36d6ee4ba42bb6659ebdea5533e9c201aff6798eb4c47296c7d93a1e45cb7987

Analysis

max time kernel
120s
max time network
118s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
19/09/2024, 04:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

36d6ee4ba42bb6659ebdea5533e9c201aff6798eb4c47296c7d93a1e45cb7987N.exe
Size

468KB
MD5

f6f683e8d62ab32707fe835b50bf3550
SHA1

93c9c5885b997d5f1a960f5f180510b6ae8fcc4b
SHA256

36d6ee4ba42bb6659ebdea5533e9c201aff6798eb4c47296c7d93a1e45cb7987
SHA512

4a6702e74a1fcf95fe98cad6d0621499909014f2b9f0f339398a4623d0cb95f41a484bc8c568f6170991ef2df7d748d5946bcfd2973f979e0dc41f5470f85aed
SSDEEP

3072:1G3HogISIE5TtbY2MzcOcf8/zfctPgpo9VHVTVPyQ85Lk73EEmlL:1G3obMTtxM4OcfdcG0Q8Vi3EE

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
1272	Unicorn-38725.exe
2348	Unicorn-27838.exe
2632	Unicorn-24308.exe
2680	Unicorn-54599.exe
2136	Unicorn-48891.exe
2796	Unicorn-8927.exe
2808	Unicorn-1728.exe
2720	Unicorn-10868.exe
2564	Unicorn-29242.exe
3068	Unicorn-43541.exe
624	Unicorn-43084.exe
944	Unicorn-43349.exe
1428	Unicorn-23483.exe
2864	Unicorn-65518.exe
2264	Unicorn-64101.exe
2244	Unicorn-10453.exe
1488	Unicorn-43126.exe
2224	Unicorn-59197.exe
2016	Unicorn-55165.exe
292	Unicorn-41404.exe
812	Unicorn-1133.exe
2924	Unicorn-33806.exe
1344	Unicorn-13940.exe
2064	Unicorn-60348.exe
2904	Unicorn-59784.exe
2988	Unicorn-17526.exe
632	Unicorn-20864.exe
2448	Unicorn-31069.exe
2272	Unicorn-53920.exe
1588	Unicorn-57490.exe
1780	Unicorn-51891.exe
2356	Unicorn-15497.exe
2832	Unicorn-59867.exe
2644	Unicorn-27008.exe
2772	Unicorn-3074.exe
2560	Unicorn-27579.exe
2732	Unicorn-24049.exe
2704	Unicorn-60251.exe
2576	Unicorn-31728.exe
1696	Unicorn-15200.exe
3000	Unicorn-21331.exe
1244	Unicorn-42305.exe
264	Unicorn-12705.exe
532	Unicorn-4609.exe
2800	Unicorn-48933.exe
2104	Unicorn-2555.exe
2860	Unicorn-22421.exe
1972	Unicorn-7930.exe
2200	Unicorn-30397.exe
900	Unicorn-19275.exe
2044	Unicorn-39141.exe
1072	Unicorn-55212.exe
1852	Unicorn-30781.exe
2416	Unicorn-59156.exe
820	Unicorn-13292.exe
1340	Unicorn-40603.exe
2944	Unicorn-46733.exe
1968	Unicorn-10339.exe
852	Unicorn-30013.exe
2228	Unicorn-64028.exe
1580	Unicorn-23957.exe
2360	Unicorn-64283.exe
2764	Unicorn-19188.exe
2740	Unicorn-4697.exe

Loads dropped DLL 64 IoCs

pid	Process
1680	36d6ee4ba42bb6659ebdea5533e9c201aff6798eb4c47296c7d93a1e45cb7987N.exe
1680	36d6ee4ba42bb6659ebdea5533e9c201aff6798eb4c47296c7d93a1e45cb7987N.exe
1272	Unicorn-38725.exe
1272	Unicorn-38725.exe
1680	36d6ee4ba42bb6659ebdea5533e9c201aff6798eb4c47296c7d93a1e45cb7987N.exe
1680	36d6ee4ba42bb6659ebdea5533e9c201aff6798eb4c47296c7d93a1e45cb7987N.exe
2348	Unicorn-27838.exe
1272	Unicorn-38725.exe
2348	Unicorn-27838.exe
2632	Unicorn-24308.exe
1272	Unicorn-38725.exe
2632	Unicorn-24308.exe
1680	36d6ee4ba42bb6659ebdea5533e9c201aff6798eb4c47296c7d93a1e45cb7987N.exe
1680	36d6ee4ba42bb6659ebdea5533e9c201aff6798eb4c47296c7d93a1e45cb7987N.exe
2680	Unicorn-54599.exe
2680	Unicorn-54599.exe
1272	Unicorn-38725.exe
1272	Unicorn-38725.exe
2136	Unicorn-48891.exe
2136	Unicorn-48891.exe
1680	36d6ee4ba42bb6659ebdea5533e9c201aff6798eb4c47296c7d93a1e45cb7987N.exe
2808	Unicorn-1728.exe
1680	36d6ee4ba42bb6659ebdea5533e9c201aff6798eb4c47296c7d93a1e45cb7987N.exe
2808	Unicorn-1728.exe
2632	Unicorn-24308.exe
2632	Unicorn-24308.exe
2836	WerFault.exe
2836	WerFault.exe
2836	WerFault.exe
2836	WerFault.exe
860	WerFault.exe
860	WerFault.exe
860	WerFault.exe
860	WerFault.exe
860	WerFault.exe
2836	WerFault.exe
2720	Unicorn-10868.exe
2720	Unicorn-10868.exe
2680	Unicorn-54599.exe
2680	Unicorn-54599.exe
2564	Unicorn-29242.exe
2564	Unicorn-29242.exe
624	Unicorn-43084.exe
624	Unicorn-43084.exe
1272	Unicorn-38725.exe
1272	Unicorn-38725.exe
2340	WerFault.exe
2340	WerFault.exe
2340	WerFault.exe
2340	WerFault.exe
2136	Unicorn-48891.exe
2136	Unicorn-48891.exe
2340	WerFault.exe
1680	36d6ee4ba42bb6659ebdea5533e9c201aff6798eb4c47296c7d93a1e45cb7987N.exe
1680	36d6ee4ba42bb6659ebdea5533e9c201aff6798eb4c47296c7d93a1e45cb7987N.exe
944	Unicorn-43349.exe
944	Unicorn-43349.exe
1428	Unicorn-23483.exe
1428	Unicorn-23483.exe
2808	Unicorn-1728.exe
2808	Unicorn-1728.exe
2632	Unicorn-24308.exe
2632	Unicorn-24308.exe
2864	Unicorn-65518.exe

Program crash 64 IoCs

pid	pid_target	Process	procid_target
860	2348	WerFault.exe	31
2836	2796	WerFault.exe	35
2340	3068	WerFault.exe	39
2552	2064	WerFault.exe	57
2624	2924	WerFault.exe	55
2248	264	WerFault.exe	78
2696	2104	WerFault.exe	81
2412	900	WerFault.exe	86
2968	1972	WerFault.exe	83
744	564	WerFault.exe	128
2236	1580	WerFault.exe	96
748	2416	WerFault.exe	89
1316	2576	WerFault.exe	72
2900	2200	WerFault.exe	84
2804	2540	WerFault.exe	105
2896	440	WerFault.exe	113
1368	2732	WerFault.exe	70
3428	2228	WerFault.exe	95
3624	2312	WerFault.exe	119
4036	2912	WerFault.exe	142
3132	940	WerFault.exe	134
3148	816	WerFault.exe	135
3220	1648	WerFault.exe	136
3304	2600	WerFault.exe	137
3704	2288	WerFault.exe	101
4044	1844	WerFault.exe	115
3108	1980	WerFault.exe	168
3868	2360	WerFault.exe	97
3576	2760	WerFault.exe	102
3900	944	WerFault.exe	41
3396	2560	WerFault.exe	69
4144	2844	WerFault.exe	156
4940	1712	WerFault.exe	144
5088	2948	WerFault.exe	116
5096	1080	WerFault.exe	106
4468	2904	WerFault.exe	58
4440	2272	WerFault.exe	62
4488	1344	WerFault.exe	56
4500	2452	WerFault.exe	126
4536	1732	WerFault.exe	118
4608	292	WerFault.exe	53
4792	3376	WerFault.exe	184
4832	3348	WerFault.exe	183
4496	2132	WerFault.exe	143
4564	1952	WerFault.exe	108
4592	1596	WerFault.exe	159
4960	2324	WerFault.exe	140
4884	2832	WerFault.exe	66
4828	1588	WerFault.exe	63
4808	3280	WerFault.exe	181
4888	2044	WerFault.exe	85
4788	3184	WerFault.exe	179
4556	892	WerFault.exe	133
4560	856	WerFault.exe	141
5068	1800	WerFault.exe	107
5188	624	WerFault.exe	40
5408	3056	WerFault.exe	165
5896	2016	WerFault.exe	52
5880	852	WerFault.exe	94
5916	1928	WerFault.exe	151
6016	1300	WerFault.exe	153
5288	1780	WerFault.exe	64
5384	2812	WerFault.exe	162
5508	2420	WerFault.exe	176

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3074.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64028.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64283.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39804.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48363.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15628.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27579.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5122.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11327.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16656.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27913.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58632.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13705.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11817.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30098.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65518.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12705.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55145.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5039.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24308.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22459.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37562.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63585.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58654.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33242.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18695.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25625.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45491.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49938.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11378.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27787.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59197.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22421.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1303.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33640.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59636.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37451.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59867.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9026.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12036.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21513.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52683.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1862.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42014.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28059.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38690.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25905.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51687.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34972.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2605.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14645.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45024.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5010.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19275.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21848.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10868.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43903.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17961.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44468.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41702.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38725.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8748.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46721.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40333.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
1680	36d6ee4ba42bb6659ebdea5533e9c201aff6798eb4c47296c7d93a1e45cb7987N.exe
1272	Unicorn-38725.exe
2348	Unicorn-27838.exe
2632	Unicorn-24308.exe
2680	Unicorn-54599.exe
2136	Unicorn-48891.exe
2796	Unicorn-8927.exe
2808	Unicorn-1728.exe
2720	Unicorn-10868.exe
2564	Unicorn-29242.exe
624	Unicorn-43084.exe
3068	Unicorn-43541.exe
1428	Unicorn-23483.exe
944	Unicorn-43349.exe
2864	Unicorn-65518.exe
2264	Unicorn-64101.exe
2244	Unicorn-10453.exe
1488	Unicorn-43126.exe
2224	Unicorn-59197.exe
2016	Unicorn-55165.exe
812	Unicorn-1133.exe
292	Unicorn-41404.exe
2924	Unicorn-33806.exe
1344	Unicorn-13940.exe
2064	Unicorn-60348.exe
2904	Unicorn-59784.exe
2988	Unicorn-17526.exe
632	Unicorn-20864.exe
2448	Unicorn-31069.exe
2272	Unicorn-53920.exe
1588	Unicorn-57490.exe
1780	Unicorn-51891.exe
2356	Unicorn-15497.exe
2832	Unicorn-59867.exe
2644	Unicorn-27008.exe
2772	Unicorn-3074.exe
2560	Unicorn-27579.exe
2732	Unicorn-24049.exe
2704	Unicorn-60251.exe
3000	Unicorn-21331.exe
2576	Unicorn-31728.exe
1244	Unicorn-42305.exe
1696	Unicorn-15200.exe
264	Unicorn-12705.exe
532	Unicorn-4609.exe
2800	Unicorn-48933.exe
2104	Unicorn-2555.exe
2860	Unicorn-22421.exe
1972	Unicorn-7930.exe
2200	Unicorn-30397.exe
2044	Unicorn-39141.exe
900	Unicorn-19275.exe
1852	Unicorn-30781.exe
1072	Unicorn-55212.exe
2416	Unicorn-59156.exe
820	Unicorn-13292.exe
1340	Unicorn-40603.exe
2944	Unicorn-46733.exe
1968	Unicorn-10339.exe
852	Unicorn-30013.exe
1580	Unicorn-23957.exe
2228	Unicorn-64028.exe
2360	Unicorn-64283.exe
2764	Unicorn-19188.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1680 wrote to memory of 1272	1680	36d6ee4ba42bb6659ebdea5533e9c201aff6798eb4c47296c7d93a1e45cb7987N.exe	30
PID 1680 wrote to memory of 1272	1680	36d6ee4ba42bb6659ebdea5533e9c201aff6798eb4c47296c7d93a1e45cb7987N.exe	30
PID 1680 wrote to memory of 1272	1680	36d6ee4ba42bb6659ebdea5533e9c201aff6798eb4c47296c7d93a1e45cb7987N.exe	30
PID 1680 wrote to memory of 1272	1680	36d6ee4ba42bb6659ebdea5533e9c201aff6798eb4c47296c7d93a1e45cb7987N.exe	30
PID 1272 wrote to memory of 2348	1272	Unicorn-38725.exe	31
PID 1272 wrote to memory of 2348	1272	Unicorn-38725.exe	31
PID 1272 wrote to memory of 2348	1272	Unicorn-38725.exe	31
PID 1272 wrote to memory of 2348	1272	Unicorn-38725.exe	31
PID 1680 wrote to memory of 2632	1680	36d6ee4ba42bb6659ebdea5533e9c201aff6798eb4c47296c7d93a1e45cb7987N.exe	32
PID 1680 wrote to memory of 2632	1680	36d6ee4ba42bb6659ebdea5533e9c201aff6798eb4c47296c7d93a1e45cb7987N.exe	32
PID 1680 wrote to memory of 2632	1680	36d6ee4ba42bb6659ebdea5533e9c201aff6798eb4c47296c7d93a1e45cb7987N.exe	32
PID 1680 wrote to memory of 2632	1680	36d6ee4ba42bb6659ebdea5533e9c201aff6798eb4c47296c7d93a1e45cb7987N.exe	32
PID 2348 wrote to memory of 2136	2348	Unicorn-27838.exe	33
PID 2348 wrote to memory of 2136	2348	Unicorn-27838.exe	33
PID 2348 wrote to memory of 2136	2348	Unicorn-27838.exe	33
PID 2348 wrote to memory of 2136	2348	Unicorn-27838.exe	33
PID 1272 wrote to memory of 2680	1272	Unicorn-38725.exe	34
PID 1272 wrote to memory of 2680	1272	Unicorn-38725.exe	34
PID 1272 wrote to memory of 2680	1272	Unicorn-38725.exe	34
PID 1272 wrote to memory of 2680	1272	Unicorn-38725.exe	34
PID 2632 wrote to memory of 2796	2632	Unicorn-24308.exe	35
PID 2632 wrote to memory of 2796	2632	Unicorn-24308.exe	35
PID 2632 wrote to memory of 2796	2632	Unicorn-24308.exe	35
PID 2632 wrote to memory of 2796	2632	Unicorn-24308.exe	35
PID 1680 wrote to memory of 2808	1680	36d6ee4ba42bb6659ebdea5533e9c201aff6798eb4c47296c7d93a1e45cb7987N.exe	36
PID 1680 wrote to memory of 2808	1680	36d6ee4ba42bb6659ebdea5533e9c201aff6798eb4c47296c7d93a1e45cb7987N.exe	36
PID 1680 wrote to memory of 2808	1680	36d6ee4ba42bb6659ebdea5533e9c201aff6798eb4c47296c7d93a1e45cb7987N.exe	36
PID 1680 wrote to memory of 2808	1680	36d6ee4ba42bb6659ebdea5533e9c201aff6798eb4c47296c7d93a1e45cb7987N.exe	36
PID 2680 wrote to memory of 2720	2680	Unicorn-54599.exe	37
PID 2680 wrote to memory of 2720	2680	Unicorn-54599.exe	37
PID 2680 wrote to memory of 2720	2680	Unicorn-54599.exe	37
PID 2680 wrote to memory of 2720	2680	Unicorn-54599.exe	37
PID 1272 wrote to memory of 2564	1272	Unicorn-38725.exe	38
PID 1272 wrote to memory of 2564	1272	Unicorn-38725.exe	38
PID 1272 wrote to memory of 2564	1272	Unicorn-38725.exe	38
PID 1272 wrote to memory of 2564	1272	Unicorn-38725.exe	38
PID 2136 wrote to memory of 3068	2136	Unicorn-48891.exe	39
PID 2136 wrote to memory of 3068	2136	Unicorn-48891.exe	39
PID 2136 wrote to memory of 3068	2136	Unicorn-48891.exe	39
PID 2136 wrote to memory of 3068	2136	Unicorn-48891.exe	39
PID 1680 wrote to memory of 624	1680	36d6ee4ba42bb6659ebdea5533e9c201aff6798eb4c47296c7d93a1e45cb7987N.exe	40
PID 1680 wrote to memory of 624	1680	36d6ee4ba42bb6659ebdea5533e9c201aff6798eb4c47296c7d93a1e45cb7987N.exe	40
PID 1680 wrote to memory of 624	1680	36d6ee4ba42bb6659ebdea5533e9c201aff6798eb4c47296c7d93a1e45cb7987N.exe	40
PID 1680 wrote to memory of 624	1680	36d6ee4ba42bb6659ebdea5533e9c201aff6798eb4c47296c7d93a1e45cb7987N.exe	40
PID 2808 wrote to memory of 944	2808	Unicorn-1728.exe	41
PID 2808 wrote to memory of 944	2808	Unicorn-1728.exe	41
PID 2808 wrote to memory of 944	2808	Unicorn-1728.exe	41
PID 2808 wrote to memory of 944	2808	Unicorn-1728.exe	41
PID 2796 wrote to memory of 2836	2796	Unicorn-8927.exe	42
PID 2796 wrote to memory of 2836	2796	Unicorn-8927.exe	42
PID 2796 wrote to memory of 2836	2796	Unicorn-8927.exe	42
PID 2796 wrote to memory of 2836	2796	Unicorn-8927.exe	42
PID 2348 wrote to memory of 860	2348	Unicorn-27838.exe	43
PID 2348 wrote to memory of 860	2348	Unicorn-27838.exe	43
PID 2348 wrote to memory of 860	2348	Unicorn-27838.exe	43
PID 2348 wrote to memory of 860	2348	Unicorn-27838.exe	43
PID 2632 wrote to memory of 1428	2632	Unicorn-24308.exe	44
PID 2632 wrote to memory of 1428	2632	Unicorn-24308.exe	44
PID 2632 wrote to memory of 1428	2632	Unicorn-24308.exe	44
PID 2632 wrote to memory of 1428	2632	Unicorn-24308.exe	44
PID 2720 wrote to memory of 2864	2720	Unicorn-10868.exe	46
PID 2720 wrote to memory of 2864	2720	Unicorn-10868.exe	46
PID 2720 wrote to memory of 2864	2720	Unicorn-10868.exe	46
PID 2720 wrote to memory of 2864	2720	Unicorn-10868.exe	46

C:\Users\Admin\AppData\Local\Temp\36d6ee4ba42bb6659ebdea5533e9c201aff6798eb4c47296c7d93a1e45cb7987N.exe
"C:\Users\Admin\AppData\Local\Temp\36d6ee4ba42bb6659ebdea5533e9c201aff6798eb4c47296c7d93a1e45cb7987N.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1680
- C:\Users\Admin\AppData\Local\Temp\Unicorn-38725.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-38725.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1272
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27838.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27838.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48891.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48891.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43541.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3068
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3068 -s 240
        6⤵
        Loads dropped DLL
        Program crash
        
        PID:2340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55165.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60251.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28508.exe
        7⤵
        
        PID:1952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55145.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:2148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63067.exe
        9⤵
        
        PID:3992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26687.exe
        10⤵
        
        PID:8576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48794.exe
        10⤵
        
        PID:9716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16596.exe
        9⤵
        
        PID:4436
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2148 -s 244
        9⤵
        
        PID:6276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25713.exe
        8⤵
        
        PID:920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40792.exe
        9⤵
        
        PID:8548
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1952 -s 240
        8⤵
        Program crash
        
        PID:4564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10391.exe
        7⤵
        
        PID:2112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45397.exe
        8⤵
        
        PID:3228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45024.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:4836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48701.exe
        9⤵
        
        PID:5840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15540.exe
        9⤵
        
        PID:1744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27714.exe
        9⤵
        
        PID:8188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61981.exe
        9⤵
        
        PID:8568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50976.exe
        8⤵
        
        PID:4568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6263.exe
        8⤵
        
        PID:5596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5463.exe
        8⤵
        
        PID:6996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11287.exe
        8⤵
        
        PID:7320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42466.exe
        8⤵
        
        PID:8840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56040.exe
        8⤵
        
        PID:9964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36034.exe
        7⤵
        
        PID:3280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45579.exe
        8⤵
        
        PID:3172
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3172 -s 224
        9⤵
        
        PID:8256
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3280 -s 228
        8⤵
        Program crash
        
        PID:4808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1624.exe
        7⤵
        
        PID:3164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58654.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:9440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3411.exe
        7⤵
        
        PID:5144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56993.exe
        7⤵
        
        PID:6644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36737.exe
        7⤵
        
        PID:7584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8567.exe
        7⤵
        
        PID:8916
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2704 -s 244
        7⤵
        
        PID:2476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9026.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59011.exe
        7⤵
        
        PID:3060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33228.exe
        8⤵
        
        PID:3376
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3376 -s 224
        9⤵
        Program crash
        
        PID:4792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53664.exe
        8⤵
        
        PID:4760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62436.exe
        8⤵
        
        PID:5788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21405.exe
        8⤵
        
        PID:6572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19048.exe
        8⤵
        
        PID:8080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45445.exe
        8⤵
        
        PID:8632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13362.exe
        7⤵
        
        PID:3360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47925.exe
        8⤵
        
        PID:4752
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3360 -s 248
        8⤵
        
        PID:6348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1862.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59064.exe
        7⤵
        
        PID:5500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12740.exe
        7⤵
        
        PID:912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2513.exe
        7⤵
        
        PID:7444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62511.exe
        7⤵
        
        PID:8696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12232.exe
        6⤵
        
        PID:1928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44095.exe
        7⤵
        
        PID:3504
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1928 -s 228
        7⤵
        Program crash
        
        PID:5916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52683.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3712
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2016 -s 244
        6⤵
        Program crash
        
        PID:5896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15200.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59260.exe
        6⤵
        
        PID:1080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43830.exe
        7⤵
        
        PID:3680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11187.exe
        8⤵
        
        PID:6224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3201.exe
        8⤵
        
        PID:8164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35186.exe
        8⤵
        
        PID:8744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64175.exe
        8⤵
        
        PID:10028
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1080 -s 248
        7⤵
        Program crash
        
        PID:5096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8780.exe
        6⤵
        
        PID:3808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47581.exe
        7⤵
        
        PID:6940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44237.exe
        7⤵
        
        PID:7368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15175.exe
        7⤵
        
        PID:9056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41795.exe
        6⤵
        
        PID:4620
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1696 -s 248
        6⤵
        
        PID:6396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28243.exe
        5⤵
        
        PID:1800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56816.exe
        6⤵
        
        PID:856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42538.exe
        7⤵
        
        PID:4056
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 856 -s 248
        7⤵
        Program crash
        
        PID:4560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31499.exe
        6⤵
        
        PID:3288
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1800 -s 240
        6⤵
        Program crash
        
        PID:5068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25301.exe
        5⤵
        
        PID:1712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46295.exe
        6⤵
        
        PID:3488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37451.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59558.exe
        7⤵
        
        PID:7228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61729.exe
        7⤵
        
        PID:8264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38358.exe
        7⤵
        
        PID:8320
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1712 -s 248
        6⤵
        Program crash
        
        PID:4940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17788.exe
        5⤵
        
        PID:3608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29446.exe
        6⤵
        
        PID:4420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14544.exe
        6⤵
        
        PID:6532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5566.exe
        6⤵
        
        PID:7356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5451.exe
        6⤵
        
        PID:8652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25390.exe
        6⤵
        
        PID:9144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12394.exe
        5⤵
        
        PID:5024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29398.exe
        5⤵
        
        PID:5656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51941.exe
        5⤵
        
        PID:1280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62450.exe
        5⤵
        
        PID:7188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12109.exe
        5⤵
        
        PID:8792
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2348 -s 236
      4⤵
      Loads dropped DLL
      Program crash
      PID:860
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54599.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54599.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10868.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10868.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65518.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59784.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48933.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61839.exe
        8⤵
        
        PID:2140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54432.exe
        9⤵
        
        PID:3748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43547.exe
        10⤵
        
        PID:8332
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3748 -s 228
        10⤵
        
        PID:8508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23949.exe
        9⤵
        
        PID:4120
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2140 -s 244
        9⤵
        
        PID:6544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43393.exe
        8⤵
        
        PID:3944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7553.exe
        9⤵
        
        PID:8532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15628.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:9508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30331.exe
        8⤵
        
        PID:4460
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2800 -s 236
        8⤵
        
        PID:6240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20292.exe
        7⤵
        
        PID:2940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13160.exe
        8⤵
        
        PID:4004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39105.exe
        9⤵
        
        PID:8120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58809.exe
        9⤵
        
        PID:8960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28059.exe
        8⤵
        
        PID:4732
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2940 -s 224
        8⤵
        
        PID:6308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33205.exe
        7⤵
        
        PID:3216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34001.exe
        8⤵
        
        PID:7240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28720.exe
        8⤵
        
        PID:8488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29363.exe
        8⤵
        
        PID:9492
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2904 -s 236
        7⤵
        Program crash
        
        PID:4468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2555.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2104
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2104 -s 244
        7⤵
        Program crash
        
        PID:2696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56140.exe
        6⤵
        
        PID:564
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 564 -s 240
        7⤵
        Program crash
        
        PID:744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52257.exe
        6⤵
        
        PID:2780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35735.exe
        7⤵
        
        PID:1520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53047.exe
        7⤵
        
        PID:6004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38690.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18551.exe
        7⤵
        
        PID:8044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61555.exe
        7⤵
        
        PID:9192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58632.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:9332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34972.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13705.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28252.exe
        6⤵
        
        PID:6780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4646.exe
        6⤵
        
        PID:7892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35219.exe
        6⤵
        
        PID:9148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19591.exe
        6⤵
        
        PID:9252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17526.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22421.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39966.exe
        7⤵
        
        PID:1672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62216.exe
        8⤵
        
        PID:3616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29816.exe
        9⤵
        
        PID:8472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1077.exe
        9⤵
        
        PID:8464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23290.exe
        8⤵
        
        PID:4976
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1672 -s 220
        8⤵
        
        PID:6512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33414.exe
        7⤵
        
        PID:3848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52504.exe
        8⤵
        
        PID:8552
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3848 -s 228
        8⤵
        
        PID:8324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63772.exe
        7⤵
        
        PID:4968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58841.exe
        7⤵
        
        PID:6364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2766.exe
        7⤵
        
        PID:7484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37728.exe
        7⤵
        
        PID:8804
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2860 -s 244
        7⤵
        
        PID:8780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20100.exe
        6⤵
        
        PID:1628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53617.exe
        7⤵
        
        PID:3964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30745.exe
        8⤵
        
        PID:7988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48804.exe
        8⤵
        
        PID:8768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28059.exe
        7⤵
        
        PID:4728
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1628 -s 244
        7⤵
        
        PID:6300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47871.exe
        6⤵
        
        PID:4080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44468.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7980
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4080 -s 216
        7⤵
        
        PID:7976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47660.exe
        6⤵
        
        PID:4600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50176.exe
        6⤵
        
        PID:6432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51768.exe
        6⤵
        
        PID:7384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62853.exe
        6⤵
        
        PID:8700
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2988 -s 248
        6⤵
        
        PID:8988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7930.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1972
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1972 -s 224
        6⤵
        Program crash
        
        PID:2968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12036.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45579.exe
        6⤵
        
        PID:1216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27476.exe
        7⤵
        
        PID:8980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44575.exe
        7⤵
        
        PID:10036
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 892 -s 228
        6⤵
        Program crash
        
        PID:4556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34375.exe
        5⤵
        
        PID:3640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33242.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52413.exe
        5⤵
        
        PID:5040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8521.exe
        5⤵
        
        PID:6656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15206.exe
        5⤵
        
        PID:7540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3232.exe
        5⤵
        
        PID:8908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3255.exe
        5⤵
        
        PID:8992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64101.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64101.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20864.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30397.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2200
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2200 -s 220
        7⤵
        Program crash
        
        PID:2900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40139.exe
        6⤵
        
        PID:1980
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1980 -s 224
        7⤵
        Program crash
        
        PID:3108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8748.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37562.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10809.exe
        6⤵
        
        PID:7164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20678.exe
        6⤵
        
        PID:8152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7705.exe
        6⤵
        
        PID:8412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5563.exe
        6⤵
        
        PID:9516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19275.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:900
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 900 -s 224
        6⤵
        Program crash
        
        PID:2412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39804.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18506.exe
        6⤵
        
        PID:2844
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2844 -s 224
        7⤵
        Program crash
        
        PID:4144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18365.exe
        6⤵
        
        PID:3936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31696.exe
        6⤵
        
        PID:6068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19474.exe
        6⤵
        
        PID:7136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37213.exe
        6⤵
        
        PID:8140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56177.exe
        6⤵
        
        PID:8408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27094.exe
        6⤵
        
        PID:9532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20928.exe
        5⤵
        
        PID:2176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56814.exe
        6⤵
        
        PID:3648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17961.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13609.exe
        6⤵
        
        PID:7140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45879.exe
        6⤵
        
        PID:8128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7175.exe
        6⤵
        
        PID:2756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10028.exe
        6⤵
        
        PID:9480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40676.exe
        5⤵
        
        PID:3336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30617.exe
        5⤵
        
        PID:5012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62865.exe
        5⤵
        
        PID:6964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55823.exe
        5⤵
        
        PID:7248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32666.exe
        5⤵
        
        PID:8824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33374.exe
        5⤵
        
        PID:9948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31069.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31069.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39141.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11232.exe
        6⤵
        
        PID:940
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 940 -s 220
        7⤵
        Program crash
        
        PID:3132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44354.exe
        6⤵
        
        PID:3532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40076.exe
        7⤵
        
        PID:8636
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2044 -s 240
        6⤵
        Program crash
        
        PID:4888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24615.exe
        5⤵
        
        PID:816
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 816 -s 220
        6⤵
        Program crash
        
        PID:3148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37176.exe
        5⤵
        
        PID:3660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2930.exe
        6⤵
        
        PID:9820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12076.exe
        5⤵
        
        PID:4664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7991.exe
        5⤵
        
        PID:6632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19671.exe
        5⤵
        
        PID:7548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30098.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4390.exe
        5⤵
        
        PID:8272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55212.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55212.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64470.exe
        5⤵
        
        PID:2452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64416.exe
        6⤵
        
        PID:3464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27787.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10589.exe
        7⤵
        
        PID:3720
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2452 -s 236
        6⤵
        Program crash
        
        PID:4500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42734.exe
        5⤵
        
        PID:3768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54725.exe
        6⤵
        
        PID:8604
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3768 -s 216
        6⤵
        
        PID:8996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63772.exe
        5⤵
        
        PID:4996
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1072 -s 248
        5⤵
        
        PID:6404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28643.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28643.exe
      4⤵
      PID:2660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48080.exe
        5⤵
        
        PID:3424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61380.exe
        6⤵
        
        PID:8028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35617.exe
        6⤵
        
        PID:7524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28059.exe
        5⤵
        
        PID:4656
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2660 -s 244
        5⤵
        
        PID:6316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45494.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45494.exe
      4⤵
      PID:3668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4434.exe
        5⤵
        
        PID:8400
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3668 -s 228
        5⤵
        
        PID:8468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58684.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58684.exe
      4⤵
      PID:5020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29175.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29175.exe
      4⤵
      PID:6356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41967.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41967.exe
      4⤵
      PID:7496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32128.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32128.exe
      4⤵
      PID:8796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41056.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41056.exe
      4⤵
      PID:9200
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29242.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29242.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10453.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10453.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53920.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30781.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62846.exe
        7⤵
        
        PID:1492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23576.exe
        8⤵
        
        PID:3384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65446.exe
        9⤵
        
        PID:7440
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3384 -s 228
        9⤵
        
        PID:8420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28059.exe
        8⤵
        
        PID:4692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52976.exe
        8⤵
        
        PID:6268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11431.exe
        8⤵
        
        PID:7420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54264.exe
        8⤵
        
        PID:8784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8855.exe
        8⤵
        
        PID:8216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42350.exe
        7⤵
        
        PID:3480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5010.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:8436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9245.exe
        8⤵
        
        PID:8520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37026.exe
        7⤵
        
        PID:4988
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1852 -s 248
        7⤵
        
        PID:6388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32399.exe
        6⤵
        
        PID:2648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21329.exe
        7⤵
        
        PID:4024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41702.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:7536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29094.exe
        8⤵
        
        PID:8528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28059.exe
        7⤵
        
        PID:4668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28279.exe
        7⤵
        
        PID:6552
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2648 -s 248
        7⤵
        
        PID:7428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42142.exe
        6⤵
        
        PID:3264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57854.exe
        7⤵
        
        PID:7508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1440.exe
        7⤵
        
        PID:9064
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2272 -s 236
        6⤵
        Program crash
        
        PID:4440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59156.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2416
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2416 -s 240
        6⤵
        Program crash
        
        PID:748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28568.exe
        5⤵
        
        PID:1552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59388.exe
        6⤵
        
        PID:3984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51080.exe
        6⤵
        
        PID:5464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41840.exe
        6⤵
        
        PID:6956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61208.exe
        6⤵
        
        PID:7652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54072.exe
        6⤵
        
        PID:9016
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1552 -s 216
        6⤵
        
        PID:8544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45475.exe
        5⤵
        
        PID:3828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39478.exe
        5⤵
        
        PID:5888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11378.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26177.exe
        5⤵
        
        PID:7916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40554.exe
        5⤵
        
        PID:9120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48831.exe
        5⤵
        
        PID:9296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57490.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57490.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13292.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4600.exe
        6⤵
        
        PID:2324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5122.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36210.exe
        8⤵
        
        PID:8244
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2324 -s 228
        7⤵
        Program crash
        
        PID:4960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55153.exe
        6⤵
        
        PID:3764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40149.exe
        7⤵
        
        PID:10208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6211.exe
        6⤵
        
        PID:5180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16656.exe
        6⤵
        
        PID:6680
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 820 -s 224
        6⤵
        
        PID:7608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63759.exe
        5⤵
        
        PID:2132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-929.exe
        6⤵
        
        PID:3976
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2132 -s 248
        6⤵
        Program crash
        
        PID:4496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45427.exe
        5⤵
        
        PID:3120
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1588 -s 248
        5⤵
        Program crash
        
        PID:4828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40603.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40603.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50908.exe
        5⤵
        
        PID:3316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40333.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39240.exe
        6⤵
        
        PID:6340
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3316 -s 224
        6⤵
        
        PID:7404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20607.exe
        5⤵
        
        PID:4672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36907.exe
        5⤵
        
        PID:5792
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1340 -s 228
        5⤵
        
        PID:7016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32963.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32963.exe
      4⤵
      PID:3348
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3348 -s 224
        5⤵
        Program crash
        
        PID:4832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64599.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64599.exe
      4⤵
      PID:4768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43100.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43100.exe
      4⤵
      PID:5592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13270.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13270.exe
      4⤵
      PID:7124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63585.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63585.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35645.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35645.exe
      4⤵
      PID:8640
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59197.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59197.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59867.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59867.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18996.exe
        5⤵
        
        PID:2708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3448.exe
        6⤵
        
        PID:1648
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1648 -s 224
        7⤵
        Program crash
        
        PID:3220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39584.exe
        6⤵
        
        PID:3804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6211.exe
        6⤵
        
        PID:5168
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2708 -s 236
        6⤵
        
        PID:6600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18943.exe
        5⤵
        
        PID:2600
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2600 -s 244
        6⤵
        Program crash
        
        PID:3304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11327.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3904
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2832 -s 248
        5⤵
        Program crash
        
        PID:4884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63707.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63707.exe
      4⤵
      PID:2288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3020.exe
        5⤵
        
        PID:1912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49606.exe
        6⤵
        
        PID:4136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36217.exe
        6⤵
        
        PID:5204
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1912 -s 244
        6⤵
        
        PID:7044
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2288 -s 236
        5⤵
        Program crash
        
        PID:3704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63963.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63963.exe
      4⤵
      PID:3176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24417.exe
        5⤵
        
        PID:4316
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3176 -s 228
        5⤵
        
        PID:5548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5039.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5039.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3463.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3463.exe
      4⤵
      PID:5620
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2224 -s 248
      4⤵
      PID:6944
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27008.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27008.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30013.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30013.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26674.exe
        5⤵
        
        PID:2296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35460.exe
        6⤵
        
        PID:4064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9087.exe
        6⤵
        
        PID:5512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24818.exe
        6⤵
        
        PID:7096
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2296 -s 248
        6⤵
        
        PID:7708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48350.exe
        5⤵
        
        PID:3112
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 852 -s 244
        5⤵
        Program crash
        
        PID:5880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42168.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42168.exe
      4⤵
      PID:3056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48397.exe
        5⤵
        
        PID:3744
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3056 -s 228
        5⤵
        Program crash
        
        PID:5408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22889.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22889.exe
      4⤵
      PID:3484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7390.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7390.exe
      4⤵
      PID:5612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45563.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45563.exe
      4⤵
      PID:6172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36007.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36007.exe
      4⤵
      PID:7724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54602.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54602.exe
      4⤵
      PID:9008
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2644 -s 248
      4⤵
      PID:8856
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64028.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64028.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2228
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2228 -s 244
      4⤵
      Program crash
      PID:3428
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54615.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54615.exe
    3⤵
    PID:3552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15297.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15297.exe
      4⤵
      PID:6912
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3552 -s 228
      4⤵
      PID:7748
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15560.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15560.exe
    3⤵
    PID:4952
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33300.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33300.exe
    3⤵
    PID:5644
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56142.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56142.exe
    3⤵
    PID:7156
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34714.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34714.exe
    3⤵
    PID:7876
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59446.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59446.exe
    3⤵
    PID:8564
- C:\Users\Admin\AppData\Local\Temp\Unicorn-24308.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-24308.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2632
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8927.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8927.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2796
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2796 -s 244
      4⤵
      Loads dropped DLL
      Program crash
      PID:2836
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23483.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23483.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33806.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33806.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2924
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2924 -s 220
        5⤵
        Program crash
        
        PID:2624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42305.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42305.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18695.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27494.exe
        6⤵
        
        PID:3652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45491.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4980
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3652 -s 216
        7⤵
        
        PID:5460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49938.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53199.exe
        6⤵
        
        PID:5820
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 300 -s 248
        6⤵
        
        PID:1512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55677.exe
        5⤵
        
        PID:3756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17156.exe
        6⤵
        
        PID:6148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54709.exe
        6⤵
        
        PID:8020
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3756 -s 240
        6⤵
        
        PID:8736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63673.exe
        5⤵
        
        PID:5108
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1244 -s 236
        5⤵
        
        PID:5576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55709.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55709.exe
      4⤵
      PID:1732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4992.exe
        5⤵
        
        PID:4012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48007.exe
        6⤵
        
        PID:7436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4590.exe
        6⤵
        
        PID:8460
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1732 -s 236
        5⤵
        Program crash
        
        PID:4536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39263.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39263.exe
      4⤵
      PID:3124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55057.exe
        5⤵
        
        PID:8064
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3124 -s 216
        5⤵
        
        PID:8756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38995.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38995.exe
      4⤵
      PID:4516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33640.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33640.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3296.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3296.exe
      4⤵
      PID:7340
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41322.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41322.exe
      4⤵
      PID:8660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64592.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64592.exe
      4⤵
      PID:8712
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60348.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60348.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2064
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2064 -s 240
      4⤵
      Program crash
      PID:2552
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12705.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12705.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:264
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 264 -s 220
      4⤵
      Program crash
      PID:2248
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34460.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34460.exe
    3⤵
    PID:2232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39528.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39528.exe
      4⤵
      PID:3152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38988.exe
        5⤵
        
        PID:8184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47927.exe
        5⤵
        
        PID:8716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28059.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28059.exe
      4⤵
      PID:4740
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2232 -s 244
      4⤵
      PID:6332
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36942.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36942.exe
    3⤵
    PID:3544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57470.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57470.exe
      4⤵
      PID:7456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8093.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8093.exe
      4⤵
      PID:8360
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18611.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18611.exe
    3⤵
    PID:4852
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2632 -s 236
    3⤵
    PID:6248
- C:\Users\Admin\AppData\Local\Temp\Unicorn-1728.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-1728.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2808
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43349.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43349.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1133.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1133.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3074.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23957.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1580
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1580 -s 220
        7⤵
        Program crash
        
        PID:2236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64034.exe
        6⤵
        
        PID:2192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51687.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28542.exe
        7⤵
        
        PID:5924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30713.exe
        7⤵
        
        PID:6764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1447.exe
        7⤵
        
        PID:8012
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2192 -s 220
        7⤵
        
        PID:9176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46818.exe
        6⤵
        
        PID:3912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48143.exe
        6⤵
        
        PID:5904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27913.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9111.exe
        6⤵
        
        PID:7900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62085.exe
        6⤵
        
        PID:9184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20726.exe
        6⤵
        
        PID:9268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64283.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62034.exe
        6⤵
        
        PID:972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47489.exe
        7⤵
        
        PID:4444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25008.exe
        7⤵
        
        PID:5536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65135.exe
        7⤵
        
        PID:6992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19952.exe
        7⤵
        
        PID:7212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59002.exe
        7⤵
        
        PID:8864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38974.exe
        7⤵
        
        PID:9992
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2360 -s 236
        6⤵
        Program crash
        
        PID:3868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21586.exe
        5⤵
        
        PID:2852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14624.exe
        6⤵
        
        PID:4508
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2852 -s 248
        6⤵
        
        PID:5544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49341.exe
        5⤵
        
        PID:3212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47153.exe
        5⤵
        
        PID:5196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45799.exe
        5⤵
        
        PID:6880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11817.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38001.exe
        5⤵
        
        PID:8812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29174.exe
        5⤵
        
        PID:9972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24049.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24049.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59452.exe
        5⤵
        
        PID:2164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21194.exe
        6⤵
        
        PID:2812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42014.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4224
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2812 -s 228
        7⤵
        Program crash
        
        PID:5384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29740.exe
        6⤵
        
        PID:4108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49953.exe
        6⤵
        
        PID:5300
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2164 -s 228
        6⤵
        
        PID:7004
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2732 -s 236
        5⤵
        Program crash
        
        PID:1368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44962.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44962.exe
      4⤵
      PID:2540
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2540 -s 244
        5⤵
        Program crash
        
        PID:2804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35044.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35044.exe
      4⤵
      PID:2384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46721.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23363.exe
        5⤵
        
        PID:5664
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2384 -s 220
        5⤵
        
        PID:6936
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 944 -s 244
      4⤵
      Program crash
      PID:3900
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13940.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13940.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27579.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27579.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42540.exe
        5⤵
        
        PID:2760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3020.exe
        6⤵
        
        PID:612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46721.exe
        7⤵
        
        PID:4648
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 612 -s 228
        7⤵
        
        PID:5672
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2760 -s 216
        6⤵
        Program crash
        
        PID:3576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17939.exe
        5⤵
        
        PID:2420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55657.exe
        6⤵
        
        PID:4476
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2420 -s 216
        6⤵
        Program crash
        
        PID:5508
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2560 -s 240
        5⤵
        Program crash
        
        PID:3396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39586.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39586.exe
      4⤵
      PID:2548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12117.exe
        5⤵
        
        PID:3880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4266.exe
        6⤵
        
        PID:4020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39463.exe
        6⤵
        
        PID:5652
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3880 -s 244
        6⤵
        
        PID:6428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28059.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4632
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2548 -s 244
        5⤵
        
        PID:6284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29998.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29998.exe
      4⤵
      PID:3920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64882.exe
        5⤵
        
        PID:7056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41607.exe
        5⤵
        
        PID:7716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56872.exe
        5⤵
        
        PID:9032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34056.exe
        5⤵
        
        PID:8964
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1344 -s 236
      4⤵
      Program crash
      PID:4488
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31728.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31728.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43775.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43775.exe
      4⤵
      PID:2872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34699.exe
        5⤵
        
        PID:1300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43903.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3996
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1300 -s 248
        6⤵
        Program crash
        
        PID:6016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48350.exe
        5⤵
        
        PID:3236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42278.exe
        5⤵
        
        PID:5872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36579.exe
        5⤵
        
        PID:6732
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2872 -s 224
        5⤵
        
        PID:8000
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2576 -s 236
      4⤵
      Program crash
      PID:1316
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19389.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19389.exe
    3⤵
    PID:2392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40680.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40680.exe
      4⤵
      PID:3080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63300.exe
        5⤵
        
        PID:8068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1793.exe
        5⤵
        
        PID:8312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28059.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28059.exe
      4⤵
      PID:4704
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2392 -s 244
      4⤵
      PID:6292
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14645.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14645.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37953.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37953.exe
      4⤵
      PID:7364
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3356 -s 216
      4⤵
      PID:9028
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22459.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22459.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4524
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50706.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50706.exe
    3⤵
    PID:6324
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47302.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47302.exe
    3⤵
    PID:7376
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35987.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35987.exe
    3⤵
    PID:8676
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2808 -s 236
    3⤵
    PID:8428
- C:\Users\Admin\AppData\Local\Temp\Unicorn-43084.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-43084.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:624
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43126.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43126.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51891.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51891.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46733.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3020.exe
        6⤵
        
        PID:316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1588.exe
        7⤵
        
        PID:3400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58013.exe
        7⤵
        
        PID:4596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10791.exe
        7⤵
        
        PID:6584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44872.exe
        7⤵
        
        PID:7576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29567.exe
        7⤵
        
        PID:8868
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 316 -s 236
        7⤵
        
        PID:8504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14395.exe
        6⤵
        
        PID:3368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6211.exe
        6⤵
        
        PID:5160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16656.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36206.exe
        6⤵
        
        PID:7600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13032.exe
        6⤵
        
        PID:8892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25921.exe
        6⤵
        
        PID:8492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58780.exe
        5⤵
        
        PID:3096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64977.exe
        6⤵
        
        PID:4708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39507.exe
        6⤵
        
        PID:5812
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3096 -s 240
        6⤵
        
        PID:6980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60580.exe
        5⤵
        
        PID:4172
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1780 -s 248
        5⤵
        Program crash
        
        PID:5288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10339.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10339.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54463.exe
        5⤵
        
        PID:3516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61379.exe
        6⤵
        
        PID:6160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1805.exe
        6⤵
        
        PID:1144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21848.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5109.exe
        6⤵
        
        PID:8720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25625.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4932
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1968 -s 244
        5⤵
        
        PID:5836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37124.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37124.exe
      4⤵
      PID:3600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38017.exe
        5⤵
        
        PID:6080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34690.exe
        5⤵
        
        PID:7176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28605.exe
        5⤵
        
        PID:8620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20529.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20529.exe
      4⤵
      PID:5032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59636.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59636.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61742.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61742.exe
      4⤵
      PID:916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19578.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19578.exe
      4⤵
      PID:8052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40980.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40980.exe
      4⤵
      PID:8592
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15497.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15497.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19188.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19188.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21513.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2912
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2912 -s 244
        6⤵
        Program crash
        
        PID:4036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25905.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55483.exe
        6⤵
        
        PID:8224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6211.exe
        5⤵
        
        PID:5152
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2764 -s 236
        5⤵
        
        PID:6620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8310.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8310.exe
      4⤵
      PID:1840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43244.exe
        5⤵
        
        PID:3820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1303.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9167.exe
        5⤵
        
        PID:6900
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1840 -s 248
        5⤵
        
        PID:7676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42075.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42075.exe
      4⤵
      PID:3940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5143.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5143.exe
      4⤵
      PID:5452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39040.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39040.exe
      4⤵
      PID:6984
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2356 -s 228
      4⤵
      PID:7740
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4697.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4697.exe
    3⤵
    - Executes dropped EXE
    PID:2740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3020.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3020.exe
      4⤵
      PID:980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29020.exe
        5⤵
        
        PID:3512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53327.exe
        5⤵
        
        PID:5628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48363.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6180
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 980 -s 248
        5⤵
        
        PID:7660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15869.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15869.exe
      4⤵
      PID:3700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33040.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33040.exe
      4⤵
      PID:5964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36387.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36387.exe
      4⤵
      PID:6832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33814.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33814.exe
      4⤵
      PID:7992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45019.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45019.exe
      4⤵
      PID:7528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10160.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10160.exe
      4⤵
      PID:9320
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4291.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4291.exe
    3⤵
    PID:3184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37987.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37987.exe
      4⤵
      PID:3204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38815.exe
        5⤵
        
        PID:9104
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3184 -s 228
      4⤵
      Program crash
      PID:4788
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58688.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58688.exe
    3⤵
    PID:3776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41026.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41026.exe
      4⤵
      PID:9244
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 624 -s 248
    3⤵
    - Program crash
    PID:5188
- C:\Users\Admin\AppData\Local\Temp\Unicorn-41404.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-41404.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:292
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21331.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21331.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35991.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35991.exe
      4⤵
      PID:440
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 440 -s 244
        5⤵
        Program crash
        
        PID:2896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15443.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15443.exe
      4⤵
      PID:2380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55273.exe
        5⤵
        
        PID:4348
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2380 -s 248
        5⤵
        
        PID:5560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43476.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43476.exe
      4⤵
      PID:3716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55818.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55818.exe
      4⤵
      PID:5336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62335.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62335.exe
      4⤵
      PID:7036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60289.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60289.exe
      4⤵
      PID:6876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59532.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59532.exe
      4⤵
      PID:8832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34509.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34509.exe
      4⤵
      PID:9984
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23525.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23525.exe
    3⤵
    PID:2948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2605.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2605.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44810.exe
        5⤵
        
        PID:7092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19781.exe
        5⤵
        
        PID:7464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10157.exe
        5⤵
        
        PID:8444
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2948 -s 248
      4⤵
      Program crash
      PID:5088
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47020.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47020.exe
    3⤵
    PID:3840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26409.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26409.exe
      4⤵
      PID:7928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50620.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50620.exe
      4⤵
      PID:9208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12430.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12430.exe
      4⤵
      PID:9348
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 292 -s 228
    3⤵
    - Program crash
    PID:4608
- C:\Users\Admin\AppData\Local\Temp\Unicorn-4609.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-4609.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:532
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51367.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51367.exe
    3⤵
    PID:1844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42867.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42867.exe
      4⤵
      PID:3004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18740.exe
        5⤵
        
        PID:3328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41567.exe
        5⤵
        
        PID:5564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-122.exe
        5⤵
        
        PID:7148
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3004 -s 228
        5⤵
        
        PID:7668
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1844 -s 216
      4⤵
      Program crash
      PID:4044
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39480.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39480.exe
    3⤵
    PID:1596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34837.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34837.exe
      4⤵
      PID:3572
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1596 -s 248
      4⤵
      Program crash
      PID:4592
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53834.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53834.exe
    3⤵
    PID:3200
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28688.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28688.exe
    3⤵
    PID:5520
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22018.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22018.exe
    3⤵
    PID:7104
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 532 -s 248
    3⤵
    PID:7732
- C:\Users\Admin\AppData\Local\Temp\Unicorn-53439.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-53439.exe
  2⤵
  PID:2312
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2312 -s 244
    3⤵
    - Program crash
    PID:3624
- C:\Users\Admin\AppData\Local\Temp\Unicorn-31517.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-31517.exe
  2⤵
  PID:3888
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54725.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54725.exe
    3⤵
    PID:8596
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14455.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14455.exe
    3⤵
    PID:8732
- C:\Users\Admin\AppData\Local\Temp\Unicorn-34636.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-34636.exe
  2⤵
  PID:4892
- C:\Users\Admin\AppData\Local\Temp\Unicorn-28040.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-28040.exe
  2⤵
  PID:6372
- C:\Users\Admin\AppData\Local\Temp\Unicorn-18432.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-18432.exe
  2⤵
  PID:7348
- C:\Users\Admin\AppData\Local\Temp\Unicorn-59788.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-59788.exe
  2⤵
  PID:8684
- C:\Users\Admin\AppData\Local\Temp\Unicorn-38256.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-38256.exe
  2⤵
  PID:8972

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-17788.exe

Filesize
468KB

MD5
1ff9cf4f53a7e85d9f573b4e5266d7d8

SHA1
c8948c17d42b337e9338d10c5b83e8217a44f462

SHA256
51c4d236f20c4cb9d7f0607bb64969c99be1f9f6656447b1071736b37a0f9902

SHA512
8a7dbbcc2c6b844d318cb921c0016ce960e4663b4a5f404001017c88d71aff837e73007cba660dcc92244e2900ee969b6ea721721b43206f3064b1b03eef61b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-23483.exe

Filesize
468KB

MD5
d7e4bb2e7de9d6ecf7a30861722e0a15

SHA1
749b009581f9bd301f561ceaa8933adfb2476773

SHA256
957a1a5b38e9db4c4f31584ca4b9127eda633eb4c391296a9ac532aaf4c29647

SHA512
0b6c93b5483e86803b4271ddfa0d05bebd70cd7cc532236697f7f514fbfb0537f17f703aaee5d3fec99a9df79ea682ecf3bea3ff741ad9dc201dc15c6e141a47

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-27838.exe

Filesize
468KB

MD5
001eaf252aa5219803d441860e6ca58c

SHA1
d8a13d15df91c689eb4d2068389bc553e65b61bb

SHA256
12ed55a393cf75cfa6f41ea48bf2d0ca321eac9f481367802eb45bc81908c32e

SHA512
85a28bcbc537f1162796b73ff0852bc85f8b47e89e024b0e28c17d174788bc79d8ada0ff50b1994e321bad4fafb28d78e42b0e7a2811a737e175921d2ddbc943

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-40139.exe

Filesize
468KB

MD5
d73ecb2baead69cd03eaca3accd66f31

SHA1
7c49ee19bbe1627738b5109f633ec6ac70863826

SHA256
720e66bbb6fe2cc9a4b4ddc09ea26ea53360ff7c8a25a6fd590f60473ac684ac

SHA512
fe708b537d15d44b7b4a7621824954c2c0ed4c62cabfbda9e904b7ff52096fa7b49645e953aa97bd244a0e74af69c1e6cbbd70565131fef46465ac19ea0a3981

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-41702.exe

Filesize
468KB

MD5
9aadaf2bc06fbb03d78bea664cdbf60b

SHA1
e0024b51be8b7c332882c976c76e65afdd5d9205

SHA256
335f1de25f6890078c0d382de3721b71655b7bf242b44b3e4329f7baaa774cb6

SHA512
ee36bd711dd850fe1dda2ba576051d72e2292a2bfcadf58ce8e2ca5f6064383b523d9b9ef508095781eb0a7aaff6e5725836d43d07a2c61a5b26661ac40c1eca

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-43349.exe

Filesize
468KB

MD5
a3e767dcf5e6c4d55c766ce63350b1af

SHA1
84e0993f16617701b97f79405d9baf37d8f568f9

SHA256
ed76a70d81909a32ef12cfda8c5a8cdcd503804a6ab24b4bf5fbd6f4c403b3a2

SHA512
d7e3eee32d6ea711935ed18a14201cb2cd05c09ec8d6f73190215ba00dde5fb41574a61a123784a200df12b354bd42d8e9b8e52e44b5d5a104482208af40ed1e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-43541.exe

Filesize
468KB

MD5
07f190f844461e5a7d35fc34345d703f

SHA1
0e9d2c86d895ecda9cdc557d5c72d8fe3316e35c

SHA256
1b2f318ab536d45864fd0c287705f3ae1ab7af17471c10c40c99824b997a0542

SHA512
4939ca60f2670152e375f0bec04a891d7dd57785f5d3dab6fdc9897d56dc6ba43c849360464a916e9d64d35e5b30b0c6044e9f5b9243a96e335d9ac8817ef942

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-46733.exe

Filesize
468KB

MD5
763419a174b73a8d3b13eef3947c835c

SHA1
165197c299ea22f23e41b4c992edb8370efe5bdf

SHA256
a026bdbe0e74854f619495f5e73b91c27665302783443e268f524fc551d8772e

SHA512
7bfa89d914b9779e9e538673ef0d06a39c050bef66a658812bef12507db36b5920870bb238d4656f92928c690c6a2fe5eaafa9449138a239783b831b4f778402

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-55057.exe

Filesize
468KB

MD5
09aaf8ac97c687e0160794fb8bdf054f

SHA1
8a4c24cc85035b5064e08078cc3777fe4723826a

SHA256
d1a8cdc75812ecf21f4d2eee530c5762926e7fd97c8f0ac7a0a5a6d933f7539e

SHA512
d0ee608b5437cd9461f68e9a83badbdbcd0170f4698e8778f51a4cde90899562f73be0c70b5a2fdde0a74ff3b368ad3f266708c4ca1c5cb921a93219ae4dbcf0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-63300.exe

Filesize
468KB

MD5
bd02cc4a23387bba158a0eba9a5850ac

SHA1
1f518ade2e55fd4548041a7e79db5b2cbd7974ec

SHA256
ca6c1006410878fd14f149597db202706338141eeffde95fbd6d49bc4bc34b9a

SHA512
64fb4f995da800a5f05272c1f19c755843c033750b9860c73cb183ea1b21c248b78beaa4748b60c4959d4abe528de2e569968979d00156d9f057fb5f169b0146

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-10868.exe

Filesize
468KB

MD5
d3c210e69f4744dfc17f096aaef06989

SHA1
1dbd8983cb339dab9b4d017b76dcd4b3edf4ed47

SHA256
8fee187062376ba1af6194fb8711977d78bcae961fb4ccbdaffd3ab65b04b8af

SHA512
bfe4dbf56a2530099315ea9cc24449e21d8bc7fe617d1012af2807f39d29b54e0c836039ffd0df571327dbcb78db7a966f580b81c47a7c2e3dfbd6803e83f852

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-1728.exe

Filesize
468KB

MD5
555befb4434bdd611d2cbcbd0d2032e1

SHA1
7fb9b3c4287b2cee47880ec13bf7b7db5be3d1a2

SHA256
196f5df74048d733d899c047bcc42e8d399fd145a9609507c2288adf6907bf29

SHA512
59eb3476603e35fc1c7f74175ac1aeac590aa047864217e4e26543b7e5ec4ed80b92c1d1a7e9380734333a1d1ba8ac35a8edf49d008b58f58d9eff2286102047

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-24308.exe

Filesize
468KB

MD5
884df28a6a28cdacada6f349bd4631b5

SHA1
49dc657fbd2a4418ccc672f51a6f77066ad11422

SHA256
47149285bfc80913eb2934de699c34a1cc4ba209fa61679f3ff9184ed11a5dcd

SHA512
ad4fc5c4e38dcb569eace315c8cc5fa12f10e35d91fdb907f34903f5b7e878b8278cdc36f29be8dc2356c7e6046156c65dc2118ca4ba6d35cd0044f0982e6261

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-29242.exe

Filesize
468KB

MD5
385ce0fadcc1e34a27ba3af437fb2d05

SHA1
e01064ba4abf162225c115091cb0ed838d59fc1e

SHA256
42059c90dfb638750930e82822eac901f4b2250d3a1c903f7e9c50659a050cb4

SHA512
0f58566e77460fd8974522988793d9dd37ea484276664f5200b314956b374c07099f795c5f33282133c5fa0ab49ce9d4995f6a735c82744d0ac07d88b75a4090

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-38725.exe

Filesize
468KB

MD5
ba42387aa12d3c5c354f1d31b09ba438

SHA1
f08caca6312caafd5d6d5d4cc490a0c7cd2e3df5

SHA256
9600d90b053bd65178bff8c88e4c934843334a93c5b5de468e951ac37bcca9ab

SHA512
eebe3883b0418d7023b123f14e05bdb619ec89de656d14a1ceb25644c1b016408482da1ddbb1ce5c1059418ce25488ddb28a2df728ee2803312420542d4dd518

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-43084.exe

Filesize
468KB

MD5
fd3ae3ce9f72e96be92ef84dab012bac

SHA1
87025bd53ce44deb4369f3c12a036ccadfeaea33

SHA256
d1a906842d0ace727412ef5d677ed05962951ed2b01e757ba1f03acad182eee2

SHA512
8ff0251b26b84c89394e38a92fc5756ef2d9a7bcf6e5abb6a7bdd5e2c0563c9e5844f7861d1e13e126199c5362aae2c1c3a0232fdbb13e7a88b8fa0647f4a863

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-48891.exe

Filesize
468KB

MD5
acd0073b2f54a9b853a967998c0a6675

SHA1
5ef53c27c1d953eedef0513132c3a62091330274

SHA256
45f675892edab154f84650c659bdd28e1adfe48022647176ee6cdccd2e6efc81

SHA512
4e4ef58f52d893278b2bd616e4e84ac085a5bc6a5b0ddb6ef398e00a99671180778ca3ba95787a15633a31659f0430b3181ccdc96f6be9ddc9868d0468e81d0e

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-54599.exe

Filesize
468KB

MD5
d2e43f02c2df853b42d9254d933161d6

SHA1
68b5f1f2f0087018b0926fb6075c590d0f614ca9

SHA256
039049a5b186e05db9678dfd0553c25dd1cb002a182d4d9a9fec97b65176fac9

SHA512
6bc046a40609714adb11eff192b04a3a165d7bcfa61e63e8f66ec7dd417cabdd303a21dc72ffb61db8c301a31badfee6c3a2bfd32de5885dfbbd646565383697

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-64101.exe

Filesize
468KB

MD5
69c037f8e6041b39055bb5b4d8a31b18

SHA1
e1def4602d247e6f07eb96a74e85785938860a0b

SHA256
a4682aecc1d3efb371902ed91bb53ea4a49555860b2c84c11f47773bf6a24942

SHA512
b5886213cf1e630b66c7dc50a148070122ef17229d95cdf0a1a850d08ba666d4446c639bac0dd1ea66ba4955b26bf1c7fca3a9a98727fc5b4e0922c5bcb48c25

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-65518.exe

Filesize
468KB

MD5
e4065dc77f47871653f29043b40b53bf

SHA1
5a8f7f5ea37cf4e771149c8eaa980496da7a0007

SHA256
6ae272f16b420ce6fe1b6e80c36e1209ceff98daa021c845d017b9926f9ead60

SHA512
8528f080ff32683b4c701662947458cbb19dbc5f8dcb624775d6fd9f68a15d91c7e6b97821f24cf789a3b575b272c4c2df4f0e4e845279f9efb9a03a5579b063

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-8927.exe

Filesize
468KB

MD5
3c7184b76a7ce158fbf0d1c186569370

SHA1
31099fadd49d96e61ce046caf8bc252ba283bfc6

SHA256
3a5d51418b81ccfba2369598cf35130ad3669fe7b94fe5390659215abe52e369

SHA512
6d0d377a1c4558118a7b049769624bb242d01b058c8f0961fac3371d964a4d1d46f17bcc73cfb1b177c8a542ff82522277244d9875b2fc4f87c0849781b44ef8

Download Submit