000-memory.dmp

Filesize
468KB

Download
memory/2348-375-0x00000000024A0000-0x0000000002515000-memory.dmp

Filesize
468KB

Download
memory/2348-165-0x00000000024A0000-0x0000000002515000-memory.dmp

Filesize
468KB

Download
memory/2348-59-0x00000000024A0000-0x0000000002515000-memory.dmp

Filesize
468KB

Download
memory/2348-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2472-365-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2472-284-0x0000000002400000-0x0000000002475000-memory.dmp

Filesize
468KB

Download
memory/2472-166-0x0000000002400000-0x0000000002475000-memory.dmp

Filesize
468KB

Download
memory/2472-31-0x0000000002400000-0x0000000002475000-memory.dmp

Filesize
468KB

Download
memory/2472-299-0x0000000002400000-0x0000000002475000-memory.dmp

Filesize
468KB

Download
memory/2492-303-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2504-133-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2504-254-0x0000000002C60000-0x0000000002CD5000-memory.dmp

Filesize
468KB

Download
memory/2504-255-0x0000000002130000-0x00000000021A5000-memory.dmp

Filesize
468KB

Download
memory/2548-366-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2556-359-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2620-358-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2668-163-0x0000000002550000-0x00000000025C5000-memory.dmp

Filesize
468KB

Download
memory/2668-264-0x0000000002550000-0x00000000025C5000-memory.dmp

Filesize
468KB

Download
memory/2668-78-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2756-289-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2756-301-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2756-170-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2764-418-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2772-248-0x00000000033E0000-0x0000000003455000-memory.dmp

Filesize
468KB

Download
memory/2772-179-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2772-252-0x00000000033E0000-0x0000000003455000-memory.dmp

Filesize
468KB

Download
memory/2876-211-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2876-336-0x00000000023F0000-0x0000000002465000-memory.dmp

Filesize
468KB

Download
memory/2884-129-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2884-221-0x00000000028F0000-0x0000000002965000-memory.dmp

Filesize
468KB

Download
memory/2884-222-0x00000000028F0000-0x0000000002965000-memory.dmp

Filesize
468KB

Download
memory/2940-390-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2988-63-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2988-287-0x00000000027E0000-0x0000000002855000-memory.dmp

Filesize
468KB

Download
memory/2988-130-0x0000000003310000-0x0000000003385000-memory.dmp

Filesize
468KB

Download
memory/2988-300-0x00000000027E0000-0x0000000002855000-memory.dmp

Filesize
468KB

Download
memory/2988-416-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3056-280-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/3056-34-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3056-164-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/3056-76-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/3056-417-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/3056-167-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/3056-382-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3056-271-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/3060-389-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/3064-223-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download