121ac5e38005ae79864374cc3a7f4d3c9246fbedd2faaea50b08f8a32c7f019d

Analysis

max time kernel
120s
max time network
16s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
15/09/2024, 04:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

8bfef7e6bd8ec5bb0b527fed3a4079b0N.exe
Size

468KB
MD5

8bfef7e6bd8ec5bb0b527fed3a4079b0
SHA1

70dc70752c1b132ee96516c5f8d9b4e386d216da
SHA256

121ac5e38005ae79864374cc3a7f4d3c9246fbedd2faaea50b08f8a32c7f019d
SHA512

a0b72aabeff6f528cf8788b84654a99079871d6e7b4e62e9118d3af0fb081d13bbd3abe78b7d70151cb1830afecc4cb1c60af9d76291998ee1c0552f676bd9bf
SSDEEP

3072:1G3KogjSIE5TtbY2HncOcf8KvChaP0pfJVHeTVPDQ7NLO7vgEElp:1G6oAMTtxHcOcfjYqlQ7psvgE

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
1084	Unicorn-15893.exe
1796	Unicorn-63357.exe
2332	Unicorn-51427.exe
2744	Unicorn-59668.exe
2800	Unicorn-56331.exe
2668	Unicorn-4529.exe
2652	Unicorn-44453.exe
784	Unicorn-29113.exe
1640	Unicorn-18517.exe
2472	Unicorn-18709.exe
1632	Unicorn-64380.exe
2496	Unicorn-13647.exe
2700	Unicorn-37619.exe
1268	Unicorn-37619.exe
1948	Unicorn-16108.exe
2524	Unicorn-20707.exe
2536	Unicorn-28112.exe
3048	Unicorn-33408.exe
2092	Unicorn-23203.exe
1904	Unicorn-6409.exe
2820	Unicorn-6674.exe
1668	Unicorn-52346.exe
2220	Unicorn-43556.exe
2600	Unicorn-6778.exe
1684	Unicorn-26644.exe
2416	Unicorn-23306.exe
1932	Unicorn-29332.exe
992	Unicorn-8698.exe
1660	Unicorn-15600.exe
1088	Unicorn-57327.exe
2360	Unicorn-14448.exe
1740	Unicorn-15517.exe
1620	Unicorn-30977.exe
2152	Unicorn-50613.exe
2836	Unicorn-63877.exe
2352	Unicorn-25604.exe
2772	Unicorn-11691.exe
2828	Unicorn-8891.exe
2728	Unicorn-49617.exe
2664	Unicorn-46581.exe
2692	Unicorn-44965.exe
2864	Unicorn-58156.exe
1320	Unicorn-64373.exe
1676	Unicorn-30933.exe
2424	Unicorn-41331.exe
1076	Unicorn-10683.exe
1112	Unicorn-30549.exe
2984	Unicorn-57475.exe
1484	Unicorn-699.exe
912	Unicorn-20565.exe
964	Unicorn-64704.exe
760	Unicorn-53922.exe
1496	Unicorn-1576.exe
2440	Unicorn-37010.exe
2064	Unicorn-40502.exe
2320	Unicorn-42111.exe
1804	Unicorn-6594.exe
1708	Unicorn-316.exe
1584	Unicorn-42604.exe
1532	Unicorn-17483.exe
2392	Unicorn-6018.exe
1080	Unicorn-5337.exe
2952	Unicorn-60403.exe
2768	Unicorn-60668.exe

Loads dropped DLL 64 IoCs

pid	Process
2380	8bfef7e6bd8ec5bb0b527fed3a4079b0N.exe
2380	8bfef7e6bd8ec5bb0b527fed3a4079b0N.exe
1084	Unicorn-15893.exe
2380	8bfef7e6bd8ec5bb0b527fed3a4079b0N.exe
2380	8bfef7e6bd8ec5bb0b527fed3a4079b0N.exe
1084	Unicorn-15893.exe
2332	Unicorn-51427.exe
2332	Unicorn-51427.exe
1084	Unicorn-15893.exe
1084	Unicorn-15893.exe
2380	8bfef7e6bd8ec5bb0b527fed3a4079b0N.exe
2380	8bfef7e6bd8ec5bb0b527fed3a4079b0N.exe
2668	Unicorn-4529.exe
2668	Unicorn-4529.exe
2380	8bfef7e6bd8ec5bb0b527fed3a4079b0N.exe
2380	8bfef7e6bd8ec5bb0b527fed3a4079b0N.exe
2744	Unicorn-59668.exe
2744	Unicorn-59668.exe
2332	Unicorn-51427.exe
1084	Unicorn-15893.exe
2800	Unicorn-56331.exe
1084	Unicorn-15893.exe
2800	Unicorn-56331.exe
2332	Unicorn-51427.exe
784	Unicorn-29113.exe
2652	Unicorn-44453.exe
2652	Unicorn-44453.exe
784	Unicorn-29113.exe
2668	Unicorn-4529.exe
2668	Unicorn-4529.exe
1632	Unicorn-64380.exe
1632	Unicorn-64380.exe
2380	8bfef7e6bd8ec5bb0b527fed3a4079b0N.exe
2380	8bfef7e6bd8ec5bb0b527fed3a4079b0N.exe
2332	Unicorn-51427.exe
1640	Unicorn-18517.exe
2332	Unicorn-51427.exe
1640	Unicorn-18517.exe
1084	Unicorn-15893.exe
1084	Unicorn-15893.exe
2496	Unicorn-13647.exe
2496	Unicorn-13647.exe
2744	Unicorn-59668.exe
2744	Unicorn-59668.exe
2284	WerFault.exe
2284	WerFault.exe
2284	WerFault.exe
2284	WerFault.exe
2228	WerFault.exe
2228	WerFault.exe
2228	WerFault.exe
2228	WerFault.exe
2228	WerFault.exe
2284	WerFault.exe
1268	Unicorn-37619.exe
1268	Unicorn-37619.exe
784	Unicorn-29113.exe
2700	Unicorn-37619.exe
784	Unicorn-29113.exe
2700	Unicorn-37619.exe
2652	Unicorn-44453.exe
2652	Unicorn-44453.exe
2524	Unicorn-20707.exe
2524	Unicorn-20707.exe

Program crash 64 IoCs

pid	pid_target	Process	procid_target
2228	2800	WerFault.exe	33
2284	2472	WerFault.exe	40
1508	2820	WerFault.exe	51
3016	3048	WerFault.exe	46
2936	1932	WerFault.exe	57
352	2152	WerFault.exe	66
780	2772	WerFault.exe	69
2456	2728	WerFault.exe	71
1428	2352	WerFault.exe	68
2716	2360	WerFault.exe	62
1512	1112	WerFault.exe	79
1608	1804	WerFault.exe	91
2492	1740	WerFault.exe	64
3732	2368	WerFault.exe	122
3088	1376	WerFault.exe	138
3116	2516	WerFault.exe	140
3852	2940	WerFault.exe	144
4084	2064	WerFault.exe	88
3372	2440	WerFault.exe	87
3440	1080	WerFault.exe	99
3364	2392	WerFault.exe	98
3720	2796	WerFault.exe	102
3620	948	WerFault.exe	159
4220	2416	WerFault.exe	56
4228	1684	WerFault.exe	55
4252	1444	WerFault.exe	157
4328	2112	WerFault.exe	119
4388	1688	WerFault.exe	151
5024	2980	WerFault.exe	112
5012	1632	WerFault.exe	38
5036	1348	WerFault.exe	136
5056	2168	WerFault.exe	146
4112	2740	WerFault.exe	131
4116	604	WerFault.exe	123
3584	620	WerFault.exe	137
4068	448	WerFault.exe	129
5096	2924	WerFault.exe	153
5088	1448	WerFault.exe	135
4180	1172	WerFault.exe	113
4188	760	WerFault.exe	85
4196	2984	WerFault.exe	80
4204	912	WerFault.exe	83
4260	1496	WerFault.exe	86
4236	2720	WerFault.exe	120
4532	2992	WerFault.exe	187
4476	2672	WerFault.exe	156
4496	1996	WerFault.exe	132
4660	2836	WerFault.exe	67
4776	1584	WerFault.exe	94
4752	484	WerFault.exe	107
4724	2768	WerFault.exe	101
4828	2552	WerFault.exe	143
4812	996	WerFault.exe	145
4808	1672	WerFault.exe	148
4884	1668	WerFault.exe	52
5612	2504	WerFault.exe	154
5604	788	WerFault.exe	147
5596	2400	WerFault.exe	180
5632	1904	WerFault.exe	50
5648	1620	WerFault.exe	65
5656	2828	WerFault.exe	70
5732	2908	WerFault.exe	126
5740	1712	WerFault.exe	106
5724	2320	WerFault.exe	90

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20707.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4464.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8161.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58170.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8078.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61028.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31442.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33498.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52857.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10314.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50469.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19607.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6018.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26464.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16202.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3127.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-434.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49955.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57901.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59992.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16108.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25227.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6594.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1725.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56298.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41254.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35005.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23969.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49013.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56331.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35997.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58707.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23254.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56449.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28344.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63306.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23306.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30495.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19351.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25995.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40722.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64373.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48163.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57219.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2132.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35766.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3630.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47710.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35872.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25464.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57756.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39719.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16357.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21316.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51129.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6945.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40799.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21637.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13790.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33549.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47520.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32989.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37134.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21371.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2380	8bfef7e6bd8ec5bb0b527fed3a4079b0N.exe
1084	Unicorn-15893.exe
1796	Unicorn-63357.exe
2332	Unicorn-51427.exe
2744	Unicorn-59668.exe
2668	Unicorn-4529.exe
2800	Unicorn-56331.exe
2652	Unicorn-44453.exe
784	Unicorn-29113.exe
2472	Unicorn-18709.exe
1632	Unicorn-64380.exe
1640	Unicorn-18517.exe
2496	Unicorn-13647.exe
1268	Unicorn-37619.exe
2700	Unicorn-37619.exe
2524	Unicorn-20707.exe
1948	Unicorn-16108.exe
2536	Unicorn-28112.exe
3048	Unicorn-33408.exe
2820	Unicorn-6674.exe
2092	Unicorn-23203.exe
1904	Unicorn-6409.exe
1668	Unicorn-52346.exe
2220	Unicorn-43556.exe
2600	Unicorn-6778.exe
1684	Unicorn-26644.exe
2416	Unicorn-23306.exe
1932	Unicorn-29332.exe
992	Unicorn-8698.exe
1660	Unicorn-15600.exe
1088	Unicorn-57327.exe
2360	Unicorn-14448.exe
1620	Unicorn-30977.exe
1740	Unicorn-15517.exe
2152	Unicorn-50613.exe
2836	Unicorn-63877.exe
2352	Unicorn-25604.exe
2828	Unicorn-8891.exe
2772	Unicorn-11691.exe
2728	Unicorn-49617.exe
2664	Unicorn-46581.exe
2692	Unicorn-44965.exe
2864	Unicorn-58156.exe
1676	Unicorn-30933.exe
1320	Unicorn-64373.exe
2424	Unicorn-41331.exe
2984	Unicorn-57475.exe
1076	Unicorn-10683.exe
1112	Unicorn-30549.exe
1484	Unicorn-699.exe
912	Unicorn-20565.exe
964	Unicorn-64704.exe
760	Unicorn-53922.exe
1496	Unicorn-1576.exe
2440	Unicorn-37010.exe
2064	Unicorn-40502.exe
2320	Unicorn-42111.exe
1804	Unicorn-6594.exe
1708	Unicorn-316.exe
1584	Unicorn-42604.exe
1532	Unicorn-17483.exe
2392	Unicorn-6018.exe
1080	Unicorn-5337.exe
2768	Unicorn-60668.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2380 wrote to memory of 1084	2380	8bfef7e6bd8ec5bb0b527fed3a4079b0N.exe	29
PID 2380 wrote to memory of 1084	2380	8bfef7e6bd8ec5bb0b527fed3a4079b0N.exe	29
PID 2380 wrote to memory of 1084	2380	8bfef7e6bd8ec5bb0b527fed3a4079b0N.exe	29
PID 2380 wrote to memory of 1084	2380	8bfef7e6bd8ec5bb0b527fed3a4079b0N.exe	29
PID 2380 wrote to memory of 1796	2380	8bfef7e6bd8ec5bb0b527fed3a4079b0N.exe	31
PID 2380 wrote to memory of 1796	2380	8bfef7e6bd8ec5bb0b527fed3a4079b0N.exe	31
PID 2380 wrote to memory of 1796	2380	8bfef7e6bd8ec5bb0b527fed3a4079b0N.exe	31
PID 2380 wrote to memory of 1796	2380	8bfef7e6bd8ec5bb0b527fed3a4079b0N.exe	31
PID 1084 wrote to memory of 2332	1084	Unicorn-15893.exe	30
PID 1084 wrote to memory of 2332	1084	Unicorn-15893.exe	30
PID 1084 wrote to memory of 2332	1084	Unicorn-15893.exe	30
PID 1084 wrote to memory of 2332	1084	Unicorn-15893.exe	30
PID 2332 wrote to memory of 2744	2332	Unicorn-51427.exe	32
PID 2332 wrote to memory of 2744	2332	Unicorn-51427.exe	32
PID 2332 wrote to memory of 2744	2332	Unicorn-51427.exe	32
PID 2332 wrote to memory of 2744	2332	Unicorn-51427.exe	32
PID 1084 wrote to memory of 2800	1084	Unicorn-15893.exe	33
PID 1084 wrote to memory of 2800	1084	Unicorn-15893.exe	33
PID 1084 wrote to memory of 2800	1084	Unicorn-15893.exe	33
PID 1084 wrote to memory of 2800	1084	Unicorn-15893.exe	33
PID 2380 wrote to memory of 2668	2380	8bfef7e6bd8ec5bb0b527fed3a4079b0N.exe	34
PID 2380 wrote to memory of 2668	2380	8bfef7e6bd8ec5bb0b527fed3a4079b0N.exe	34
PID 2380 wrote to memory of 2668	2380	8bfef7e6bd8ec5bb0b527fed3a4079b0N.exe	34
PID 2380 wrote to memory of 2668	2380	8bfef7e6bd8ec5bb0b527fed3a4079b0N.exe	34
PID 2668 wrote to memory of 2652	2668	Unicorn-4529.exe	35
PID 2668 wrote to memory of 2652	2668	Unicorn-4529.exe	35
PID 2668 wrote to memory of 2652	2668	Unicorn-4529.exe	35
PID 2668 wrote to memory of 2652	2668	Unicorn-4529.exe	35
PID 2380 wrote to memory of 784	2380	8bfef7e6bd8ec5bb0b527fed3a4079b0N.exe	36
PID 2380 wrote to memory of 784	2380	8bfef7e6bd8ec5bb0b527fed3a4079b0N.exe	36
PID 2380 wrote to memory of 784	2380	8bfef7e6bd8ec5bb0b527fed3a4079b0N.exe	36
PID 2380 wrote to memory of 784	2380	8bfef7e6bd8ec5bb0b527fed3a4079b0N.exe	36
PID 2744 wrote to memory of 1640	2744	Unicorn-59668.exe	37
PID 2744 wrote to memory of 1640	2744	Unicorn-59668.exe	37
PID 2744 wrote to memory of 1640	2744	Unicorn-59668.exe	37
PID 2744 wrote to memory of 1640	2744	Unicorn-59668.exe	37
PID 1084 wrote to memory of 2496	1084	Unicorn-15893.exe	39
PID 1084 wrote to memory of 2496	1084	Unicorn-15893.exe	39
PID 1084 wrote to memory of 2496	1084	Unicorn-15893.exe	39
PID 1084 wrote to memory of 2496	1084	Unicorn-15893.exe	39
PID 2800 wrote to memory of 2472	2800	Unicorn-56331.exe	40
PID 2800 wrote to memory of 2472	2800	Unicorn-56331.exe	40
PID 2800 wrote to memory of 2472	2800	Unicorn-56331.exe	40
PID 2800 wrote to memory of 2472	2800	Unicorn-56331.exe	40
PID 2332 wrote to memory of 1632	2332	Unicorn-51427.exe	38
PID 2332 wrote to memory of 1632	2332	Unicorn-51427.exe	38
PID 2332 wrote to memory of 1632	2332	Unicorn-51427.exe	38
PID 2332 wrote to memory of 1632	2332	Unicorn-51427.exe	38
PID 2652 wrote to memory of 2700	2652	Unicorn-44453.exe	42
PID 2652 wrote to memory of 2700	2652	Unicorn-44453.exe	42
PID 2652 wrote to memory of 2700	2652	Unicorn-44453.exe	42
PID 2652 wrote to memory of 2700	2652	Unicorn-44453.exe	42
PID 784 wrote to memory of 1268	784	Unicorn-29113.exe	41
PID 784 wrote to memory of 1268	784	Unicorn-29113.exe	41
PID 784 wrote to memory of 1268	784	Unicorn-29113.exe	41
PID 784 wrote to memory of 1268	784	Unicorn-29113.exe	41
PID 2668 wrote to memory of 1948	2668	Unicorn-4529.exe	43
PID 2668 wrote to memory of 1948	2668	Unicorn-4529.exe	43
PID 2668 wrote to memory of 1948	2668	Unicorn-4529.exe	43
PID 2668 wrote to memory of 1948	2668	Unicorn-4529.exe	43
PID 1632 wrote to memory of 2524	1632	Unicorn-64380.exe	44
PID 1632 wrote to memory of 2524	1632	Unicorn-64380.exe	44
PID 1632 wrote to memory of 2524	1632	Unicorn-64380.exe	44
PID 1632 wrote to memory of 2524	1632	Unicorn-64380.exe	44

C:\Users\Admin\AppData\Local\Temp\8bfef7e6bd8ec5bb0b527fed3a4079b0N.exe
"C:\Users\Admin\AppData\Local\Temp\8bfef7e6bd8ec5bb0b527fed3a4079b0N.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2380
- C:\Users\Admin\AppData\Local\Temp\Unicorn-15893.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-15893.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1084
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51427.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51427.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59668.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59668.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18517.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:1640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23203.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49617.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2728
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2728 -s 220
        8⤵
        Program crash
        
        PID:2456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6018.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40799.exe
        8⤵
        
        PID:948
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 948 -s 220
        9⤵
        Program crash
        
        PID:3620
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2392 -s 212
        8⤵
        Program crash
        
        PID:3364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52925.exe
        7⤵
        
        PID:2764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54937.exe
        8⤵
        
        PID:5044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65288.exe
        8⤵
        
        PID:6788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14320.exe
        8⤵
        
        PID:7212
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2764 -s 244
        8⤵
        
        PID:7248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55675.exe
        7⤵
        
        PID:3484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54585.exe
        7⤵
        
        PID:5624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23772.exe
        7⤵
        
        PID:6452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25144.exe
        7⤵
        
        PID:8084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53045.exe
        7⤵
        
        PID:8836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46581.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60668.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30804.exe
        8⤵
        
        PID:2412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3630.exe
        9⤵
        
        PID:3884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16202.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:4432
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2412 -s 240
        9⤵
        
        PID:6196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38523.exe
        8⤵
        
        PID:3960
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2768 -s 240
        8⤵
        Program crash
        
        PID:4724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46709.exe
        7⤵
        
        PID:2940
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2940 -s 236
        8⤵
        Program crash
        
        PID:3852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52259.exe
        7⤵
        
        PID:3940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53987.exe
        7⤵
        
        PID:4740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10686.exe
        7⤵
        
        PID:6796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60522.exe
        7⤵
        
        PID:7196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43035.exe
        7⤵
        
        PID:7496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4056.exe
        7⤵
        
        PID:940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37818.exe
        6⤵
        
        PID:2776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14296.exe
        7⤵
        
        PID:2520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28522.exe
        8⤵
        
        PID:6284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5925.exe
        8⤵
        
        PID:7812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51771.exe
        8⤵
        
        PID:8544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36432.exe
        7⤵
        
        PID:3524
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2776 -s 240
        7⤵
        
        PID:5968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37213.exe
        6⤵
        
        PID:1780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35372.exe
        7⤵
        
        PID:6696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49013.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63198.exe
        7⤵
        
        PID:8232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36589.exe
        6⤵
        
        PID:3300
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1640 -s 244
        6⤵
        
        PID:5940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52346.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15517.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42111.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7057.exe
        8⤵
        
        PID:2904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45520.exe
        9⤵
        
        PID:3768
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2904 -s 224
        9⤵
        
        PID:5960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35005.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3412
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2320 -s 220
        8⤵
        Program crash
        
        PID:5724
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1740 -s 244
        7⤵
        Program crash
        
        PID:2492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6594.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1804
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1804 -s 240
        7⤵
        Program crash
        
        PID:1608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40678.exe
        6⤵
        
        PID:1688
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1688 -s 216
        7⤵
        Program crash
        
        PID:4388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49323.exe
        6⤵
        
        PID:4012
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1668 -s 220
        6⤵
        Program crash
        
        PID:4884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11691.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2772
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2772 -s 220
        6⤵
        Program crash
        
        PID:780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60403.exe
        5⤵
        Executes dropped EXE
        
        PID:2952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47332.exe
        6⤵
        
        PID:2896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19884.exe
        7⤵
        
        PID:3780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36861.exe
        7⤵
        
        PID:4796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35370.exe
        7⤵
        
        PID:6420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56760.exe
        7⤵
        
        PID:2200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61028.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59992.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49302.exe
        6⤵
        
        PID:3832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1972.exe
        6⤵
        
        PID:4728
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2952 -s 232
        6⤵
        
        PID:6104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24862.exe
        5⤵
        
        PID:1056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3630.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21978.exe
        6⤵
        
        PID:4596
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1056 -s 220
        6⤵
        
        PID:5328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32923.exe
        5⤵
        
        PID:3952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45852.exe
        5⤵
        
        PID:4720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55222.exe
        5⤵
        
        PID:6836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50721.exe
        5⤵
        
        PID:6540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20369.exe
        5⤵
        
        PID:8136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40722.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64380.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64380.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20707.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29332.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1932
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1932 -s 236
        7⤵
        Program crash
        
        PID:2936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-699.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55811.exe
        7⤵
        
        PID:2256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61741.exe
        8⤵
        
        PID:3724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24577.exe
        9⤵
        
        PID:7252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5052.exe
        9⤵
        
        PID:8428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35685.exe
        8⤵
        
        PID:4712
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2256 -s 240
        8⤵
        
        PID:6124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55991.exe
        7⤵
        
        PID:3840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18187.exe
        8⤵
        
        PID:8248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54822.exe
        8⤵
        
        PID:4136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30046.exe
        7⤵
        
        PID:5068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23363.exe
        7⤵
        
        PID:6204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29646.exe
        7⤵
        
        PID:7100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56506.exe
        7⤵
        
        PID:8044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22106.exe
        7⤵
        
        PID:8700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20189.exe
        6⤵
        
        PID:1228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23254.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54868.exe
        8⤵
        
        PID:7036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18239.exe
        8⤵
        
        PID:7448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21371.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:8324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44295.exe
        7⤵
        
        PID:3560
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1228 -s 236
        7⤵
        
        PID:5844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23098.exe
        6⤵
        
        PID:2236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6862.exe
        7⤵
        
        PID:5296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19927.exe
        7⤵
        
        PID:6992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46199.exe
        7⤵
        
        PID:7392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27237.exe
        7⤵
        
        PID:8292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53969.exe
        6⤵
        
        PID:4036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20068.exe
        6⤵
        
        PID:5880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43526.exe
        6⤵
        
        PID:6776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4464.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31566.exe
        6⤵
        
        PID:9052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8698.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20565.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25360.exe
        7⤵
        
        PID:604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10319.exe
        8⤵
        
        PID:3868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4421.exe
        9⤵
        
        PID:7840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55.exe
        9⤵
        
        PID:8004
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 604 -s 244
        8⤵
        Program crash
        
        PID:4116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25046.exe
        7⤵
        
        PID:3968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1378.exe
        8⤵
        
        PID:8320
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 912 -s 240
        7⤵
        Program crash
        
        PID:4204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47316.exe
        6⤵
        
        PID:2312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61136.exe
        7⤵
        
        PID:3160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1293.exe
        8⤵
        
        PID:6616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12438.exe
        8⤵
        
        PID:7276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58528.exe
        8⤵
        
        PID:8696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-434.exe
        7⤵
        
        PID:4312
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2312 -s 240
        7⤵
        
        PID:5308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48325.exe
        6⤵
        
        PID:3332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61810.exe
        7⤵
        
        PID:7944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7475.exe
        7⤵
        
        PID:8632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20034.exe
        6⤵
        
        PID:4208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10942.exe
        6⤵
        
        PID:6028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60010.exe
        6⤵
        
        PID:6988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59928.exe
        6⤵
        
        PID:7484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36901.exe
        6⤵
        
        PID:9000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64704.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48048.exe
        6⤵
        
        PID:2212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7366.exe
        7⤵
        
        PID:3512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4555.exe
        8⤵
        
        PID:7660
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3512 -s 224
        8⤵
        
        PID:8520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-434.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4360
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2212 -s 220
        7⤵
        
        PID:6132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52244.exe
        6⤵
        
        PID:3640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9641.exe
        7⤵
        
        PID:7936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57756.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31356.exe
        6⤵
        
        PID:4636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4999.exe
        6⤵
        
        PID:5496
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 964 -s 240
        6⤵
        
        PID:6340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17331.exe
        5⤵
        
        PID:1544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11087.exe
        6⤵
        
        PID:3760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59527.exe
        7⤵
        
        PID:7984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44435.exe
        7⤵
        
        PID:8976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50569.exe
        6⤵
        
        PID:4756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21303.exe
        6⤵
        
        PID:6116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57219.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64655.exe
        6⤵
        
        PID:6428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64989.exe
        6⤵
        
        PID:8412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35322.exe
        5⤵
        
        PID:3896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30356.exe
        6⤵
        
        PID:8648
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1632 -s 244
        5⤵
        Program crash
        
        PID:5012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33408.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33408.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3048
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3048 -s 220
        5⤵
        Program crash
        
        PID:3016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50613.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50613.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2152
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2152 -s 236
        5⤵
        Program crash
        
        PID:352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-316.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-316.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39719.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53430.exe
        6⤵
        
        PID:1760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15159.exe
        7⤵
        
        PID:6308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54353.exe
        7⤵
        
        PID:8020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58170.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11430.exe
        6⤵
        
        PID:3564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39404.exe
        6⤵
        
        PID:5920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51661.exe
        6⤵
        
        PID:6724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25464.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41366.exe
        6⤵
        
        PID:9100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53082.exe
        5⤵
        
        PID:3036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48163.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11822.exe
        6⤵
        
        PID:6404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35608.exe
        6⤵
        
        PID:8072
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3036 -s 220
        6⤵
        
        PID:8964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58222.exe
        5⤵
        
        PID:3520
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1708 -s 232
        5⤵
        
        PID:5820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3309.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3309.exe
      4⤵
      PID:1648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27315.exe
        5⤵
        
        PID:4044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56734.exe
        6⤵
        
        PID:8728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16311.exe
        5⤵
        
        PID:5076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17497.exe
        5⤵
        
        PID:5376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38312.exe
        5⤵
        
        PID:7112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7504.exe
        5⤵
        
        PID:8032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5041.exe
        5⤵
        
        PID:8612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55344.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55344.exe
      4⤵
      PID:4076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40247.exe
        5⤵
        
        PID:8440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6246.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6246.exe
      4⤵
      PID:5048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53898.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53898.exe
      4⤵
      PID:6160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2132.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2132.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39890.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39890.exe
      4⤵
      PID:7408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55305.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55305.exe
      4⤵
      PID:8360
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56331.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56331.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18709.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18709.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2472
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2472 -s 236
        5⤵
        Loads dropped DLL
        Program crash
        
        PID:2284
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2800 -s 232
      4⤵
      Loads dropped DLL
      Program crash
      PID:2228
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13647.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13647.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6674.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6674.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2820
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2820 -s 216
        5⤵
        Program crash
        
        PID:1508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63877.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63877.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42604.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3834.exe
        6⤵
        
        PID:788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7782.exe
        7⤵
        
        PID:1984
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 788 -s 212
        7⤵
        Program crash
        
        PID:5604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41294.exe
        6⤵
        
        PID:3328
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1584 -s 240
        6⤵
        Program crash
        
        PID:4776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58847.exe
        5⤵
        
        PID:1672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10314.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3500
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1672 -s 224
        6⤵
        Program crash
        
        PID:4808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59161.exe
        5⤵
        
        PID:3656
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2836 -s 232
        5⤵
        Program crash
        
        PID:4660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5337.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5337.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40799.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31419.exe
        6⤵
        
        PID:5696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63306.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12146.exe
        6⤵
        
        PID:8152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17174.exe
        6⤵
        
        PID:8916
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1080 -s 224
        5⤵
        Program crash
        
        PID:3440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58707.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58707.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41844.exe
        5⤵
        
        PID:4744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3762.exe
        5⤵
        
        PID:6168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32446.exe
        5⤵
        
        PID:7152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16169.exe
        5⤵
        
        PID:8076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21576.exe
        5⤵
        
        PID:8656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47669.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47669.exe
      4⤵
      PID:3636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38049.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38049.exe
      4⤵
      PID:5672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9234.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9234.exe
      4⤵
      PID:6564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53882.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53882.exe
      4⤵
      PID:8160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47710.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47710.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:8896
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8896 -s 188
        5⤵
        
        PID:8240
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6409.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6409.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30977.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30977.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45401.exe
        5⤵
        
        PID:2796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41759.exe
        6⤵
        
        PID:1016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64352.exe
        7⤵
        
        PID:2960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25668.exe
        7⤵
        
        PID:5948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46865.exe
        7⤵
        
        PID:6736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31442.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7260
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1016 -s 240
        7⤵
        
        PID:9156
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2796 -s 224
        6⤵
        Program crash
        
        PID:3720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57363.exe
        5⤵
        
        PID:568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5008.exe
        6⤵
        
        PID:6944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31420.exe
        6⤵
        
        PID:7308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12056.exe
        6⤵
        
        PID:8212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8885.exe
        6⤵
        
        PID:9096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49701.exe
        5⤵
        
        PID:3188
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1620 -s 244
        5⤵
        Program crash
        
        PID:5648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58016.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58016.exe
      4⤵
      PID:2688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61468.exe
        5⤵
        
        PID:2748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33467.exe
        6⤵
        
        PID:6664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59303.exe
        6⤵
        
        PID:6368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23602.exe
        6⤵
        
        PID:7976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12800.exe
        6⤵
        
        PID:8668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35472.exe
        5⤵
        
        PID:3156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57385.exe
        5⤵
        
        PID:5664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17369.exe
        5⤵
        
        PID:6520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9346.exe
        5⤵
        
        PID:8144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57511.exe
        5⤵
        
        PID:8852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23817.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23817.exe
      4⤵
      PID:2032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56298.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43649.exe
        5⤵
        
        PID:5680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30336.exe
        5⤵
        
        PID:6644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16558.exe
        5⤵
        
        PID:6268
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2032 -s 220
        5⤵
        
        PID:9192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40657.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40657.exe
      4⤵
      PID:3796
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1904 -s 240
      4⤵
      Program crash
      PID:5632
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8891.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8891.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17737.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17737.exe
      4⤵
      PID:1712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9963.exe
        5⤵
        
        PID:3008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2576.exe
        6⤵
        
        PID:5420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63581.exe
        6⤵
        
        PID:6332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61814.exe
        6⤵
        
        PID:7700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1030.exe
        6⤵
        
        PID:9164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36733.exe
        5⤵
        
        PID:3660
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1712 -s 240
        5⤵
        Program crash
        
        PID:5740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24882.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24882.exe
      4⤵
      PID:2196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6945.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4250.exe
        5⤵
        
        PID:7104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31590.exe
        5⤵
        
        PID:7504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43765.exe
        5⤵
        
        PID:8388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33748.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33748.exe
      4⤵
      PID:3988
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2828 -s 224
      4⤵
      Program crash
      PID:5656
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8607.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8607.exe
    3⤵
    PID:484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53035.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53035.exe
      4⤵
      PID:996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60008.exe
        5⤵
        
        PID:3572
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 996 -s 224
        5⤵
        Program crash
        
        PID:4812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41294.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41294.exe
      4⤵
      PID:3344
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 484 -s 220
      4⤵
      Program crash
      PID:4752
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27038.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27038.exe
    3⤵
    PID:2168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3464.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3464.exe
      4⤵
      PID:3604
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2168 -s 232
      4⤵
      Program crash
      PID:5056
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56449.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56449.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3696
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-911.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-911.exe
    3⤵
    PID:4124
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58099.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58099.exe
    3⤵
    PID:6228
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39933.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39933.exe
    3⤵
    PID:6784
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5353.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5353.exe
    3⤵
    PID:7440
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5168.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5168.exe
    3⤵
    PID:8336
- C:\Users\Admin\AppData\Local\Temp\Unicorn-63357.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-63357.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1796
- C:\Users\Admin\AppData\Local\Temp\Unicorn-4529.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-4529.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2668
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44453.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44453.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37619.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37619.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26644.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30933.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26320.exe
        7⤵
        
        PID:1060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21316.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27436.exe
        9⤵
        
        PID:7720
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3208 -s 212
        9⤵
        
        PID:8496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-434.exe
        8⤵
        
        PID:4304
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1060 -s 220
        8⤵
        
        PID:5152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1725.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39174.exe
        8⤵
        
        PID:7476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53822.exe
        8⤵
        
        PID:8340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14169.exe
        7⤵
        
        PID:4244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19607.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11008.exe
        7⤵
        
        PID:7056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42862.exe
        7⤵
        
        PID:2140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58432.exe
        7⤵
        
        PID:9024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5001.exe
        6⤵
        
        PID:2112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4595.exe
        7⤵
        
        PID:3268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59916.exe
        8⤵
        
        PID:7772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5171.exe
        8⤵
        
        PID:8508
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2112 -s 224
        7⤵
        Program crash
        
        PID:4328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31220.exe
        6⤵
        
        PID:3420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11265.exe
        7⤵
        
        PID:7996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63111.exe
        7⤵
        
        PID:8880
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1684 -s 244
        6⤵
        Program crash
        
        PID:4228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10683.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58115.exe
        6⤵
        
        PID:2276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47545.exe
        7⤵
        
        PID:1732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28176.exe
        8⤵
        
        PID:6088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61900.exe
        8⤵
        
        PID:6108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35416.exe
        8⤵
        
        PID:8056
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1732 -s 224
        8⤵
        
        PID:9116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37008.exe
        7⤵
        
        PID:3296
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2276 -s 240
        7⤵
        
        PID:5716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17420.exe
        6⤵
        
        PID:640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60234.exe
        7⤵
        
        PID:7160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34466.exe
        7⤵
        
        PID:7628
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 640 -s 220
        7⤵
        
        PID:8560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39390.exe
        6⤵
        
        PID:3740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45269.exe
        6⤵
        
        PID:5908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42996.exe
        6⤵
        
        PID:6884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8929.exe
        6⤵
        
        PID:7284
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1076 -s 240
        6⤵
        
        PID:9172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51217.exe
        5⤵
        
        PID:2720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47685.exe
        6⤵
        
        PID:2924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51129.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59495.exe
        8⤵
        
        PID:8300
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2924 -s 244
        7⤵
        Program crash
        
        PID:5096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30495.exe
        6⤵
        
        PID:3536
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2720 -s 240
        6⤵
        Program crash
        
        PID:4236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-331.exe
        5⤵
        
        PID:2504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39879.exe
        6⤵
        
        PID:3136
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2504 -s 212
        6⤵
        Program crash
        
        PID:5612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40658.exe
        5⤵
        
        PID:3980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12559.exe
        5⤵
        
        PID:4588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11216.exe
        5⤵
        
        PID:6828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56056.exe
        5⤵
        
        PID:6512
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2700 -s 240
        5⤵
        
        PID:2348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23306.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23306.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64373.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20150.exe
        6⤵
        
        PID:1172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61556.exe
        7⤵
        
        PID:620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52857.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3544
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 620 -s 244
        8⤵
        Program crash
        
        PID:3584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47299.exe
        7⤵
        
        PID:3664
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1172 -s 240
        7⤵
        Program crash
        
        PID:4180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27466.exe
        6⤵
        
        PID:1376
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1376 -s 236
        7⤵
        Program crash
        
        PID:3088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39716.exe
        6⤵
        
        PID:3284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35912.exe
        6⤵
        
        PID:5112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14697.exe
        6⤵
        
        PID:6216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7732.exe
        6⤵
        
        PID:6780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8418.exe
        6⤵
        
        PID:7460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36839.exe
        6⤵
        
        PID:8396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35836.exe
        5⤵
        
        PID:588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9439.exe
        6⤵
        
        PID:3128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57025.exe
        7⤵
        
        PID:6624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50093.exe
        7⤵
        
        PID:7328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13790.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-434.exe
        6⤵
        
        PID:4320
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 588 -s 240
        6⤵
        
        PID:5184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14801.exe
        5⤵
        
        PID:3240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53014.exe
        6⤵
        
        PID:7420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7636.exe
        6⤵
        
        PID:8308
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2416 -s 244
        5⤵
        Program crash
        
        PID:4220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41331.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41331.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42080.exe
        5⤵
        
        PID:2368
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2368 -s 220
        6⤵
        Program crash
        
        PID:3732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57444.exe
        5⤵
        
        PID:3808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32195.exe
        6⤵
        
        PID:8188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3454.exe
        6⤵
        
        PID:8820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63920.exe
        5⤵
        
        PID:4832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27169.exe
        5⤵
        
        PID:5276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48554.exe
        5⤵
        
        PID:6852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48119.exe
        5⤵
        
        PID:2660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16517.exe
        5⤵
        
        PID:8452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63351.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63351.exe
      4⤵
      PID:2908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29948.exe
        5⤵
        
        PID:2852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27178.exe
        6⤵
        
        PID:6212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7954.exe
        6⤵
        
        PID:7692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51771.exe
        6⤵
        
        PID:8552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21056.exe
        5⤵
        
        PID:3756
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2908 -s 240
        5⤵
        Program crash
        
        PID:5732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28355.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28355.exe
      4⤵
      PID:2400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55338.exe
        5⤵
        
        PID:3228
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2400 -s 232
        5⤵
        Program crash
        
        PID:5596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20054.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20054.exe
      4⤵
      PID:3168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37134.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37134.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21995.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21995.exe
      4⤵
      PID:6768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64666.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64666.exe
      4⤵
      PID:7360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35766.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35766.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:9080
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16108.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16108.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15600.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15600.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53922.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20010.exe
        6⤵
        
        PID:2740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19334.exe
        7⤵
        
        PID:3416
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2740 -s 224
        7⤵
        Program crash
        
        PID:4112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30495.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2436
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 760 -s 240
        6⤵
        Program crash
        
        PID:4188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35997.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39699.exe
        6⤵
        
        PID:2992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27637.exe
        7⤵
        
        PID:3104
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2992 -s 232
        7⤵
        Program crash
        
        PID:4532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57439.exe
        6⤵
        
        PID:3464
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1996 -s 236
        6⤵
        Program crash
        
        PID:4496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36257.exe
        5⤵
        
        PID:2300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23969.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49901.exe
        6⤵
        
        PID:7960
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2300 -s 240
        6⤵
        
        PID:8256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45722.exe
        5⤵
        
        PID:4032
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1660 -s 236
        5⤵
        
        PID:5796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1576.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1576.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15344.exe
        5⤵
        
        PID:2516
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2516 -s 236
        6⤵
        Program crash
        
        PID:3116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58570.exe
        5⤵
        
        PID:3112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50707.exe
        6⤵
        
        PID:8812
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1496 -s 220
        5⤵
        Program crash
        
        PID:4260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11819.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11819.exe
      4⤵
      PID:2552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10340.exe
        5⤵
        
        PID:3256
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2552 -s 224
        5⤵
        Program crash
        
        PID:4828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10651.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10651.exe
      4⤵
      PID:4088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45322.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45322.exe
      4⤵
      PID:4792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59688.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59688.exe
      4⤵
      PID:6804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12050.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12050.exe
      4⤵
      PID:7204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21504.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21504.exe
      4⤵
      PID:7968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64258.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64258.exe
      4⤵
      PID:8304
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57327.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57327.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37010.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37010.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7057.exe
        5⤵
        
        PID:796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42778.exe
        6⤵
        
        PID:4852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28344.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1367.exe
        6⤵
        
        PID:6304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6543.exe
        6⤵
        
        PID:7436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45308.exe
        6⤵
        
        PID:8724
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2440 -s 232
        5⤵
        Program crash
        
        PID:3372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55635.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55635.exe
      4⤵
      PID:2384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7457.exe
        5⤵
        
        PID:6488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26464.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37635.exe
        5⤵
        
        PID:7464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27876.exe
        5⤵
        
        PID:8492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50469.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50469.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63250.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63250.exe
      4⤵
      PID:5640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40308.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40308.exe
      4⤵
      PID:6444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8078.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8078.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:8092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9039.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9039.exe
      4⤵
      PID:8824
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40502.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40502.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33269.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33269.exe
      4⤵
      PID:2532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20300.exe
        5⤵
        
        PID:4400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49208.exe
        5⤵
        
        PID:5316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11779.exe
        5⤵
        
        PID:6256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33362.exe
        5⤵
        
        PID:7788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57902.exe
        5⤵
        
        PID:9132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29722.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29722.exe
      4⤵
      PID:4008
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2064 -s 236
      4⤵
      Program crash
      PID:4084
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47520.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47520.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19671.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19671.exe
      4⤵
      PID:3304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22476.exe
        5⤵
        
        PID:6316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51192.exe
        5⤵
        
        PID:6396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59121.exe
        5⤵
        
        PID:7176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3127.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9128
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1444 -s 232
      4⤵
      Program crash
      PID:4252
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61278.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61278.exe
    3⤵
    PID:3448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37804.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37804.exe
      4⤵
      PID:7600
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3448 -s 224
      4⤵
      PID:8528
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11899.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11899.exe
    3⤵
    PID:4276
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55478.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55478.exe
    3⤵
    PID:6044
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50209.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50209.exe
    3⤵
    PID:7044
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37262.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37262.exe
    3⤵
    PID:7500
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8030.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8030.exe
    3⤵
    PID:9032
- C:\Users\Admin\AppData\Local\Temp\Unicorn-29113.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-29113.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:784
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37619.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37619.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43556.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43556.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44965.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53974.exe
        6⤵
        
        PID:2628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7558.exe
        7⤵
        
        PID:3548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49579.exe
        8⤵
        
        PID:7952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46967.exe
        8⤵
        
        PID:9072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16962.exe
        7⤵
        
        PID:4420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13742.exe
        7⤵
        
        PID:6052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19673.exe
        7⤵
        
        PID:7008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59398.exe
        7⤵
        
        PID:7520
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2628 -s 232
        7⤵
        
        PID:9088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53313.exe
        6⤵
        
        PID:3668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8515.exe
        7⤵
        
        PID:7316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21637.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31356.exe
        6⤵
        
        PID:4644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4999.exe
        6⤵
        
        PID:5508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8979.exe
        6⤵
        
        PID:6272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8161.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7760
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2692 -s 240
        6⤵
        
        PID:9040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33340.exe
        5⤵
        
        PID:2964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56375.exe
        6⤵
        
        PID:3476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12308.exe
        7⤵
        
        PID:8036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63111.exe
        7⤵
        
        PID:8888
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3476 -s 236
        7⤵
        
        PID:8928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-434.exe
        6⤵
        
        PID:4348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62943.exe
        6⤵
        
        PID:6140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51085.exe
        6⤵
        
        PID:7156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59014.exe
        6⤵
        
        PID:7672
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2964 -s 244
        6⤵
        
        PID:9204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33498.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36398.exe
        6⤵
        
        PID:8068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49463.exe
        6⤵
        
        PID:8204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54819.exe
        5⤵
        
        PID:4548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10558.exe
        5⤵
        
        PID:5344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57981.exe
        5⤵
        
        PID:7132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25227.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7780
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2220 -s 244
        5⤵
        
        PID:9008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58156.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58156.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53206.exe
        5⤵
        
        PID:1328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30856.exe
        6⤵
        
        PID:1952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63200.exe
        7⤵
        
        PID:4152
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1952 -s 244
        7⤵
        
        PID:5336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29722.exe
        6⤵
        
        PID:4020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63690.exe
        6⤵
        
        PID:4876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19351.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6856
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1328 -s 240
        6⤵
        
        PID:7188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44540.exe
        5⤵
        
        PID:2592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49588.exe
        6⤵
        
        PID:4052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49955.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13486.exe
        6⤵
        
        PID:6812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20185.exe
        6⤵
        
        PID:6592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42505.exe
        6⤵
        
        PID:7972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8521.exe
        6⤵
        
        PID:8228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43458.exe
        5⤵
        
        PID:3992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4018.exe
        5⤵
        
        PID:4824
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2864 -s 236
        5⤵
        
        PID:6728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31232.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31232.exe
      4⤵
      PID:2980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13699.exe
        5⤵
        
        PID:1448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12898.exe
        6⤵
        
        PID:3140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57901.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8576
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1448 -s 244
        6⤵
        Program crash
        
        PID:5088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58186.exe
        5⤵
        
        PID:3180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55855.exe
        6⤵
        
        PID:8808
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2980 -s 236
        5⤵
        Program crash
        
        PID:5024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29496.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29496.exe
      4⤵
      PID:1348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45846.exe
        5⤵
        
        PID:3320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47891.exe
        6⤵
        
        PID:8784
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1348 -s 232
        5⤵
        Program crash
        
        PID:5036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36915.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36915.exe
      4⤵
      PID:3264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41254.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8480
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10711.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10711.exe
      4⤵
      PID:4996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15227.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15227.exe
      4⤵
      PID:6152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3267.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3267.exe
      4⤵
      PID:6720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63426.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63426.exe
      4⤵
      PID:7428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35704.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35704.exe
      4⤵
      PID:8316
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6778.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6778.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30549.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30549.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1112
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1112 -s 236
        5⤵
        Program crash
        
        PID:1512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44628.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44628.exe
      4⤵
      PID:2912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4504.exe
        5⤵
        
        PID:2316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42375.exe
        6⤵
        
        PID:3580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43649.exe
        6⤵
        
        PID:5756
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2316 -s 240
        6⤵
        
        PID:6656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25654.exe
        5⤵
        
        PID:3976
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2912 -s 240
        5⤵
        
        PID:5928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30771.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30771.exe
      4⤵
      PID:2644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55340.exe
        5⤵
        
        PID:6344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2183.exe
        5⤵
        
        PID:6464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64596.exe
        5⤵
        
        PID:7268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19655.exe
        5⤵
        
        PID:7444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31031.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31031.exe
      4⤵
      PID:3528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36603.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36603.exe
      4⤵
      PID:5872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27529.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27529.exe
      4⤵
      PID:6896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25995.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25995.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7336
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2600 -s 244
      4⤵
      PID:9184
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57475.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57475.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33549.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33549.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13007.exe
        5⤵
        
        PID:3932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21033.exe
        6⤵
        
        PID:8180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18996.exe
        6⤵
        
        PID:8460
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 448 -s 244
        5⤵
        Program crash
        
        PID:4068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40505.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40505.exe
      4⤵
      PID:4000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54748.exe
        5⤵
        
        PID:6468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50709.exe
        5⤵
        
        PID:8604
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2984 -s 240
      4⤵
      Program crash
      PID:4196
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19744.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19744.exe
    3⤵
    PID:2868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58531.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58531.exe
      4⤵
      PID:2508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14084.exe
        5⤵
        
        PID:6544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35872.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18249.exe
        5⤵
        
        PID:7684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27876.exe
        5⤵
        
        PID:8516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26121.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26121.exe
      4⤵
      PID:3712
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2868 -s 236
      4⤵
      PID:5856
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32989.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32989.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51043.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51043.exe
      4⤵
      PID:5408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44604.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44604.exe
      4⤵
      PID:6472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26007.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26007.exe
      4⤵
      PID:8172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64035.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64035.exe
      4⤵
      PID:8952
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28274.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28274.exe
    3⤵
    PID:4168
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60673.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60673.exe
    3⤵
    PID:5264
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55160.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55160.exe
    3⤵
    PID:7128
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-65351.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-65351.exe
    3⤵
    PID:7624
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 784 -s 224
    3⤵
    PID:9144
- C:\Users\Admin\AppData\Local\Temp\Unicorn-28112.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-28112.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2536
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14448.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14448.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2360
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2360 -s 236
      4⤵
      Program crash
      PID:2716
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14207.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14207.exe
    3⤵
    PID:2736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16357.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16357.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61160.exe
        5⤵
        
        PID:3352
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2672 -s 232
        5⤵
        Program crash
        
        PID:4476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30542.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30542.exe
      4⤵
      PID:3624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48122.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48122.exe
      4⤵
      PID:4604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19351.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19351.exe
      4⤵
      PID:6844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11520.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11520.exe
      4⤵
      PID:7180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25969.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25969.exe
      4⤵
      PID:7388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25587.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25587.exe
      4⤵
      PID:8796
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51581.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51581.exe
    3⤵
    PID:3032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33169.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33169.exe
      4⤵
      PID:3592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34386.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34386.exe
      4⤵
      PID:4624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13486.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13486.exe
      4⤵
      PID:6820
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3032 -s 212
      4⤵
      PID:7088
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23579.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23579.exe
    3⤵
    PID:3216
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14377.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14377.exe
    3⤵
    PID:4936
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2536 -s 232
    3⤵
    PID:6744
- C:\Users\Admin\AppData\Local\Temp\Unicorn-25604.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-25604.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2352
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2352 -s 240
    3⤵
    - Program crash
    PID:1428
- C:\Users\Admin\AppData\Local\Temp\Unicorn-17483.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-17483.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1532
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45132.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45132.exe
    3⤵
    PID:2760
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2760 -s 216
      4⤵
      PID:6476
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3485.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3485.exe
    3⤵
    PID:3772
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1532 -s 240
    3⤵
    PID:5708
- C:\Users\Admin\AppData\Local\Temp\Unicorn-47297.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-47297.exe
  2⤵
  PID:2684
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9036.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9036.exe
    3⤵
    PID:5020
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28100.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28100.exe
    3⤵
    PID:6700
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14512.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14512.exe
    3⤵
    PID:6440
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51170.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51170.exe
    3⤵
    PID:8116
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25056.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25056.exe
    3⤵
    PID:8736
- C:\Users\Admin\AppData\Local\Temp\Unicorn-35832.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-35832.exe
  2⤵
  PID:3496
- C:\Users\Admin\AppData\Local\Temp\Unicorn-32449.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-32449.exe
  2⤵
  PID:5688
- C:\Users\Admin\AppData\Local\Temp\Unicorn-43202.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-43202.exe
  2⤵
  PID:6676
- C:\Users\Admin\AppData\Local\Temp\Unicorn-5358.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-5358.exe
  2⤵
  PID:6612
- C:\Users\Admin\AppData\Local\Temp\Unicorn-5230.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-5230.exe
  2⤵
  PID:9212

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-11691.exe

Filesize
468KB

MD5
da75297d077542fda2621e60f0ee9456

SHA1
76698a49453fa5af64b337cc0734bf3b67b12f02

SHA256
292a5d3f10b3b8034e340d3a7df5025e2b970087bf6470b55e61c6eef38b0f03

SHA512
aad3e51affc073965819f7b168aad009272fdb60d57888d2ae41a1bbfa829dc549635754157ff01933f73e56547d5d2bfad20833826c5bc3d8e446ca4646c436

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-11819.exe

Filesize
468KB

MD5
09e2bffc10825c7c241f58eb9f08e5a7

SHA1
bafdc57f379ca59328a2dbeda09399463bef7eae

SHA256
03b6401a93690c59528b1ea31c716bee28b75039c3083a1aa69d77c236f3cfd6

SHA512
eed616c1bd31396acb037c5965d77f529e3280ad81fb7b5c6c68f5ab477b0b35fff359c114360df88fe4d53fd3f0bf936e6b527e1ea8315ad92b2966c469be65

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-12056.exe

Filesize
468KB

MD5
5e74b1eb273ebffb111669e7265f0a0a

SHA1
93fb2bb9ef719813b726091f2c5fd1e7f9c911cb

SHA256
c258f7fbbadfa517448e9f3c14f767d4ef8d7eb9cb4326033ea079872eebfff5

SHA512
066c922d9a4000fffdaee7d81822f58b615672a515e52aed63f1e383fccdbf661ded9d6b81d64f28dfc2e3ef4194b93f0f2379bd874d87113c356306306379b0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-18517.exe

Filesize
468KB

MD5
4e80c5427963b687bb4e598b0c87a888

SHA1
22811e1409dfeb97d59c93b243dc8849630a70f9

SHA256
7130804b96f7e344f1cd79538f7ca5fad1930f3354708b9050db77c4a74f6f34

SHA512
5996145b21248576f117b85f637704f6e4c99285a5a9bc384676774fa563598fb58ed61e4d24622fd6d508f0ee2fc335a11ec9ed02381da7639e75deb226baca

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-19744.exe

Filesize
468KB

MD5
3ebcbcc176cd326c7da437fe10c020bb

SHA1
823ce74d1ebc336b865dbf6f6da48273ec1439d6

SHA256
e8926838dc94260172c1b998daa743ad951423fd234fe576daf0e5e1c10c41c1

SHA512
c2a9c5a47be7d02008b2b44a27e505c6afa45c45abbe4ca6a7ccd0e100c5eb6916d38df1ebc6a622083647b033d5f314e22d1a5b209d5d5f9b9744475b8949bf

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-37619.exe

Filesize
468KB

MD5
2f78be99ccaef03cc0120ec7f1f10708

SHA1
35c5eae95af115d21e2cedb51fba5eea9c692baa

SHA256
db00e1595388d87974590aee3dce2517523930047cf5c1de6a29129a317c8f72

SHA512
4ccaa670171fafb7d956245662d91bfd90d3aa4e06b6919774d69fd1173dd64ef70fb6e926009813b82faead9f62efc04d5f476f8871b162626e3f04c7550738

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-55338.exe

Filesize
468KB

MD5
0e3ccd0749bda045b34b57b7212045d7

SHA1
e5109f2cf43648df23f3a8f150d5b8af2de38f7d

SHA256
c151ceefaa317e5e300714c7165f33db4fbe910edb03fa7e070719efe0c774fa

SHA512
22cd42e10aa44a8f76c3c636aa1260dccc9d5ecc2953d7f473bf8f4bfaf85088270c2c56ebeda1ae8ee5f811b707de35e44206eaaecf86d69d4e363a8c9a9579

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-58528.exe

Filesize
468KB

MD5
c79a730bec923b068e601b3dc9d5da43

SHA1
8792de078f399387be7ac210a0b495e4d824f2eb

SHA256
821346884cec750f01b8c231387464aa80cf0a858f39340a873857afacbabb94

SHA512
ecbdafcd1eabbc60bb0d8989e2a505ca56e3a332b8afee33e7c80cb2dbb7febc394019ed4edf75d02b9b34168219c539e08e2a257fb45af0b0b7271e1f4766d4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-7636.exe

Filesize
468KB

MD5
31df90dff4548e2e699e458ef759941b

SHA1
0dd45048cd06a08ae81046efcf33d255fe61ee50

SHA256
f0c23be5ca9ca94e59a3fd67d91c17ff70001c0f2f526a2f3eeae9d1a866714c

SHA512
d481a526b346957c98cf9712f36d2b929d07e48de9b2bbaf8b6f6b19a836fd1de42baf417fa381f85fc81e91fda6351358cf1c27631bba7b337df949dfb9282a

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-13647.exe

Filesize
468KB

MD5
997ffac739fb5ea95133090a85437ead

SHA1
43aad6b57407fea9338ee122f6a2765b1a090cb3

SHA256
88c4c59b9b42ff874aeed5b8f0a29dc92973e5295b73dc85c4a7f1181687207c

SHA512
de08387f92baef29347a83c37ff4f6f728651bf813f549309f5957aef139bab41817a6565848b7c881e1cde68f2cae04473f1a561757f0d501a8472665bae2d4

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-15893.exe

Filesize
468KB

MD5
34b721ee5c7fb0a55212e9586c93ec25

SHA1
814f312feb7c67e31495b6cb8615a873785fc6a2

SHA256
f33f3269ef7c7b93f743f1c053f347539a8a2c15fb9ed0e0ee3c4597ed197008

SHA512
35ff87869881fc1e126b450901b4152eedd489e1d2963d5b455369162fd02529770b90807ed7d12b54020687ae132a55c6c91ed6bbfdda5b51f680edf3fa4822

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-16108.exe

Filesize
468KB

MD5
47733592126ed2eed776824049526a80

SHA1
a32b6e5fd75137a6982b1c7f90b104da012fe921

SHA256
f0aadd851b1a9fe26d96a8b856eec5b85e1d2d6cd8dad55470f6a4b3fbeb3ef7

SHA512
605ea1ea49dc89465453c187cf479db2d7d00839c0dc0d9edd41a72f0c7283a31e92d13152b2f2bce99591a7e74f65e6c85b95ab5214c4b485ec8b327fdfcba8

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-18709.exe

Filesize
468KB

MD5
60e128e3375abda64c9cf6b08c83607c

SHA1
d5ee2c13f372cde4ab7b1fa5c862b139802df9c5

SHA256
e519e232a4d323d7f763170e4e23a6c193224a42b7ebbc94865e3eb7f3743642

SHA512
1ae3f22038c3ee78d257f23f8537e2bab32c415b670b993d000ef802f5f9047ee6d49e90c406ddabb406c60b584c75f595d638de2cfb4f4bbf361377a6395431

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-20707.exe

Filesize
468KB

MD5
491175f35c673d1017cbaf7eab322549

SHA1
30f8015a66c8d505d461664bd8e2be2df15fa630

SHA256
a97b15626cc41ce5f74779f9f8f1b81f3714639b7a2563566fe2af116bb1c843

SHA512
4ea43db1e11792b958d0d9cd056dfe0d0f01774f17834b93cdb871f6927be43d9e3222ec16506fd8d19969ab92b3fdf39755ef3789ffb7ed66a5d1a6a5cc7d39

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-23203.exe

Filesize
468KB

MD5
a582ef766a00a4e4e70cc067a5238ca5

SHA1
c6ddfbb5eaffe6f7b750693bcb8c9cd74346eeef

SHA256
ea5b7281a25d9ad69a734038f8b5460cb8655df9b85a9e1051876f37a1e217f3

SHA512
17d85f88d6cea1644409fa8bdc1131086ab3cb322155880116067be864697ce825247abb065acb22c31f2b9bbb5245acebb35cdf1434fe34c615db8a4f9a6fe4

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-28112.exe

Filesize
468KB

MD5
e77292aa297caf91a98547bdfe9ad971

SHA1
376a68d56c36f59f4355f9ea2538aa69340a193f

SHA256
7c471753205a58f21dc98115d0f12f78a1a0f2b76f0c23ad54a3a3580534aadc

SHA512
753a7c44776a2f5458a5bf281ec992c8b1960cf662791535d2b813b0bfc6f6883ad03d50e2501010a63115493f20aa9745935053f9419f4e0dbce1959765722c

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-29113.exe

Filesize
468KB

MD5
8469a482cdcebff0ed86b7d3760652d9

SHA1
204171a5605a4513c9753f6524f1bdf6777d06e4

SHA256
230136aabfead69ea43e8e1104ad0bbc6203d7b65b59de65b08443962e42fe13

SHA512
7d47a4344012e93b39b752dfec8e036c78101197f52b60faa68beae37de6306fa7ae04f69d85abf1937293879d8f291bfd6f9cd12ebc4ed118644eb1dd7a864d

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-33408.exe

Filesize
468KB

MD5
8ee5d777f0b5b76fcca1ef0c43ec6bb1

SHA1
0befc3d5c63efee2af5c3fa094845b5535d65138

SHA256
aa8f3f7ac6ce08d9e995e47b5052d5635dc3d681776856c091dcf26d87a7c1e3

SHA512
e788b553b2065540dc50d7142a2238f8f955fe7a0b8892cd3bf3778808cb47878816318cb62819ad294a47193ba565403cd6ae683f8aaeb4ccf68b99b6562498

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-44453.exe

Filesize
468KB

MD5
fc44febcc7470a43750764e56b7e2928

SHA1
b9d0a7bc8377e7948a840ea721ca391fd3c6bf31

SHA256
8688110b85c14a2d907f2612a1501e24779c9a5a24b48debaab85d9e6b40813c

SHA512
8f4fa03fbcd4cb04129d14079d3aeb3438948b6f486b58dba33e89b8e21da9c89784e1314e67044bef5fc5fa3d9f1419131d96407ddefd34f25e5614a3430065

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-4529.exe

Filesize
468KB

MD5
4e37e101887f0699a764a55745acf51f

SHA1
21189d1c0a982524f734c8bba1e137bc01716407

SHA256
21805f6771e3c87791f0a6a686ccd490bda3df52d2bae615afd108cbdf0e7ee3

SHA512
10dacff7266aa239852099b18645a53fca40b956f0a7e7b0169ece324ccbdbaa5c494de56e0805ecd4d9c29305a703b04b48a521c4c4c672f0ca6a0d0285923d

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-51427.exe

Filesize
468KB

MD5
c63e5e5bddeedd0537ff2bc0677ac750

SHA1
6e2f8ed3ab96b326d5474e722dc6c62c7ff2102d

SHA256
be2bbd49d2ef87cacf4ec25a780575a4c483710d88a84e2190a8318049ccc5f2

SHA512
fad1d730d43fddb44388f7e6915accb8454682e4a87ce808ca271b46baa91f77b221e25fdc1acd1dcfd8ff025b3b9ca669135ea118acff67bb4fb2f9448700b5

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-56331.exe

Filesize
468KB

MD5
0a0bede14e49512e71cbda209b02d752

SHA1
5f04fcf70f403036de7c373323d1f2feeed3359f

SHA256
c15cc84ccdf6f0358b71108992720ea154f56537dd9f50e4b9ad482e62d56cda

SHA512
0fcf5ed75a16ecd4f4b7df3b3915c5139110ed587b9996ad03cb86dbb43bfd2ae0d6f36881f930fd96398d944f7cf3c103069366813aba39414092ef162df95e

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-59668.exe

Filesize
468KB

MD5
f709111ec9983a1955d1d79929e00712

SHA1
becf9383808a79633e9b451a06321b1cee11174e

SHA256
18f8dc835e6345d3dfecf28b79c2383163dcaca1762526d288f77838cc482aae

SHA512
8ea76467c40d34323a52f7675388e30c8f9da97036e99dee63a033225d2639b40476117deb8f0aa02798ca6b8f14e623ec6f52a0116117552ffd98d7eaf885c3

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-63357.exe

Filesize
468KB

MD5
ccd8e84965edad0a12fee73c21fecf5e

SHA1
32904438bbf9e5fad016ca27730456e145388a81

SHA256
186ac1500ddc57b4bfbd4b70a313804ade34d4dfb2e5f34704a6a352eb37658b

SHA512
7cf4cff8b41bf24e7dfe45daa3dd73e307b6900aa59f4edd4d5191049f9943d2d61d6ab8f88a271bfd600363dc4eb5dbb12e5043d2da40eda12057d422e9665f

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-64380.exe

Filesize
468KB

MD5
3a59037153c1ec2ca638362964a25d70

SHA1
a3089e932f96a2c3dc9cff0b15bbe8d7ee63011b

SHA256
35e2e8121fedd37f28f9617e4987f74fb133839ad749d221bb6ee385b48aad7f

SHA512
415751b6907d4a4d09842bfb4e38f35737afa49bc8d3b5331b4bba022e6867323ce2bb130be5903e097df8ca38a0224686cea79e8d9dcc522a3e1e0423ef2ede

Download Submit