fd49bea47ce78693648c3a2de9f2b33560d464ad75d502b9005e7d695f8fbd6c

Analysis

max time kernel
150s
max time network
119s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
15/09/2024, 03:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

fd49bea47ce78693648c3a2de9f2b33560d464ad75d502b9005e7d695f8fbd6c.exe
Size

468KB
MD5

39d71a9c9b59ae68b6e0a99b974f013c
SHA1

183245f7edc584c36fa42ac8b172a1a6af7e100d
SHA256

fd49bea47ce78693648c3a2de9f2b33560d464ad75d502b9005e7d695f8fbd6c
SHA512

30425a674354f51898854b1ac96f164bfd85df78a219c8e777652b0565fc0281c280707f04bef06b9c99e1b332428de5296c24908016e84a12312af80e547c7d
SSDEEP

3072:1U3HogISIE5TtbYEHzcOcf8/zCcaP0pkJVHeTVPlOMYLZ7QgmflL:1U3obMTtrH4OcfVY1fOMitQgm

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2824	Unicorn-26190.exe
2712	Unicorn-65354.exe
2856	Unicorn-22698.exe
2768	Unicorn-29740.exe
2716	Unicorn-10153.exe
2228	Unicorn-45941.exe
604	Unicorn-9163.exe
964	Unicorn-42833.exe
2428	Unicorn-6631.exe
2548	Unicorn-59662.exe
1288	Unicorn-22199.exe
1792	Unicorn-43134.exe
1640	Unicorn-51887.exe
772	Unicorn-58017.exe
2136	Unicorn-57752.exe
2340	Unicorn-3497.exe
2576	Unicorn-48977.exe
3068	Unicorn-19450.exe
1328	Unicorn-59313.exe
1028	Unicorn-48915.exe
2016	Unicorn-35209.exe
1320	Unicorn-54883.exe
2244	Unicorn-21827.exe
1864	Unicorn-6559.exe
2376	Unicorn-21369.exe
2988	Unicorn-64513.exe
920	Unicorn-5526.exe
1660	Unicorn-16461.exe
2084	Unicorn-32774.exe
2688	Unicorn-45389.exe
2792	Unicorn-17673.exe
1612	Unicorn-17673.exe
2744	Unicorn-30479.exe
2728	Unicorn-17289.exe
2936	Unicorn-17023.exe
2696	Unicorn-34502.exe
2124	Unicorn-62576.exe
2668	Unicorn-59783.exe
2148	Unicorn-11367.exe
600	Unicorn-27054.exe
796	Unicorn-2680.exe
1496	Unicorn-10334.exe
2132	Unicorn-35208.exe
2204	Unicorn-1466.exe
2844	Unicorn-13889.exe
2044	Unicorn-33755.exe
2356	Unicorn-20033.exe
2904	Unicorn-30335.exe
1788	Unicorn-39266.exe
1060	Unicorn-49280.exe
2024	Unicorn-55410.exe
316	Unicorn-16223.exe
2952	Unicorn-45896.exe
2336	Unicorn-37978.exe
1668	Unicorn-51714.exe
2252	Unicorn-21450.exe
1140	Unicorn-57844.exe
1768	Unicorn-40932.exe
904	Unicorn-51026.exe
2484	Unicorn-59956.exe
1692	Unicorn-39706.exe
2808	Unicorn-58695.exe
2624	Unicorn-38445.exe
2784	Unicorn-58311.exe

Loads dropped DLL 64 IoCs

pid	Process
2480	fd49bea47ce78693648c3a2de9f2b33560d464ad75d502b9005e7d695f8fbd6c.exe
2480	fd49bea47ce78693648c3a2de9f2b33560d464ad75d502b9005e7d695f8fbd6c.exe
2480	fd49bea47ce78693648c3a2de9f2b33560d464ad75d502b9005e7d695f8fbd6c.exe
2480	fd49bea47ce78693648c3a2de9f2b33560d464ad75d502b9005e7d695f8fbd6c.exe
2824	Unicorn-26190.exe
2824	Unicorn-26190.exe
2712	Unicorn-65354.exe
2712	Unicorn-65354.exe
2480	fd49bea47ce78693648c3a2de9f2b33560d464ad75d502b9005e7d695f8fbd6c.exe
2480	fd49bea47ce78693648c3a2de9f2b33560d464ad75d502b9005e7d695f8fbd6c.exe
2856	Unicorn-22698.exe
2856	Unicorn-22698.exe
2824	Unicorn-26190.exe
2824	Unicorn-26190.exe
2768	Unicorn-29740.exe
2768	Unicorn-29740.exe
2712	Unicorn-65354.exe
2712	Unicorn-65354.exe
2228	Unicorn-45941.exe
2228	Unicorn-45941.exe
2856	Unicorn-22698.exe
2856	Unicorn-22698.exe
2716	Unicorn-10153.exe
2716	Unicorn-10153.exe
2480	fd49bea47ce78693648c3a2de9f2b33560d464ad75d502b9005e7d695f8fbd6c.exe
2824	Unicorn-26190.exe
604	Unicorn-9163.exe
604	Unicorn-9163.exe
2824	Unicorn-26190.exe
2480	fd49bea47ce78693648c3a2de9f2b33560d464ad75d502b9005e7d695f8fbd6c.exe
964	Unicorn-42833.exe
964	Unicorn-42833.exe
2768	Unicorn-29740.exe
2768	Unicorn-29740.exe
2428	Unicorn-6631.exe
2428	Unicorn-6631.exe
2712	Unicorn-65354.exe
2712	Unicorn-65354.exe
2548	Unicorn-59662.exe
2548	Unicorn-59662.exe
2228	Unicorn-45941.exe
2228	Unicorn-45941.exe
1640	Unicorn-51887.exe
1640	Unicorn-51887.exe
1288	Unicorn-22199.exe
1288	Unicorn-22199.exe
2136	Unicorn-57752.exe
2136	Unicorn-57752.exe
2824	Unicorn-26190.exe
2824	Unicorn-26190.exe
1372	WerFault.exe
1372	WerFault.exe
1372	WerFault.exe
1372	WerFault.exe
1880	WerFault.exe
1880	WerFault.exe
1880	WerFault.exe
1880	WerFault.exe
2856	Unicorn-22698.exe
2856	Unicorn-22698.exe
604	Unicorn-9163.exe
604	Unicorn-9163.exe
2480	fd49bea47ce78693648c3a2de9f2b33560d464ad75d502b9005e7d695f8fbd6c.exe
2480	fd49bea47ce78693648c3a2de9f2b33560d464ad75d502b9005e7d695f8fbd6c.exe

Program crash 64 IoCs

pid	pid_target	Process	procid_target
1372	1792	WerFault.exe	41
1880	772	WerFault.exe	44
1524	2716	WerFault.exe	34
2036	920	WerFault.exe	58
2344	2084	WerFault.exe	61
1672	2688	WerFault.exe	62
1708	2792	WerFault.exe	63
2164	3068	WerFault.exe	47
2440	2952	WerFault.exe	86
2948	2160	WerFault.exe	103
2648	628	WerFault.exe	110
1492	2208	WerFault.exe	128
3164	2148	WerFault.exe	71
3184	1496	WerFault.exe	74
3224	1456	WerFault.exe	115
3232	2348	WerFault.exe	134
3216	904	WerFault.exe	96
3272	2848	WerFault.exe	118
3304	1272	WerFault.exe	159
3320	1828	WerFault.exe	119
3736	2828	WerFault.exe	124
3264	1100	WerFault.exe	137
3856	2784	WerFault.exe	101
4064	2672	WerFault.exe	169
3116	336	WerFault.exe	136
4080	2504	WerFault.exe	145
3152	1036	WerFault.exe	143
3988	2484	WerFault.exe	97
3088	2988	WerFault.exe	57
4152	2276	WerFault.exe	107
5036	2028	WerFault.exe	133
5064	2356	WerFault.exe	79
5072	2904	WerFault.exe	81
5104	2044	WerFault.exe	78
4100	2204	WerFault.exe	76
5096	2268	WerFault.exe	114
4552	1620	WerFault.exe	121
4624	2684	WerFault.exe	161
4216	1060	WerFault.exe	82
4204	1576	WerFault.exe	104
4236	2644	WerFault.exe	125
4252	2332	WerFault.exe	127
4260	1008	WerFault.exe	180
4708	2844	WerFault.exe	77
4296	2176	WerFault.exe	166
4564	2608	WerFault.exe	141
4660	2132	WerFault.exe	75
4148	1720	WerFault.exe	177
4916	2468	WerFault.exe	155
4896	2852	WerFault.exe	139
4136	2756	WerFault.exe	140
4396	2320	WerFault.exe	138
4616	2692	WerFault.exe	108
5500	2252	WerFault.exe	93
5532	908	WerFault.exe	144
5544	2884	WerFault.exe	156
5672	1028	WerFault.exe	49
5704	1328	WerFault.exe	48
5732	2052	WerFault.exe	120
5744	2624	WerFault.exe	100
5752	2668	WerFault.exe	70
5760	444	WerFault.exe	116
5768	1964	WerFault.exe	150
5776	2424	WerFault.exe	146

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7813.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38227.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31901.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50526.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31657.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20331.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60595.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38199.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52378.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48809.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10989.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6556.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9795.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59077.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15740.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30468.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39741.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39446.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18944.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15030.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37712.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61550.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35276.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60157.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24142.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37667.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13613.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24458.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35057.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30368.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59783.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47309.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20913.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18514.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43585.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23782.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TempéUnicorn-33460.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58311.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36930.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13236.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6763.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36010.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51417.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32407.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26546.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38165.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2274.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16744.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64635.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4796.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39062.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25366.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10661.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36433.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16887.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62460.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46087.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55368.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19540.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52617.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62076.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1996.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16079.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2480	fd49bea47ce78693648c3a2de9f2b33560d464ad75d502b9005e7d695f8fbd6c.exe
2824	Unicorn-26190.exe
2712	Unicorn-65354.exe
2856	Unicorn-22698.exe
2768	Unicorn-29740.exe
2228	Unicorn-45941.exe
2716	Unicorn-10153.exe
604	Unicorn-9163.exe
964	Unicorn-42833.exe
2428	Unicorn-6631.exe
2548	Unicorn-59662.exe
1640	Unicorn-51887.exe
1288	Unicorn-22199.exe
1792	Unicorn-43134.exe
772	Unicorn-58017.exe
2136	Unicorn-57752.exe
2340	Unicorn-3497.exe
3068	Unicorn-19450.exe
2576	Unicorn-48977.exe
1328	Unicorn-59313.exe
1028	Unicorn-48915.exe
1320	Unicorn-54883.exe
2016	Unicorn-35209.exe
2244	Unicorn-21827.exe
1864	Unicorn-6559.exe
2376	Unicorn-21369.exe
920	Unicorn-5526.exe
1660	Unicorn-16461.exe
2988	Unicorn-64513.exe
2084	Unicorn-32774.exe
2688	Unicorn-45389.exe
1612	Unicorn-17673.exe
2792	Unicorn-17673.exe
2744	Unicorn-30479.exe
2728	Unicorn-17289.exe
2936	Unicorn-17023.exe
2696	Unicorn-34502.exe
2124	Unicorn-62576.exe
2668	Unicorn-59783.exe
2148	Unicorn-11367.exe
796	Unicorn-2680.exe
600	Unicorn-27054.exe
1496	Unicorn-10334.exe
2132	Unicorn-35208.exe
2204	Unicorn-1466.exe
2844	Unicorn-13889.exe
2044	Unicorn-33755.exe
2356	Unicorn-20033.exe
2904	Unicorn-30335.exe
1788	Unicorn-39266.exe
2024	Unicorn-55410.exe
1060	Unicorn-49280.exe
316	Unicorn-16223.exe
2952	Unicorn-45896.exe
2336	Unicorn-37978.exe
1668	Unicorn-51714.exe
2252	Unicorn-21450.exe
1140	Unicorn-57844.exe
2484	Unicorn-59956.exe
1768	Unicorn-40932.exe
904	Unicorn-51026.exe
2808	Unicorn-58695.exe
1692	Unicorn-39706.exe
2784	Unicorn-58311.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2480 wrote to memory of 2824	2480	fd49bea47ce78693648c3a2de9f2b33560d464ad75d502b9005e7d695f8fbd6c.exe	30
PID 2480 wrote to memory of 2824	2480	fd49bea47ce78693648c3a2de9f2b33560d464ad75d502b9005e7d695f8fbd6c.exe	30
PID 2480 wrote to memory of 2824	2480	fd49bea47ce78693648c3a2de9f2b33560d464ad75d502b9005e7d695f8fbd6c.exe	30
PID 2480 wrote to memory of 2824	2480	fd49bea47ce78693648c3a2de9f2b33560d464ad75d502b9005e7d695f8fbd6c.exe	30
PID 2480 wrote to memory of 2712	2480	fd49bea47ce78693648c3a2de9f2b33560d464ad75d502b9005e7d695f8fbd6c.exe	31
PID 2480 wrote to memory of 2712	2480	fd49bea47ce78693648c3a2de9f2b33560d464ad75d502b9005e7d695f8fbd6c.exe	31
PID 2480 wrote to memory of 2712	2480	fd49bea47ce78693648c3a2de9f2b33560d464ad75d502b9005e7d695f8fbd6c.exe	31
PID 2480 wrote to memory of 2712	2480	fd49bea47ce78693648c3a2de9f2b33560d464ad75d502b9005e7d695f8fbd6c.exe	31
PID 2824 wrote to memory of 2856	2824	Unicorn-26190.exe	32
PID 2824 wrote to memory of 2856	2824	Unicorn-26190.exe	32
PID 2824 wrote to memory of 2856	2824	Unicorn-26190.exe	32
PID 2824 wrote to memory of 2856	2824	Unicorn-26190.exe	32
PID 2712 wrote to memory of 2768	2712	Unicorn-65354.exe	33
PID 2712 wrote to memory of 2768	2712	Unicorn-65354.exe	33
PID 2712 wrote to memory of 2768	2712	Unicorn-65354.exe	33
PID 2712 wrote to memory of 2768	2712	Unicorn-65354.exe	33
PID 2480 wrote to memory of 2716	2480	fd49bea47ce78693648c3a2de9f2b33560d464ad75d502b9005e7d695f8fbd6c.exe	34
PID 2480 wrote to memory of 2716	2480	fd49bea47ce78693648c3a2de9f2b33560d464ad75d502b9005e7d695f8fbd6c.exe	34
PID 2480 wrote to memory of 2716	2480	fd49bea47ce78693648c3a2de9f2b33560d464ad75d502b9005e7d695f8fbd6c.exe	34
PID 2480 wrote to memory of 2716	2480	fd49bea47ce78693648c3a2de9f2b33560d464ad75d502b9005e7d695f8fbd6c.exe	34
PID 2856 wrote to memory of 2228	2856	Unicorn-22698.exe	35
PID 2856 wrote to memory of 2228	2856	Unicorn-22698.exe	35
PID 2856 wrote to memory of 2228	2856	Unicorn-22698.exe	35
PID 2856 wrote to memory of 2228	2856	Unicorn-22698.exe	35
PID 2824 wrote to memory of 604	2824	Unicorn-26190.exe	36
PID 2824 wrote to memory of 604	2824	Unicorn-26190.exe	36
PID 2824 wrote to memory of 604	2824	Unicorn-26190.exe	36
PID 2824 wrote to memory of 604	2824	Unicorn-26190.exe	36
PID 2768 wrote to memory of 964	2768	Unicorn-29740.exe	37
PID 2768 wrote to memory of 964	2768	Unicorn-29740.exe	37
PID 2768 wrote to memory of 964	2768	Unicorn-29740.exe	37
PID 2768 wrote to memory of 964	2768	Unicorn-29740.exe	37
PID 2712 wrote to memory of 2428	2712	Unicorn-65354.exe	38
PID 2712 wrote to memory of 2428	2712	Unicorn-65354.exe	38
PID 2712 wrote to memory of 2428	2712	Unicorn-65354.exe	38
PID 2712 wrote to memory of 2428	2712	Unicorn-65354.exe	38
PID 2228 wrote to memory of 2548	2228	Unicorn-45941.exe	39
PID 2228 wrote to memory of 2548	2228	Unicorn-45941.exe	39
PID 2228 wrote to memory of 2548	2228	Unicorn-45941.exe	39
PID 2228 wrote to memory of 2548	2228	Unicorn-45941.exe	39
PID 2856 wrote to memory of 1288	2856	Unicorn-22698.exe	40
PID 2856 wrote to memory of 1288	2856	Unicorn-22698.exe	40
PID 2856 wrote to memory of 1288	2856	Unicorn-22698.exe	40
PID 2856 wrote to memory of 1288	2856	Unicorn-22698.exe	40
PID 2716 wrote to memory of 1792	2716	Unicorn-10153.exe	41
PID 2716 wrote to memory of 1792	2716	Unicorn-10153.exe	41
PID 2716 wrote to memory of 1792	2716	Unicorn-10153.exe	41
PID 2716 wrote to memory of 1792	2716	Unicorn-10153.exe	41
PID 604 wrote to memory of 772	604	Unicorn-9163.exe	44
PID 604 wrote to memory of 772	604	Unicorn-9163.exe	44
PID 604 wrote to memory of 772	604	Unicorn-9163.exe	44
PID 604 wrote to memory of 772	604	Unicorn-9163.exe	44
PID 2824 wrote to memory of 1640	2824	Unicorn-26190.exe	43
PID 2824 wrote to memory of 1640	2824	Unicorn-26190.exe	43
PID 2824 wrote to memory of 1640	2824	Unicorn-26190.exe	43
PID 2824 wrote to memory of 1640	2824	Unicorn-26190.exe	43
PID 2480 wrote to memory of 2136	2480	fd49bea47ce78693648c3a2de9f2b33560d464ad75d502b9005e7d695f8fbd6c.exe	42
PID 2480 wrote to memory of 2136	2480	fd49bea47ce78693648c3a2de9f2b33560d464ad75d502b9005e7d695f8fbd6c.exe	42
PID 2480 wrote to memory of 2136	2480	fd49bea47ce78693648c3a2de9f2b33560d464ad75d502b9005e7d695f8fbd6c.exe	42
PID 2480 wrote to memory of 2136	2480	fd49bea47ce78693648c3a2de9f2b33560d464ad75d502b9005e7d695f8fbd6c.exe	42
PID 964 wrote to memory of 2340	964	Unicorn-42833.exe	45
PID 964 wrote to memory of 2340	964	Unicorn-42833.exe	45
PID 964 wrote to memory of 2340	964	Unicorn-42833.exe	45
PID 964 wrote to memory of 2340	964	Unicorn-42833.exe	45

C:\Users\Admin\AppData\Local\Temp\fd49bea47ce78693648c3a2de9f2b33560d464ad75d502b9005e7d695f8fbd6c.exe
"C:\Users\Admin\AppData\Local\Temp\fd49bea47ce78693648c3a2de9f2b33560d464ad75d502b9005e7d695f8fbd6c.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2480
- C:\Users\Admin\AppData\Local\Temp\Unicorn-26190.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-26190.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2824
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22698.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22698.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45941.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45941.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59662.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:2548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48915.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17289.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58695.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43885.exe
        9⤵
        
        PID:2992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52617.exe
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:3392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2297.exe
        11⤵
        
        PID:7780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45342.exe
        11⤵
        
        PID:8456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23756.exe
        11⤵
        
        PID:10016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38681.exe
        11⤵
        
        PID:10640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64421.exe
        10⤵
        
        PID:4288
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2992 -s 244
        10⤵
        
        PID:6224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12606.exe
        9⤵
        
        PID:3780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49578.exe
        10⤵
        
        PID:7820
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3780 -s 228
        10⤵
        
        PID:8944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45567.exe
        9⤵
        
        PID:4848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20574.exe
        9⤵
        
        PID:6324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29406.exe
        9⤵
        
        PID:7536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26738.exe
        9⤵
        
        PID:8396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47518.exe
        9⤵
        
        PID:8564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11824.exe
        9⤵
        
        PID:9708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4033.exe
        9⤵
        
        PID:10476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36930.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:336
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 336 -s 224
        9⤵
        Program crash
        
        PID:3116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2626.exe
        8⤵
        
        PID:3432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23782.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:8620
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3432 -s 216
        9⤵
        
        PID:9368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24484.exe
        8⤵
        
        PID:4704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52885.exe
        8⤵
        
        PID:6516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22736.exe
        8⤵
        
        PID:7824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53765.exe
        8⤵
        
        PID:9012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28805.exe
        8⤵
        
        PID:9784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6489.exe
        8⤵
        
        PID:9948
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2728 -s 248
        8⤵
        
        PID:10868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38445.exe
        7⤵
        Executes dropped EXE
        
        PID:2624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59666.exe
        8⤵
        
        PID:1504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58300.exe
        9⤵
        
        PID:4596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36938.exe
        9⤵
        
        PID:6036
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1504 -s 240
        9⤵
        
        PID:6544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1190.exe
        8⤵
        
        PID:3344
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2624 -s 244
        8⤵
        Program crash
        
        PID:5744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51315.exe
        7⤵
        
        PID:824
        
        C:\Users\Admin\AppData\Local\TempéUnicorn-16744.exe
        
        C:\Users\Admin\AppData\Local\TempéUnicorn-16744.exe
        8⤵
        
        PID:4160
        
        C:\Users\Admin\AppData\Local\TempéUnicorn-40467.exe
        
        C:\Users\Admin\AppData\Local\TempéUnicorn-40467.exe
        8⤵
        
        PID:5208
        
        C:\Users\Admin\AppData\Local\TempéUnicorn-15016.exe
        
        C:\Users\Admin\AppData\Local\TempéUnicorn-15016.exe
        8⤵
        
        PID:6332
        
        C:\Users\Admin\AppData\Local\TempéUnicorn-52250.exe
        
        C:\Users\Admin\AppData\Local\TempéUnicorn-52250.exe
        8⤵
        
        PID:7868
        
        C:\Users\Admin\AppData\Local\TempéUnicorn-31206.exe
        
        C:\Users\Admin\AppData\Local\TempéUnicorn-31206.exe
        8⤵
        
        PID:8760
        
        C:\Users\Admin\AppData\Local\TempéUnicorn-33460.exe
        
        C:\Users\Admin\AppData\Local\TempéUnicorn-33460.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:9712
        
        C:\Users\Admin\AppData\Local\TempéUnicorn-14136.exe
        
        C:\Users\Admin\AppData\Local\TempéUnicorn-14136.exe
        8⤵
        
        PID:10608
        
        C:\Users\Admin\AppData\Local\TempéUnicorn-43626.exe
        
        C:\Users\Admin\AppData\Local\TempéUnicorn-43626.exe
        8⤵
        
        PID:11276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4921.exe
        7⤵
        
        PID:3552
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1028 -s 244
        7⤵
        Program crash
        
        PID:5672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62576.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41591.exe
        7⤵
        
        PID:1688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42391.exe
        8⤵
        
        PID:1440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37712.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:4180
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1440 -s 228
        9⤵
        
        PID:6644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4179.exe
        8⤵
        
        PID:4420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18193.exe
        8⤵
        
        PID:5964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9490.exe
        8⤵
        
        PID:6564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34466.exe
        8⤵
        
        PID:8136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15366.exe
        8⤵
        
        PID:8412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20567.exe
        8⤵
        
        PID:10228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45973.exe
        8⤵
        
        PID:11144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22780.exe
        8⤵
        
        PID:10852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57502.exe
        7⤵
        
        PID:996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25818.exe
        8⤵
        
        PID:4664
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 996 -s 228
        8⤵
        
        PID:6668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24458.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28828.exe
        7⤵
        
        PID:6004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-825.exe
        7⤵
        
        PID:6704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17931.exe
        7⤵
        
        PID:8128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32432.exe
        7⤵
        
        PID:8364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64574.exe
        7⤵
        
        PID:10236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40638.exe
        7⤵
        
        PID:11080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43508.exe
        7⤵
        
        PID:10660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54485.exe
        6⤵
        
        PID:792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54404.exe
        7⤵
        
        PID:640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16744.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4176
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 640 -s 248
        8⤵
        
        PID:6136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39264.exe
        7⤵
        
        PID:4188
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 792 -s 220
        7⤵
        
        PID:5828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25982.exe
        6⤵
        
        PID:1720
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1720 -s 224
        7⤵
        Program crash
        
        PID:4148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15306.exe
        6⤵
        
        PID:4376
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2548 -s 248
        6⤵
        
        PID:5904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35209.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39266.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19251.exe
        7⤵
        
        PID:2828
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2828 -s 240
        8⤵
        Program crash
        
        PID:3736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48330.exe
        7⤵
        
        PID:3784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60996.exe
        8⤵
        
        PID:6424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13184.exe
        8⤵
        
        PID:8000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49788.exe
        8⤵
        
        PID:8808
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3784 -s 228
        8⤵
        
        PID:10272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47863.exe
        7⤵
        
        PID:4328
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1788 -s 248
        7⤵
        
        PID:5240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34304.exe
        6⤵
        
        PID:2652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42882.exe
        7⤵
        
        PID:4044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47495.exe
        8⤵
        
        PID:8172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31234.exe
        8⤵
        
        PID:9292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38062.exe
        8⤵
        
        PID:10948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55669.exe
        8⤵
        
        PID:6468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5952.exe
        7⤵
        
        PID:4908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55685.exe
        7⤵
        
        PID:6580
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2652 -s 228
        7⤵
        
        PID:7924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27384.exe
        6⤵
        
        PID:3916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43055.exe
        7⤵
        
        PID:7552
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3916 -s 228
        7⤵
        
        PID:1796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51432.exe
        6⤵
        
        PID:4768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11909.exe
        6⤵
        
        PID:6344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12871.exe
        6⤵
        
        PID:7520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10747.exe
        6⤵
        
        PID:8432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25987.exe
        6⤵
        
        PID:8824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6489.exe
        6⤵
        
        PID:9476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8233.exe
        6⤵
        
        PID:10620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49280.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4585.exe
        6⤵
        
        PID:2332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52150.exe
        7⤵
        
        PID:3144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51425.exe
        8⤵
        
        PID:7192
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3144 -s 248
        8⤵
        
        PID:8296
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2332 -s 228
        7⤵
        Program crash
        
        PID:4252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17868.exe
        6⤵
        
        PID:3352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10989.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7564
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3352 -s 228
        7⤵
        
        PID:9168
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1060 -s 244
        6⤵
        Program crash
        
        PID:4216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42660.exe
        5⤵
        
        PID:2208
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2208 -s 224
        6⤵
        Program crash
        
        PID:1492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18276.exe
        5⤵
        
        PID:1904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51400.exe
        6⤵
        
        PID:6292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19540.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55866.exe
        6⤵
        
        PID:8332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64942.exe
        6⤵
        
        PID:8832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20956.exe
        6⤵
        
        PID:9852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13480.exe
        6⤵
        
        PID:5844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2082.exe
        5⤵
        
        PID:4780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28638.exe
        5⤵
        
        PID:5172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51796.exe
        5⤵
        
        PID:6252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42277.exe
        5⤵
        
        PID:7580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40399.exe
        5⤵
        
        PID:9204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60944.exe
        5⤵
        
        PID:10052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11071.exe
        5⤵
        
        PID:4948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24859.exe
        5⤵
        
        PID:10796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22199.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22199.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:1288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21827.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2680.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27943.exe
        7⤵
        
        PID:1576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44269.exe
        8⤵
        
        PID:3036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60271.exe
        9⤵
        
        PID:4048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59349.exe
        10⤵
        
        PID:7204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52378.exe
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:8508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6309.exe
        10⤵
        
        PID:9408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45271.exe
        10⤵
        
        PID:11232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31134.exe
        10⤵
        
        PID:10900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64613.exe
        9⤵
        
        PID:4232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29701.exe
        9⤵
        
        PID:6108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55368.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:7304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20092.exe
        9⤵
        
        PID:8156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39741.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:8796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21486.exe
        9⤵
        
        PID:9320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9015.exe
        9⤵
        
        PID:10416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49005.exe
        8⤵
        
        PID:3096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16340.exe
        9⤵
        
        PID:8060
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3096 -s 228
        9⤵
        
        PID:9192
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1576 -s 244
        8⤵
        Program crash
        
        PID:4204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18674.exe
        7⤵
        
        PID:2028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16883.exe
        8⤵
        
        PID:3744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12220.exe
        9⤵
        
        PID:6248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6510.exe
        9⤵
        
        PID:7932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48926.exe
        9⤵
        
        PID:9180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23119.exe
        9⤵
        
        PID:10076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34192.exe
        9⤵
        
        PID:10664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7033.exe
        9⤵
        
        PID:10428
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2028 -s 216
        8⤵
        Program crash
        
        PID:5036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32407.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38251.exe
        8⤵
        
        PID:6392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5348.exe
        8⤵
        
        PID:7472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65335.exe
        8⤵
        
        PID:8232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53944.exe
        8⤵
        
        PID:10096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13606.exe
        8⤵
        
        PID:5868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48091.exe
        8⤵
        
        PID:7668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15518.exe
        7⤵
        
        PID:4404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51403.exe
        7⤵
        
        PID:6028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61218.exe
        7⤵
        
        PID:6088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44115.exe
        7⤵
        
        PID:7756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10206.exe
        7⤵
        
        PID:8568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23660.exe
        7⤵
        
        PID:9888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57008.exe
        7⤵
        
        PID:10484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14756.exe
        7⤵
        
        PID:7656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43380.exe
        6⤵
        
        PID:2224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40735.exe
        7⤵
        
        PID:2608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25285.exe
        8⤵
        
        PID:3172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32482.exe
        9⤵
        
        PID:8344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28245.exe
        9⤵
        
        PID:10124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38062.exe
        9⤵
        
        PID:10960
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3172 -s 228
        9⤵
        
        PID:10508
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2608 -s 236
        8⤵
        Program crash
        
        PID:4564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6763.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11351.exe
        8⤵
        
        PID:8248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37161.exe
        8⤵
        
        PID:9384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6723.exe
        8⤵
        
        PID:11020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54171.exe
        7⤵
        
        PID:4372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61550.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6548
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2224 -s 244
        7⤵
        
        PID:7952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26675.exe
        6⤵
        
        PID:2504
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2504 -s 224
        7⤵
        Program crash
        
        PID:4080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58761.exe
        6⤵
        
        PID:4000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40310.exe
        7⤵
        
        PID:8596
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4000 -s 216
        7⤵
        
        PID:9352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16887.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36349.exe
        6⤵
        
        PID:6528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39802.exe
        6⤵
        
        PID:7836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32234.exe
        6⤵
        
        PID:9004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23470.exe
        6⤵
        
        PID:9776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10689.exe
        6⤵
        
        PID:9620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46034.exe
        6⤵
        
        PID:5864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10334.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15774.exe
        6⤵
        
        PID:1436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62759.exe
        7⤵
        
        PID:3100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51921.exe
        8⤵
        
        PID:5428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61286.exe
        8⤵
        
        PID:6716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38165.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:7808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5663.exe
        8⤵
        
        PID:8260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45279.exe
        8⤵
        
        PID:10152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62608.exe
        8⤵
        
        PID:5808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65157.exe
        8⤵
        
        PID:6384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56115.exe
        7⤵
        
        PID:4832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30907.exe
        7⤵
        
        PID:5200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15925.exe
        7⤵
        
        PID:6264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43040.exe
        7⤵
        
        PID:7568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45999.exe
        7⤵
        
        PID:8448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45809.exe
        7⤵
        
        PID:10196
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1436 -s 248
        7⤵
        
        PID:5876
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1496 -s 236
        6⤵
        Program crash
        
        PID:3184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24142.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17568.exe
        6⤵
        
        PID:3384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15100.exe
        7⤵
        
        PID:6360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7579.exe
        7⤵
        
        PID:7988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17488.exe
        7⤵
        
        PID:8272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46300.exe
        7⤵
        
        PID:10184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1437.exe
        7⤵
        
        PID:11116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49108.exe
        7⤵
        
        PID:11000
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2268 -s 248
        6⤵
        Program crash
        
        PID:5096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2502.exe
        5⤵
        
        PID:3668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6688.exe
        6⤵
        
        PID:6396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50864.exe
        6⤵
        
        PID:7444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47343.exe
        6⤵
        
        PID:8640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17394.exe
        6⤵
        
        PID:9324
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3668 -s 228
        6⤵
        
        PID:10824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7813.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5112
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1288 -s 248
        5⤵
        
        PID:5396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64513.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64513.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1466.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36433.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1828
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1828 -s 224
        7⤵
        Program crash
        
        PID:3320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19383.exe
        6⤵
        
        PID:3208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30093.exe
        7⤵
        
        PID:6772
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3208 -s 216
        7⤵
        
        PID:7592
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2204 -s 244
        6⤵
        Program crash
        
        PID:4100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62919.exe
        5⤵
        
        PID:2052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56978.exe
        6⤵
        
        PID:2288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60498.exe
        7⤵
        
        PID:4820
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2288 -s 228
        7⤵
        
        PID:5256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15030.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3424
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2052 -s 244
        6⤵
        Program crash
        
        PID:5732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36240.exe
        5⤵
        
        PID:3008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35275.exe
        6⤵
        
        PID:4580
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3008 -s 248
        6⤵
        
        PID:5196
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2988 -s 248
        5⤵
        Program crash
        
        PID:3088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20033.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20033.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3952.exe
        5⤵
        
        PID:1456
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1456 -s 224
        6⤵
        Program crash
        
        PID:3224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47095.exe
        5⤵
        
        PID:3288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3029.exe
        6⤵
        
        PID:5628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35767.exe
        6⤵
        
        PID:7360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7241.exe
        6⤵
        
        PID:8284
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3288 -s 228
        6⤵
        
        PID:8952
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2356 -s 244
        5⤵
        Program crash
        
        PID:5064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27502.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27502.exe
      4⤵
      PID:444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10548.exe
        5⤵
        
        PID:1268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60114.exe
        6⤵
        
        PID:4864
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1268 -s 228
        6⤵
        
        PID:5212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53297.exe
        5⤵
        
        PID:4140
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 444 -s 224
        5⤵
        Program crash
        
        PID:5760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49789.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49789.exe
      4⤵
      PID:2612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54043.exe
        5⤵
        
        PID:5792
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2612 -s 216
        5⤵
        
        PID:6980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49770.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49770.exe
      4⤵
      PID:4344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32218.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32218.exe
      4⤵
      PID:5948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7162.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7162.exe
      4⤵
      PID:6492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12331.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12331.exe
      4⤵
      PID:8080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47567.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47567.exe
      4⤵
      PID:8328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17502.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17502.exe
      4⤵
      PID:10200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14302.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14302.exe
      4⤵
      PID:11092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5044.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5044.exe
      4⤵
      PID:6724
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9163.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9163.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58017.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58017.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:772
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 772 -s 244
        5⤵
        Loads dropped DLL
        Program crash
        
        PID:1880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5526.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5526.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:920
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 920 -s 244
        5⤵
        Program crash
        
        PID:2036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16223.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16223.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64144.exe
        5⤵
        
        PID:2848
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2848 -s 224
        6⤵
        Program crash
        
        PID:3272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13654.exe
        5⤵
        
        PID:3492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3413.exe
        6⤵
        
        PID:2328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62677.exe
        6⤵
        
        PID:7256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6556.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7856
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3492 -s 228
        6⤵
        
        PID:8896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10613.exe
        5⤵
        
        PID:5020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60068.exe
        5⤵
        
        PID:6068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12216.exe
        5⤵
        
        PID:7012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27049.exe
        5⤵
        
        PID:7740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31737.exe
        5⤵
        
        PID:2316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28995.exe
        5⤵
        
        PID:9800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52807.exe
        5⤵
        
        PID:10504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42491.exe
        5⤵
        
        PID:7660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32826.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32826.exe
      4⤵
      PID:1620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2274.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4488.exe
        6⤵
        
        PID:6212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62696.exe
        6⤵
        
        PID:8084
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3864 -s 224
        6⤵
        
        PID:8352
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1620 -s 248
        5⤵
        Program crash
        
        PID:4552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64008.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64008.exe
      4⤵
      PID:3924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46087.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45281.exe
        5⤵
        
        PID:7588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59077.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29622.exe
        5⤵
        
        PID:4128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30015.exe
        5⤵
        
        PID:10740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9809.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9809.exe
      4⤵
      PID:4556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51933.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51933.exe
      4⤵
      PID:5220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52362.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52362.exe
      4⤵
      PID:6960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54747.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54747.exe
      4⤵
      PID:8044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1256.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1256.exe
      4⤵
      PID:8532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36622.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36622.exe
      4⤵
      PID:9460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27480.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27480.exe
      4⤵
      PID:5880
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51887.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51887.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54883.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54883.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11367.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59956.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20331.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19136.exe
        8⤵
        
        PID:3080
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2884 -s 228
        8⤵
        Program crash
        
        PID:5544
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2484 -s 248
        7⤵
        Program crash
        
        PID:3988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54601.exe
        6⤵
        
        PID:1272
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1272 -s 224
        7⤵
        Program crash
        
        PID:3304
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2148 -s 240
        6⤵
        Program crash
        
        PID:3164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39706.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21348.exe
        6⤵
        
        PID:2312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25818.exe
        7⤵
        
        PID:4692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41949.exe
        7⤵
        
        PID:6572
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2312 -s 244
        7⤵
        
        PID:7940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39072.exe
        6⤵
        
        PID:4220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56211.exe
        6⤵
        
        PID:5836
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1692 -s 248
        6⤵
        
        PID:6992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20801.exe
        5⤵
        
        PID:1920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62061.exe
        6⤵
        
        PID:5788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44940.exe
        6⤵
        
        PID:6368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8554.exe
        6⤵
        
        PID:7188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32057.exe
        6⤵
        
        PID:8552
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1920 -s 224
        6⤵
        
        PID:9980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23780.exe
        5⤵
        
        PID:4408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53219.exe
        5⤵
        
        PID:5932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17346.exe
        5⤵
        
        PID:6312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19044.exe
        5⤵
        
        PID:8032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43080.exe
        5⤵
        
        PID:8228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11299.exe
        5⤵
        
        PID:10172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44838.exe
        5⤵
        
        PID:11064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48445.exe
        5⤵
        
        PID:6940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27054.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27054.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46526.exe
        5⤵
        
        PID:1732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22770.exe
        6⤵
        
        PID:2772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53811.exe
        7⤵
        
        PID:3776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42859.exe
        7⤵
        
        PID:5684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55867.exe
        7⤵
        
        PID:6920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11227.exe
        7⤵
        
        PID:7700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62654.exe
        7⤵
        
        PID:8936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30974.exe
        7⤵
        
        PID:9828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34723.exe
        7⤵
        
        PID:10676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2568.exe
        7⤵
        
        PID:3708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64231.exe
        6⤵
        
        PID:3540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28888.exe
        6⤵
        
        PID:5488
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1732 -s 236
        6⤵
        
        PID:6872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37112.exe
        5⤵
        
        PID:2684
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2684 -s 224
        6⤵
        Program crash
        
        PID:4624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28765.exe
        5⤵
        
        PID:4084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62460.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5712
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 600 -s 240
        5⤵
        
        PID:7104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26171.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26171.exe
      4⤵
      PID:1076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50486.exe
        5⤵
        
        PID:1036
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1036 -s 224
        6⤵
        Program crash
        
        PID:3152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8107.exe
        5⤵
        
        PID:3572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10551.exe
        6⤵
        
        PID:8888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39062.exe
        6⤵
        
        PID:9740
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3572 -s 212
        6⤵
        
        PID:9972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19687.exe
        5⤵
        
        PID:4604
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1076 -s 248
        5⤵
        
        PID:6696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33968.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33968.exe
      4⤵
      PID:1260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18560.exe
        5⤵
        
        PID:3964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15153.exe
        5⤵
        
        PID:5524
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1260 -s 224
        5⤵
        
        PID:7144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35700.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35700.exe
      4⤵
      PID:3160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24419.exe
        5⤵
        
        PID:9484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21889.exe
        5⤵
        
        PID:9968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33168.exe
        5⤵
        
        PID:10656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53139.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53139.exe
      4⤵
      PID:5128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36887.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36887.exe
      4⤵
      PID:6816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62485.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62485.exe
      4⤵
      PID:8008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9795.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9795.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:8204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49717.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49717.exe
      4⤵
      PID:10032
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1640 -s 240
      4⤵
      PID:10728
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21369.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21369.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33755.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33755.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8555.exe
        5⤵
        
        PID:2348
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2348 -s 244
        6⤵
        Program crash
        
        PID:3232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62087.exe
        5⤵
        
        PID:3560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65199.exe
        6⤵
        
        PID:6500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24813.exe
        6⤵
        
        PID:7748
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3560 -s 244
        6⤵
        
        PID:8340
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2044 -s 244
        5⤵
        Program crash
        
        PID:5104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54694.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54694.exe
      4⤵
      PID:1100
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1100 -s 244
        5⤵
        Program crash
        
        PID:3264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62247.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62247.exe
      4⤵
      PID:3512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61695.exe
        5⤵
        
        PID:8048
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3512 -s 228
        5⤵
        
        PID:8468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16647.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16647.exe
      4⤵
      PID:4492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64535.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64535.exe
      4⤵
      PID:6188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30167.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30167.exe
      4⤵
      PID:7312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20622.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20622.exe
      4⤵
      PID:7736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35276.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35276.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:8556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60157.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60157.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7880.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7880.exe
      4⤵
      PID:10480
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30335.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30335.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16563.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16563.exe
      4⤵
      PID:1856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28167.exe
        5⤵
        
        PID:1520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10908.exe
        6⤵
        
        PID:4528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25421.exe
        6⤵
        
        PID:6896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36893.exe
        6⤵
        
        PID:8088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64012.exe
        6⤵
        
        PID:8264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39181.exe
        6⤵
        
        PID:10132
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1520 -s 236
        6⤵
        
        PID:10756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10339.exe
        5⤵
        
        PID:4644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56019.exe
        5⤵
        
        PID:5916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42547.exe
        5⤵
        
        PID:6304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18514.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47545.exe
        5⤵
        
        PID:9208
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1856 -s 244
        5⤵
        
        PID:10156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13236.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13236.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23793.exe
        5⤵
        
        PID:2520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65280.exe
        5⤵
        
        PID:7388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47535.exe
        5⤵
        
        PID:8616
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3128 -s 224
        5⤵
        
        PID:9344
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2904 -s 244
      4⤵
      Program crash
      PID:5072
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61953.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61953.exe
    3⤵
    PID:2644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19094.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19094.exe
      4⤵
      PID:3240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34212.exe
        5⤵
        
        PID:8188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51600.exe
        5⤵
        
        PID:9164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48079.exe
        5⤵
        
        PID:10220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22271.exe
        5⤵
        
        PID:10628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64627.exe
        5⤵
        
        PID:7676
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2644 -s 248
      4⤵
      Program crash
      PID:4236
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27689.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27689.exe
    3⤵
    PID:3464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57040.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57040.exe
      4⤵
      PID:7896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28299.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28299.exe
      4⤵
      PID:8800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58520.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58520.exe
      4⤵
      PID:10192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61950.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61950.exe
      4⤵
      PID:10392
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53971.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53971.exe
    3⤵
    PID:4364
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38199.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38199.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6196
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24567.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24567.exe
    3⤵
    PID:7328
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35758.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35758.exe
    3⤵
    PID:8208
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53742.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53742.exe
    3⤵
    PID:8516
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33822.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33822.exe
    3⤵
    PID:984
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2280.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2280.exe
    3⤵
    PID:10516
- C:\Users\Admin\AppData\Local\Temp\Unicorn-65354.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-65354.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2712
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29740.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29740.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42833.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42833.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3497.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32774.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2084
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2084 -s 240
        7⤵
        Program crash
        
        PID:2344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37978.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42370.exe
        7⤵
        
        PID:2176
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2176 -s 224
        8⤵
        Program crash
        
        PID:4296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50858.exe
        7⤵
        
        PID:3372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56595.exe
        7⤵
        
        PID:5724
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2336 -s 248
        7⤵
        
        PID:6152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37667.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57340.exe
        7⤵
        
        PID:4748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39133.exe
        7⤵
        
        PID:6116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56765.exe
        7⤵
        
        PID:7056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35753.exe
        7⤵
        
        PID:7500
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2620 -s 240
        7⤵
        
        PID:8424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7936.exe
        6⤵
        
        PID:3948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53795.exe
        6⤵
        
        PID:5660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36531.exe
        6⤵
        
        PID:6912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3092.exe
        6⤵
        
        PID:7696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41653.exe
        6⤵
        
        PID:8900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21174.exe
        6⤵
        
        PID:9812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12057.exe
        6⤵
        
        PID:10648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39234.exe
        6⤵
        
        PID:11032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45389.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2688
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2688 -s 240
        6⤵
        Program crash
        
        PID:1672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51714.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10403.exe
        6⤵
        
        PID:1008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24719.exe
        7⤵
        
        PID:4020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16340.exe
        8⤵
        
        PID:8068
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4020 -s 228
        8⤵
        
        PID:8292
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1008 -s 228
        7⤵
        Program crash
        
        PID:4260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22725.exe
        6⤵
        
        PID:3076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8493.exe
        7⤵
        
        PID:7508
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3076 -s 228
        7⤵
        
        PID:8268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12811.exe
        6⤵
        
        PID:4208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35567.exe
        6⤵
        
        PID:6104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46703.exe
        6⤵
        
        PID:7320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3557.exe
        6⤵
        
        PID:8196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56807.exe
        6⤵
        
        PID:8408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65493.exe
        6⤵
        
        PID:9688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3680.exe
        6⤵
        
        PID:10464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60766.exe
        5⤵
        
        PID:860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20913.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16079.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15054.exe
        6⤵
        
        PID:8572
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 860 -s 228
        6⤵
        
        PID:9336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49370.exe
        5⤵
        
        PID:4568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36683.exe
        5⤵
        
        PID:5892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53597.exe
        5⤵
        
        PID:7020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14426.exe
        5⤵
        
        PID:7772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35057.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25374.exe
        5⤵
        
        PID:9940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49858.exe
        5⤵
        
        PID:10772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21033.exe
        5⤵
        
        PID:6456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48977.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48977.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34502.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63246.exe
        6⤵
        
        PID:2276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59557.exe
        7⤵
        
        PID:2964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25135.exe
        8⤵
        
        PID:4932
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2964 -s 248
        8⤵
        
        PID:5636
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2276 -s 248
        7⤵
        Program crash
        
        PID:4152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57035.exe
        6⤵
        
        PID:348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2026.exe
        7⤵
        
        PID:4636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40467.exe
        7⤵
        
        PID:5156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15016.exe
        7⤵
        
        PID:6780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52250.exe
        7⤵
        
        PID:7880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31206.exe
        7⤵
        
        PID:8636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33460.exe
        7⤵
        
        PID:4132
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 348 -s 244
        7⤵
        
        PID:10644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18874.exe
        6⤵
        
        PID:4268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62076.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5812
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2696 -s 240
        6⤵
        
        PID:7080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42996.exe
        5⤵
        
        PID:2692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2629.exe
        6⤵
        
        PID:2920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38004.exe
        7⤵
        
        PID:3992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-204.exe
        8⤵
        
        PID:932
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3992 -s 228
        8⤵
        
        PID:9424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40435.exe
        7⤵
        
        PID:4360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6676.exe
        7⤵
        
        PID:6616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10661.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53728.exe
        7⤵
        
        PID:9088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5157.exe
        7⤵
        
        PID:9892
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2920 -s 244
        7⤵
        
        PID:10708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36010.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31253.exe
        7⤵
        
        PID:8744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10021.exe
        7⤵
        
        PID:4116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32815.exe
        7⤵
        
        PID:10512
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2692 -s 244
        6⤵
        Program crash
        
        PID:4616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29830.exe
        5⤵
        
        PID:700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29063.exe
        6⤵
        
        PID:3904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44024.exe
        7⤵
        
        PID:8416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20057.exe
        7⤵
        
        PID:9496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34408.exe
        7⤵
        
        PID:11088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7042.exe
        6⤵
        
        PID:4356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39157.exe
        6⤵
        
        PID:6844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26614.exe
        6⤵
        
        PID:8016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36130.exe
        6⤵
        
        PID:8076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55318.exe
        6⤵
        
        PID:10040
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 700 -s 244
        6⤵
        
        PID:10688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13613.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15740.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23257.exe
        6⤵
        
        PID:10860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25984.exe
        6⤵
        
        PID:10764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4137.exe
        5⤵
        
        PID:5144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19821.exe
        5⤵
        
        PID:6828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34623.exe
        5⤵
        
        PID:8116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51559.exe
        5⤵
        
        PID:8372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12845.exe
        5⤵
        
        PID:10140
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2576 -s 248
        5⤵
        
        PID:10888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59783.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59783.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58311.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43797.exe
        6⤵
        
        PID:2672
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2672 -s 240
        7⤵
        Program crash
        
        PID:4064
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2784 -s 236
        6⤵
        Program crash
        
        PID:3856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7211.exe
        5⤵
        
        PID:1292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42047.exe
        6⤵
        
        PID:4880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17172.exe
        6⤵
        
        PID:5180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10060.exe
        6⤵
        
        PID:6320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51705.exe
        6⤵
        
        PID:7620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62535.exe
        6⤵
        
        PID:8444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28743.exe
        6⤵
        
        PID:10168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14136.exe
        6⤵
        
        PID:5884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43626.exe
        6⤵
        
        PID:11284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1687.exe
        5⤵
        
        PID:3980
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2668 -s 248
        5⤵
        Program crash
        
        PID:5752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27678.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27678.exe
      4⤵
      PID:2160
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2160 -s 224
        5⤵
        Program crash
        
        PID:2948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-92.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-92.exe
      4⤵
      PID:2320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40308.exe
        5⤵
        
        PID:3416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55171.exe
        6⤵
        
        PID:9416
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3416 -s 228
        6⤵
        
        PID:10176
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2320 -s 248
        5⤵
        Program crash
        
        PID:4396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18459.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18459.exe
      4⤵
      PID:3764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5393.exe
        5⤵
        
        PID:8428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28354.exe
        5⤵
        
        PID:9236
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3764 -s 224
        5⤵
        
        PID:10968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16348.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16348.exe
      4⤵
      PID:4872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48412.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48412.exe
      4⤵
      PID:6596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41197.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41197.exe
      4⤵
      PID:7960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15256.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15256.exe
      4⤵
      PID:9060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37358.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37358.exe
      4⤵
      PID:9864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31657.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31657.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:10748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36434.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36434.exe
      4⤵
      PID:11056
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6631.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6631.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19450.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19450.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17673.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2792
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2792 -s 240
        6⤵
        Program crash
        
        PID:1708
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3068 -s 248
        5⤵
        Program crash
        
        PID:2164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30479.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30479.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62478.exe
        5⤵
        
        PID:628
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 628 -s 224
        6⤵
        Program crash
        
        PID:2648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48301.exe
        5⤵
        
        PID:2424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4911.exe
        6⤵
        
        PID:4016
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2424 -s 248
        6⤵
        Program crash
        
        PID:5776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7089.exe
        5⤵
        
        PID:3768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39611.exe
        6⤵
        
        PID:9720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24326.exe
        6⤵
        
        PID:10904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49804.exe
        6⤵
        
        PID:6404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12802.exe
        5⤵
        
        PID:5164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36356.exe
        5⤵
        
        PID:6876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17557.exe
        5⤵
        
        PID:8104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55877.exe
        5⤵
        
        PID:8300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18180.exe
        5⤵
        
        PID:10100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7857.exe
        5⤵
        
        PID:10788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1433.exe
        5⤵
        
        PID:6448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40863.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40863.exe
      4⤵
      PID:2324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37051.exe
        5⤵
        
        PID:2468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59026.exe
        6⤵
        
        PID:3092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40310.exe
        7⤵
        
        PID:8608
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3092 -s 216
        7⤵
        
        PID:9376
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2468 -s 248
        6⤵
        Program crash
        
        PID:4916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23483.exe
        5⤵
        
        PID:3952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59861.exe
        6⤵
        
        PID:8960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39062.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9748
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3952 -s 220
        6⤵
        
        PID:10060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22375.exe
        5⤵
        
        PID:4440
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2324 -s 248
        5⤵
        
        PID:6660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19105.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19105.exe
      4⤵
      PID:1848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8585.exe
        5⤵
        
        PID:3860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34127.exe
        5⤵
        
        PID:4340
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1848 -s 224
        5⤵
        
        PID:5320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9629.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9629.exe
      4⤵
      PID:3620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9553.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9553.exe
      4⤵
      PID:5516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53597.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53597.exe
      4⤵
      PID:7036
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2428 -s 248
      4⤵
      PID:7800
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59313.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59313.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17673.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17673.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57844.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-792.exe
        6⤵
        
        PID:1964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24730.exe
        7⤵
        
        PID:3488
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1964 -s 248
        7⤵
        Program crash
        
        PID:5768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59742.exe
        6⤵
        
        PID:3364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23265.exe
        7⤵
        
        PID:9716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25276.exe
        7⤵
        
        PID:11048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6937.exe
        6⤵
        
        PID:5136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45022.exe
        6⤵
        
        PID:6836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17948.exe
        6⤵
        
        PID:8024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19595.exe
        6⤵
        
        PID:7804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6846.exe
        6⤵
        
        PID:10020
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1140 -s 236
        6⤵
        
        PID:10700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27361.exe
        5⤵
        
        PID:2616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47309.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9227.exe
        6⤵
        
        PID:6020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3625.exe
        6⤵
        
        PID:6588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43132.exe
        6⤵
        
        PID:8124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31901.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3502.exe
        6⤵
        
        PID:9272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1967.exe
        6⤵
        
        PID:11108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44643.exe
        6⤵
        
        PID:6444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18734.exe
        5⤵
        
        PID:3888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58705.exe
        6⤵
        
        PID:6972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1889.exe
        5⤵
        
        PID:5432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53067.exe
        5⤵
        
        PID:7136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18891.exe
        5⤵
        
        PID:328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61923.exe
        5⤵
        
        PID:9032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26509.exe
        5⤵
        
        PID:9912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8926.exe
        5⤵
        
        PID:10916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24868.exe
        5⤵
        
        PID:10364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21450.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21450.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41026.exe
        5⤵
        
        PID:1704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56855.exe
        6⤵
        
        PID:5016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60595.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6324.exe
        6⤵
        
        PID:7212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18368.exe
        6⤵
        
        PID:8160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46988.exe
        6⤵
        
        PID:9240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16289.exe
        6⤵
        
        PID:10280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30899.exe
        6⤵
        
        PID:10944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31558.exe
        5⤵
        
        PID:4036
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2252 -s 224
        5⤵
        Program crash
        
        PID:5500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3074.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3074.exe
      4⤵
      PID:1164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25244.exe
        5⤵
        
        PID:4684
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1164 -s 228
        5⤵
        
        PID:6048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8320.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8320.exe
      4⤵
      PID:3872
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1328 -s 244
      4⤵
      Program crash
      PID:5704
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17023.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17023.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40932.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40932.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47227.exe
        5⤵
        
        PID:2896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12363.exe
        6⤵
        
        PID:4960
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2896 -s 236
        6⤵
        
        PID:4560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42118.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25366.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61561.exe
        5⤵
        
        PID:5416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61732.exe
        5⤵
        
        PID:6964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35426.exe
        5⤵
        
        PID:2104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44857.exe
        5⤵
        
        PID:8988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48040.exe
        5⤵
        
        PID:9872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13192.exe
        5⤵
        
        PID:10800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62770.exe
        5⤵
        
        PID:6892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-849.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-849.exe
      4⤵
      PID:264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14444.exe
        5⤵
        
        PID:4476
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 264 -s 228
        5⤵
        
        PID:6080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12429.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12429.exe
      4⤵
      PID:3660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34754.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34754.exe
      4⤵
      PID:5464
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2936 -s 240
      4⤵
      PID:7060
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51026.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51026.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:904
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 904 -s 244
      4⤵
      Program crash
      PID:3216
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13783.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13783.exe
    3⤵
    PID:3244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46237.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46237.exe
      4⤵
      PID:6800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54175.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54175.exe
      4⤵
      PID:7608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37084.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37084.exe
      4⤵
      PID:8812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28381.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28381.exe
      4⤵
      PID:9480
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35261.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35261.exe
      4⤵
      PID:10924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30468.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30468.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:11040
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8343.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8343.exe
    3⤵
    PID:5048
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30402.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30402.exe
    3⤵
    PID:6092
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51417.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51417.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6300
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21449.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21449.exe
    3⤵
    PID:7872
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46872.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46872.exe
    3⤵
    PID:8588
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47461.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47461.exe
    3⤵
    PID:9876
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26472.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26472.exe
    3⤵
    PID:10520
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36891.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36891.exe
    3⤵
    PID:6568
- C:\Users\Admin\AppData\Local\Temp\Unicorn-10153.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-10153.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2716
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43134.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43134.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1792
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1792 -s 224
      4⤵
      Loads dropped DLL
      Program crash
      PID:1372
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2716 -s 248
    3⤵
    - Program crash
    PID:1524
- C:\Users\Admin\AppData\Local\Temp\Unicorn-57752.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-57752.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:2136
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6559.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6559.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35208.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35208.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8254.exe
        5⤵
        
        PID:2852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26546.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40920.exe
        7⤵
        
        PID:8840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39446.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:9664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35625.exe
        7⤵
        
        PID:9732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39034.exe
        7⤵
        
        PID:10812
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2852 -s 228
        6⤵
        Program crash
        
        PID:4896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39160.exe
        5⤵
        
        PID:4028
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4028 -s 212
        6⤵
        
        PID:8880
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2132 -s 224
        5⤵
        Program crash
        
        PID:4660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37397.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37397.exe
      4⤵
      PID:2756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8019.exe
        5⤵
        
        PID:3360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4978.exe
        6⤵
        
        PID:9096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36574.exe
        6⤵
        
        PID:4792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36993.exe
        6⤵
        
        PID:10844
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3360 -s 228
        6⤵
        
        PID:10412
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2756 -s 228
        5⤵
        Program crash
        
        PID:4136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20498.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20498.exe
      4⤵
      PID:4060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4978.exe
        5⤵
        
        PID:9056
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4060 -s 228
        5⤵
        
        PID:9900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60036.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60036.exe
      4⤵
      PID:4920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3876.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3876.exe
      4⤵
      PID:6684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50998.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50998.exe
      4⤵
      PID:7900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37922.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37922.exe
      4⤵
      PID:9124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-692.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-692.exe
      4⤵
      PID:9916
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1864 -s 244
      4⤵
      PID:10872
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13889.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13889.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11980.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11980.exe
      4⤵
      PID:1644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2840.exe
        5⤵
        
        PID:3636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29407.exe
        6⤵
        
        PID:8152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36052.exe
        6⤵
        
        PID:9248
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3636 -s 224
        6⤵
        
        PID:10264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17332.exe
        5⤵
        
        PID:4652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1798.exe
        5⤵
        
        PID:6216
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1644 -s 248
        5⤵
        
        PID:7336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13649.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13649.exe
      4⤵
      PID:3932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44101.exe
        5⤵
        
        PID:8916
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3932 -s 228
        5⤵
        
        PID:9756
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2844 -s 220
      4⤵
      Program crash
      PID:4708
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5850.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5850.exe
    3⤵
    PID:2776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20915.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20915.exe
      4⤵
      PID:3892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48661.exe
        5⤵
        
        PID:6388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4227.exe
        5⤵
        
        PID:8004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26191.exe
        5⤵
        
        PID:8488
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3892 -s 236
        5⤵
        
        PID:9768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15409.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15409.exe
      4⤵
      PID:4520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54203.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54203.exe
      4⤵
      PID:6044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20881.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20881.exe
      4⤵
      PID:3004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43585.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43585.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14671.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14671.exe
      4⤵
      PID:8604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50526.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50526.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58142.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58142.exe
      4⤵
      PID:10524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38291.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38291.exe
      4⤵
      PID:10856
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12419.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12419.exe
    3⤵
    PID:3972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6048.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6048.exe
      4⤵
      PID:7456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42130.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42130.exe
      4⤵
      PID:8320
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3972 -s 224
      4⤵
      PID:9200
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26344.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26344.exe
    3⤵
    PID:4500
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34867.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34867.exe
    3⤵
    PID:5424
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64635.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64635.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6656
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55064.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55064.exe
    3⤵
    PID:7224
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48809.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48809.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:8976
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27092.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27092.exe
    3⤵
    PID:9232
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36693.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36693.exe
    3⤵
    PID:10980
- C:\Users\Admin\AppData\Local\Temp\Unicorn-16461.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-16461.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1660
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55410.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55410.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17046.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17046.exe
      4⤵
      PID:908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18944.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41845.exe
        6⤵
        
        PID:10744
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 908 -s 248
        5⤵
        Program crash
        
        PID:5532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3146.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3146.exe
      4⤵
      PID:3604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32493.exe
        5⤵
        
        PID:8908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58111.exe
        5⤵
        
        PID:9364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16598.exe
        5⤵
        
        PID:10452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24284.exe
        5⤵
        
        PID:10408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4778.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4778.exe
      4⤵
      PID:4592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12541.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12541.exe
      4⤵
      PID:6676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1996.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1996.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20856.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20856.exe
      4⤵
      PID:9080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22222.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22222.exe
      4⤵
      PID:9928
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2024 -s 248
      4⤵
      PID:10880
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46464.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46464.exe
    3⤵
    PID:2192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39249.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39249.exe
      4⤵
      PID:3200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34827.exe
        5⤵
        
        PID:5584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42131.exe
        5⤵
        
        PID:6164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38227.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4521.exe
        5⤵
        
        PID:9024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47510.exe
        5⤵
        
        PID:9840
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3200 -s 228
        5⤵
        
        PID:10832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62415.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62415.exe
      4⤵
      PID:5080
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2192 -s 244
      4⤵
      PID:6128
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33118.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33118.exe
    3⤵
    PID:3252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28506.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28506.exe
      4⤵
      PID:4712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58478.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58478.exe
      4⤵
      PID:6636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4796.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4796.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46057.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46057.exe
      4⤵
      PID:9104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21692.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21692.exe
      4⤵
      PID:9904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17657.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17657.exe
      4⤵
      PID:10780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24098.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24098.exe
      4⤵
      PID:11076
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16478.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16478.exe
    3⤵
    PID:4108
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1660 -s 244
    3⤵
    PID:5316
- C:\Users\Admin\AppData\Local\Temp\Unicorn-45896.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-45896.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2952
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2952 -s 220
    3⤵
    - Program crash
    PID:2440
- C:\Users\Admin\AppData\Local\Temp\Unicorn-24690.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-24690.exe
  2⤵
  PID:2724
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32472.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32472.exe
    3⤵
    PID:3808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54425.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54425.exe
      4⤵
      PID:8544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26452.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26452.exe
      4⤵
      PID:9388
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3808 -s 224
      4⤵
      PID:9296
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31831.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31831.exe
    3⤵
    PID:4840
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14709.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14709.exe
    3⤵
    PID:6336
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38072.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38072.exe
    3⤵
    PID:7528
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43274.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43274.exe
    3⤵
    PID:8388
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30452.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30452.exe
    3⤵
    PID:9184
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33355.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33355.exe
    3⤵
    PID:10092
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9368.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9368.exe
    3⤵
    PID:10996
- C:\Users\Admin\AppData\Local\Temp\Unicorn-38446.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-38446.exe
  2⤵
  PID:3536
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60781.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60781.exe
    3⤵
    PID:7760
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54002.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54002.exe
    3⤵
    PID:8752
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23083.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23083.exe
    3⤵
    PID:9432
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41490.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41490.exe
    3⤵
    PID:10064
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30368.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30368.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:10820
- C:\Users\Admin\AppData\Local\Temp\Unicorn-47183.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-47183.exe
  2⤵
  PID:4516
- C:\Users\Admin\AppData\Local\Temp\Unicorn-42399.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-42399.exe
  2⤵
  PID:6168
- C:\Users\Admin\AppData\Local\Temp\Unicorn-62368.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-62368.exe
  2⤵
  PID:7372
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2480 -s 248
  2⤵
  PID:7984

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-3497.exe

Filesize
468KB

MD5
98d05b60a722b4c24f6dc7876aa1def6

SHA1
644356012ab0e4eac5617f00e8339d0eb1f7afa1

SHA256
8da1a30b90a42c70a7350f60905226e071de4dea24186ce90ef64fc69b9fd1b9

SHA512
8b8c4c35dc981ce229badac9f17e89f5088d44e2ca424365cf471ad3541f0da4c3f37cf38183252afdfb5fbb60f81f64429546be8c983b500cbd639fedfa0de2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-38251.exe

Filesize
468KB

MD5
a6eb47a5165ebd6dbb92c351dbaac8b5

SHA1
a3a1a924d212382483b49b10b3c6db934e9823d6

SHA256
4340d9595bcd355f80bc4d809696e6bf7f29594c8caffe949fce951ca0ea057d

SHA512
431f409d8b4dbc239863579a1c49111ccfafad2f5bfcf47e56797bfef573b13340f35dd6ff822f42324b3c2de8040e15daa6f2a82e81b889580fd6b49709c3c8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39706.exe

Filesize
468KB

MD5
715558284f60bb7aeec31617db819742

SHA1
2a54a7044ca21d4f2717d7563bb9862e30da35e7

SHA256
c2aa5fc68a7368acaaf48ff2c1bf939d037efa2b8cca5a9239d939aa825463f3

SHA512
efc8f6e27e6f03631f19b072249cf1df7f422da0fac1f4b2ca63c4fc76c80b8c09ab605fef8c229721d37a002ae630692788e0faf3b35343a40fbbedfa41d688

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-48445.exe

Filesize
468KB

MD5
522de0cf4a4c325b9c09ba7d407e1010

SHA1
c1c3e7b4da299f6c6862c7c54e4d03a8d6e9fb19

SHA256
67c02ed01b974da96a2be098907d8b937d3df788c776f49010c3a7b0362fc85b

SHA512
296aa9bea7ed006b754a48930c3e998284981e122b7bd750402f7fd8a1abd88953cef3d87e1b641b2bf17d78b7c11816729ff75cc9a2dfa1de948c10c8328860

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-51887.exe

Filesize
468KB

MD5
488c469af4d4c19c763affdb6aabac97

SHA1
59ab5687bfbcc522d4d7765bbea50d132de52e92

SHA256
73aaa9aca9f2db9c1dcc85ee1c4697a4a39a4dddc5f14a0e85c5e68b2f5d4c58

SHA512
873d6a22d2ab451e25ea369cd1c8af389f6ef20366931380adc6e9e26c8d4aa0a96e521e4ff4fca3b6f5d65870a01ebdd7f37c00b661d073b793ecbf2ea8275d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-53765.exe

Filesize
468KB

MD5
7cf5334129e3da84625d5f563423e647

SHA1
9262ea849b91efc5601ec04b7993e1e91e698082

SHA256
1161895cfd30c7e45986011dcfac825763e38d5d0c105c30a4ce5c5fb9f085a3

SHA512
28ead09be70aee75574c89fc7f56aaa34b53b51a80fe94fd201e7bdfb1d15d2f6a6fb60a8050f5cbef7ad8dabde881b90f3b0a9eac7f6a892ffd0e8edd29cf24

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-57752.exe

Filesize
468KB

MD5
27ea74b18dc67ceb947d66b94b5a5f1a

SHA1
71b9cbeab2639b0209f3ab5b4d1457813ee2f18e

SHA256
82706735d50b6da135e1024076c933f5cf5b011b773dcf7f64052d1dae317002

SHA512
6f388b860f213bbf9a65169f1c9d7555e4efc068be1f0e50a3787c2b1efd1acde390065c3cd63998661129b619fbecbd3288c5bf73110bfdfa845dc9e5e9b1ea

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-58017.exe

Filesize
468KB

MD5
aef1b03ca68133539dfac43b20384422

SHA1
4dd744dd92f3c548f009def49bde446f220602b1

SHA256
7dc19f6337da08778abc50118ee10605d1635ccdfd8303259a487dbadc779a65

SHA512
a197c0e8442eb99be978dc6ef8e03e243d44fce4a07a19d71cf77e81ce45734ef1a1d7ec837530f178a37641ecc51c28f509d5568c2729c61857bfd7fc1b0d12

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-6048.exe

Filesize
468KB

MD5
addace955c1596df8b23970c317a52a5

SHA1
4042b9e831dcc1f1728cadf70b6e263e0b8eab6c

SHA256
6585a3857db95372e30fec5f0a95b20cc87c77c27381bd42ad2abf73faf2d30e

SHA512
0ce503127d955232fadc49ecc92f8748cd507f3ce41e5cd8b28c87c0f9f57d56b7a94cc0476c530d840d4993583515b623ad66d619fd83baca5a4d4983c57b81

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-10153.exe

Filesize
468KB

MD5
fb8d37c5285755769dc7832662f2c214

SHA1
a371dc66cd7ba24b0069761cfeec0564cb6e7120

SHA256
e70ce6b2c83189b0cc8c5aa20bb7198bafc5a6844f07bfa06c246cdd7c26ae82

SHA512
099a647dcbd101adbc5956313d6fb86f5b088099bbe318760eaa474b563348715cf95048bb5c107d8d5d29bba7d413f58db5bc2881960be5f381c408e6f280e3

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-19450.exe

Filesize
468KB

MD5
ff4c465fc390b114c089270317bba0ff

SHA1
3e1386cdb72b0f4078603eb3c3d3ceff551c2fd0

SHA256
863dd5c7f2f411b259c81894acfbc5fc41c38a1b2656c7bbf6e606e72830382f

SHA512
e4d17163a5ea75209107a07b985dd856cfd748fe410f0ceddf4eb9ea228d30f8c91f54f793d46b299e0e378500156a0730f50d73c0ae3e823f2da1b702d56daf

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-22199.exe

Filesize
468KB

MD5
caba8b6b56c3765b92ee465bbf4a4487

SHA1
21ac244313d3e46c4f3ce83af65ab0c31f21d06a

SHA256
7651a4df28ff7a36becf2da098488d9a2150f6d0299121b5b34b53c5a75b1a64

SHA512
8d9972042c72fa821a44d4ebedd6aaa5b797517b1c650a5ced8b43423a8d22509a8a2393985abbfc96b1e8c3aad7319f86402eb65754cdd854bade76272c0f75

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-22698.exe

Filesize
468KB

MD5
6cef1f187ae285e5ed0d0b3e5e7f7b01

SHA1
ccf7e10af0af44d2d4ce7f5ea37090909a16436b

SHA256
56bad0cdcac64c6b8bfcf73efcad1e7ec09b4d96a61a3c2f19ab22f5ba8162b7

SHA512
985e3ae07551c54e6343dbbc31bc99eea0d442a1466a9cfcd5c45bf580201cc9a4e2196607da750640c42ef9a30932784ae0e00bcac9b7170adbfd579d0b256d

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-26190.exe

Filesize
468KB

MD5
7cd310c2953b43827e1746b1479b42d7

SHA1
20e7dea261a7f3983794b564362bf03f4ab953c3

SHA256
f36727ccc9e0ac5140b5f6289560202445994ef904801c68d342b97bb9e16c67

SHA512
71e20f075388e1a8188de191d7ff076480c511ae6affab7cb6ed9be138f3a178c1b3dd3862568d9d4f2d524e86c209c7c867f585e924fbfd104a8260022fe553

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-29740.exe

Filesize
468KB

MD5
eaf25148acfb9f8c6c281c88faa63604

SHA1
ac26a518e7d8ef5a00405464f0949ee27adf86d5

SHA256
2e41a5b6cfa986f4d92121bc7645d66748cc60da02383982d48a9e6b410c4f3d

SHA512
3c5f952621d1c43df260c126c793a3151ebc206d8a0ff00dcc5ca6445381bf47aa0d6ae175ec69dc9f05d2b0a043abdbb5ed4d9ae7b3519e1edc985d0a33d22e

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-42833.exe

Filesize
468KB

MD5
e3e0e7b70d50ebd4308c41384313bee1

SHA1
f6b80e7dcc75e9136342bcb7458d1c1a395e8f49

SHA256
f2d2a42fe5ef96863f35047dcb99ec73b8936543d6e7564a585e07615450f8aa

SHA512
8098d76cafdbd1d4efc197a0a61261ad4c58340c58d0a491e5552973e73f41e0872b34d2fd4960c84db52ce08e7fcc84d7af4f1b7f2caf4c567e64b1829d964d

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-43134.exe

Filesize
468KB

MD5
04da0dfa79117f1ab4263067c3233d28

SHA1
ad7812e60391e50d84958d4efccdcdddc36e436b

SHA256
4f78dd3ab4183c323cf0652e7f75c6a404fd649f00e09392c9a508d8a0ab6431

SHA512
806f615b61d75fe558941ab03a531ba9ee21af2f2778e2f10aaf3a37a08333e1428c802604701c655ffbfe431f2a3ba94139887da417f521651cbe806f517516

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-45941.exe

Filesize
468KB

MD5
0f9e755e5077bb9eb558c7f869553229

SHA1
b94eb2d2af5e70007d27d57796446b25d290c287

SHA256
c29537ba12137e3c77d54988a168da9847eac4709b5368d5477d244e0710b6f5

SHA512
5d4d29141558c9eb76f965d95573b02eda4bdbc477f922d212f7e87d220130b368ead3c81c72ba544a24193b6316c36dbabce2bbd54c844d43b09064cadadb2f

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-48977.exe

Filesize
468KB

MD5
be51e110f6d4272f5fd95dd6137db20f

SHA1
b42fb97b09db3985507de17e7f824e7fac746576

SHA256
f31ac3ca6db13cfbdc603d6b69b0a92dce7e89ce1e1f0732408ed97983de3ced

SHA512
13e29b3e8effae9d6344963d4b5e65b9d91955376030f630b9c63e6d933d14f531ee66538ffacf10c60ee5f084605a7f6c38e647144bea949816e8d23653daa0

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-59313.exe

Filesize
468KB

MD5
c4082c1c5e5370fa56b70379ede12e0f

SHA1
e5ffcd2368f0fc5e625b90fa1fd98c47f44aeb6d

SHA256
3c481c68873d5ab86868f53d609378564c7345675d7f3e1eb807d4b04f41fcbc

SHA512
956abdff4d77bdb38328ed3f056dc2d24fe134fe5c97d238a3b6564985748b096f0f5171d38d982ff7867ae36784410e0b572c46e00101e3e8cb2d17276d8896

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-59662.exe

Filesize
468KB

MD5
4fb386bb859bb18e5ed00a98f88ace56

SHA1
985d3d9cd018ae0bd7a7bee489e0adeb11786f73

SHA256
175beafc660aa31c538ad9d7bba3d86f6bee27f03cc2321bd1685caec71d66e2

SHA512
d8e1379a625e6ad8b366d6054c433ef1c85caea20e9d04c495cfa2136b732003db20e3ecc932f84326b49b6fef74621494f97864c6723d17669b6c8a4cf1c1b7

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-65354.exe

Filesize
468KB

MD5
e7c88319231c572035eebcb398529d75

SHA1
03c2825033ed014d34cb83c76f461a704dc0d884

SHA256
a2ebe906d2602066f3222984effd2c13d8a2adba96f992e0f3a8a31ae215922b

SHA512
7fa059347ae48e1bc023cbc7b3603ddb4c58da6e477962bfb12f89a86417f084d86bbfdda7f4e660b4b44a0d398782e33dfd517429afb6c8bb715668bef6846c

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-6631.exe

Filesize
468KB

MD5
c950412e43fd77e7194a5ef04f6ce954

SHA1
516f73990303bca49f38de222a0ff318608b2b34

SHA256
573f9a010a3543fe43fb9099a4bf1ba7504f7412fd9e0f7846abc1286535c3b9

SHA512
cd553c265275b878783e18512cffd9b43df95dcac0cd8c7b0710c1a1a465ab7d5404353aebd844f5b9efcf990057d44994d4ad9e98604542accbef5616f0828c

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-9163.exe

Filesize
468KB

MD5
54f13f25f7323414a8c68777449084b1

SHA1
4a5c34232bc0d6e3cd7c1f56824dc4c8d1f25291

SHA256
1ead5f8a8e90ce7c18f005a9041f3d75e260948dcc740f40e6bd004691cfb4f9

SHA512
52c3ec4f7eb7903783cc3e44afe7b44116c39267f7a0bb9bc8c1633bfa22a522334c25a5fca18e4706aba6d013bb330cb20f10b4908b9ee6097bb7b6be462934

Download Submit