a8cf5422e2adffe1c57aa34d2f1991d76ed29e6098c7cab19eed3e48ee511dc2

Analysis

max time kernel
120s
max time network
16s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19-09-2024 05:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a8cf5422e2adffe1c57aa34d2f1991d76ed29e6098c7cab19eed3e48ee511dc2N.exe
Size

468KB
MD5

60002f04df776cc94093cadec55cbdc0
SHA1

1dd113cd7780da5bed45a269ebde6183a497bc36
SHA256

a8cf5422e2adffe1c57aa34d2f1991d76ed29e6098c7cab19eed3e48ee511dc2
SHA512

4908363b0277f8105a735bc67f7ff41abb0480a3058196c3db9509d31b8087ef041cd5d817b775d0fd608af3076091eba45073f28a35aabc14119fff119f5be2
SSDEEP

3072:1G3HogISIE5TtbY2MzcOcf8/zfctPgpo9VHVTVPyQ85LkY3ElBlL:1G3obMTtxM4OcfdcG0Q8Vd3El

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2832	Unicorn-51492.exe
2728	Unicorn-41674.exe
1944	Unicorn-21808.exe
2676	Unicorn-13490.exe
2752	Unicorn-34465.exe
2556	Unicorn-40033.exe
2420	Unicorn-56308.exe
872	Unicorn-60947.exe
2760	Unicorn-7107.exe
996	Unicorn-33649.exe
304	Unicorn-31612.exe
1320	Unicorn-45483.exe
1604	Unicorn-56770.exe
2880	Unicorn-41211.exe
2220	Unicorn-15244.exe
2340	Unicorn-28051.exe
2940	Unicorn-31389.exe
2376	Unicorn-55131.exe
2868	Unicorn-64061.exe
1684	Unicorn-38597.exe
936	Unicorn-10563.exe
952	Unicorn-59764.exe
1008	Unicorn-5467.exe
2140	Unicorn-5042.exe
2960	Unicorn-26017.exe
544	Unicorn-21763.exe
1904	Unicorn-61378.exe
1908	Unicorn-36262.exe
1288	Unicorn-36262.exe
3020	Unicorn-63947.exe
2616	Unicorn-57817.exe
1548	Unicorn-43012.exe
2320	Unicorn-54710.exe
800	Unicorn-54710.exe
2180	Unicorn-46350.exe
2756	Unicorn-46926.exe
2640	Unicorn-46926.exe
2540	Unicorn-10532.exe
2860	Unicorn-4939.exe
2568	Unicorn-7739.exe
2668	Unicorn-63070.exe
2532	Unicorn-43204.exe
2576	Unicorn-37604.exe
888	Unicorn-58581.exe
1840	Unicorn-52401.exe
1232	Unicorn-57808.exe
2020	Unicorn-52100.exe
1668	Unicorn-45778.exe
2784	Unicorn-27212.exe
1628	Unicorn-39250.exe
1780	Unicorn-26252.exe
2028	Unicorn-33657.exe
2116	Unicorn-61420.exe
2368	Unicorn-57891.exe
1060	Unicorn-53060.exe
1940	Unicorn-41746.exe
1356	Unicorn-61612.exe
1292	Unicorn-40786.exe
1916	Unicorn-35463.exe
1676	Unicorn-61813.exe
2972	Unicorn-59775.exe
2952	Unicorn-2406.exe
3036	Unicorn-29215.exe
880	Unicorn-34237.exe

Loads dropped DLL 64 IoCs

pid	Process
2016	a8cf5422e2adffe1c57aa34d2f1991d76ed29e6098c7cab19eed3e48ee511dc2N.exe
2016	a8cf5422e2adffe1c57aa34d2f1991d76ed29e6098c7cab19eed3e48ee511dc2N.exe
2832	Unicorn-51492.exe
2016	a8cf5422e2adffe1c57aa34d2f1991d76ed29e6098c7cab19eed3e48ee511dc2N.exe
2832	Unicorn-51492.exe
2016	a8cf5422e2adffe1c57aa34d2f1991d76ed29e6098c7cab19eed3e48ee511dc2N.exe
1944	Unicorn-21808.exe
1944	Unicorn-21808.exe
2832	Unicorn-51492.exe
2832	Unicorn-51492.exe
2016	a8cf5422e2adffe1c57aa34d2f1991d76ed29e6098c7cab19eed3e48ee511dc2N.exe
2016	a8cf5422e2adffe1c57aa34d2f1991d76ed29e6098c7cab19eed3e48ee511dc2N.exe
2688	WerFault.exe
2688	WerFault.exe
2688	WerFault.exe
2688	WerFault.exe
2688	WerFault.exe
2676	Unicorn-13490.exe
2676	Unicorn-13490.exe
1944	Unicorn-21808.exe
1944	Unicorn-21808.exe
2752	Unicorn-34465.exe
2752	Unicorn-34465.exe
2832	Unicorn-51492.exe
2832	Unicorn-51492.exe
2556	Unicorn-40033.exe
2556	Unicorn-40033.exe
2016	a8cf5422e2adffe1c57aa34d2f1991d76ed29e6098c7cab19eed3e48ee511dc2N.exe
2016	a8cf5422e2adffe1c57aa34d2f1991d76ed29e6098c7cab19eed3e48ee511dc2N.exe
872	Unicorn-60947.exe
872	Unicorn-60947.exe
1944	Unicorn-21808.exe
1944	Unicorn-21808.exe
2420	Unicorn-56308.exe
2420	Unicorn-56308.exe
2676	Unicorn-13490.exe
2676	Unicorn-13490.exe
1320	Unicorn-45483.exe
2016	a8cf5422e2adffe1c57aa34d2f1991d76ed29e6098c7cab19eed3e48ee511dc2N.exe
1320	Unicorn-45483.exe
2760	Unicorn-7107.exe
2016	a8cf5422e2adffe1c57aa34d2f1991d76ed29e6098c7cab19eed3e48ee511dc2N.exe
2760	Unicorn-7107.exe
996	Unicorn-33649.exe
2556	Unicorn-40033.exe
996	Unicorn-33649.exe
2556	Unicorn-40033.exe
1640	WerFault.exe
1640	WerFault.exe
1640	WerFault.exe
1640	WerFault.exe
2752	Unicorn-34465.exe
2832	Unicorn-51492.exe
2752	Unicorn-34465.exe
2832	Unicorn-51492.exe
1640	WerFault.exe
1604	Unicorn-56770.exe
1604	Unicorn-56770.exe
872	Unicorn-60947.exe
872	Unicorn-60947.exe
2880	Unicorn-41211.exe
2880	Unicorn-41211.exe
1944	Unicorn-21808.exe
1944	Unicorn-21808.exe

Program crash 64 IoCs

pid	pid_target	Process	procid_target
2688	2728	WerFault.exe	32
1640	304	WerFault.exe	42
1756	2752	WerFault.exe	36
3056	2576	WerFault.exe	76
696	2616	WerFault.exe	64
1096	2532	WerFault.exe	75
2136	2868	WerFault.exe	51
1736	2680	WerFault.exe	103
2724	1060	WerFault.exe	88
2696	1760	WerFault.exe	127
2336	1676	WerFault.exe	93
1112	2824	WerFault.exe	131
2792	1596	WerFault.exe	99
1532	2972	WerFault.exe	94
1680	1808	WerFault.exe	101
4084	2828	WerFault.exe	153
3336	1692	WerFault.exe	126
3660	2912	WerFault.exe	129
3872	1560	WerFault.exe	156
3904	2884	WerFault.exe	152
3344	2800	WerFault.exe	104
3472	880	WerFault.exe	98
3432	2744	WerFault.exe	128
3800	1788	WerFault.exe	116
3804	2348	WerFault.exe	115
4404	1852	WerFault.exe	121
4412	628	WerFault.exe	112
4788	2628	WerFault.exe	118
4844	2216	WerFault.exe	167
4836	1272	WerFault.exe	175
4884	2004	WerFault.exe	166
4876	672	WerFault.exe	168
4204	1668	WerFault.exe	81
4208	2960	WerFault.exe	57
4232	1092	WerFault.exe	117
4264	3020	WerFault.exe	63
4304	1524	WerFault.exe	177
4332	776	WerFault.exe	180
4340	3016	WerFault.exe	165
4372	2984	WerFault.exe	169
4384	2056	WerFault.exe	171
4552	1908	WerFault.exe	61
4584	2140	WerFault.exe	56
4644	2860	WerFault.exe	73
4628	2028	WerFault.exe	85
4656	2352	WerFault.exe	143
4912	1724	WerFault.exe	133
4984	2812	WerFault.exe	130
4688	1328	WerFault.exe	107
4568	1940	WerFault.exe	89
4352	1548	WerFault.exe	65
4488	952	WerFault.exe	54
4784	2604	WerFault.exe	149
4812	1436	WerFault.exe	146
4276	2572	WerFault.exe	137
5004	1764	WerFault.exe	136
2272	1956	WerFault.exe	144
5316	2952	WerFault.exe	95
5308	2256	WerFault.exe	157
5336	2464	WerFault.exe	158
5596	1376	WerFault.exe	108
6068	1008	WerFault.exe	55
6108	1232	WerFault.exe	79
6100	2220	WerFault.exe	46

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62749.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59775.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60704.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30526.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36015.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-266.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34408.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63901.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30939.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28051.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2943.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49704.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42502.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59959.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63805.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43427.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5907.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63540.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15244.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28993.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47266.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38734.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31966.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31389.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6685.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3486.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52031.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37703.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20141.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35342.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46298.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29895.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50478.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4939.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2406.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36613.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46975.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60282.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10197.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3091.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33704.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6621.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33162.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26475.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56308.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55131.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34237.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13287.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37979.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21550.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46926.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14139.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60493.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20206.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64934.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52108.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64061.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20971.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50450.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10176.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28277.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47636.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3306.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45660.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2016	a8cf5422e2adffe1c57aa34d2f1991d76ed29e6098c7cab19eed3e48ee511dc2N.exe
2832	Unicorn-51492.exe
2728	Unicorn-41674.exe
1944	Unicorn-21808.exe
2676	Unicorn-13490.exe
2752	Unicorn-34465.exe
2556	Unicorn-40033.exe
2420	Unicorn-56308.exe
872	Unicorn-60947.exe
996	Unicorn-33649.exe
2760	Unicorn-7107.exe
304	Unicorn-31612.exe
1320	Unicorn-45483.exe
1604	Unicorn-56770.exe
2880	Unicorn-41211.exe
2340	Unicorn-28051.exe
2376	Unicorn-55131.exe
2220	Unicorn-15244.exe
2940	Unicorn-31389.exe
2868	Unicorn-64061.exe
1684	Unicorn-38597.exe
936	Unicorn-10563.exe
1008	Unicorn-5467.exe
952	Unicorn-59764.exe
2140	Unicorn-5042.exe
2960	Unicorn-26017.exe
544	Unicorn-21763.exe
1904	Unicorn-61378.exe
1908	Unicorn-36262.exe
1288	Unicorn-36262.exe
3020	Unicorn-63947.exe
1548	Unicorn-43012.exe
2616	Unicorn-57817.exe
800	Unicorn-54710.exe
2320	Unicorn-54710.exe
2180	Unicorn-46350.exe
2756	Unicorn-46926.exe
2640	Unicorn-46926.exe
2540	Unicorn-10532.exe
2532	Unicorn-43204.exe
2568	Unicorn-7739.exe
2668	Unicorn-63070.exe
2576	Unicorn-37604.exe
2860	Unicorn-4939.exe
888	Unicorn-58581.exe
1840	Unicorn-52401.exe
1232	Unicorn-57808.exe
2020	Unicorn-52100.exe
1668	Unicorn-45778.exe
2784	Unicorn-27212.exe
1628	Unicorn-39250.exe
1780	Unicorn-26252.exe
2028	Unicorn-33657.exe
2116	Unicorn-61420.exe
2368	Unicorn-57891.exe
1060	Unicorn-53060.exe
1356	Unicorn-61612.exe
1940	Unicorn-41746.exe
1292	Unicorn-40786.exe
1916	Unicorn-35463.exe
1676	Unicorn-61813.exe
2952	Unicorn-2406.exe
2972	Unicorn-59775.exe
3036	Unicorn-29215.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2016 wrote to memory of 2832	2016	a8cf5422e2adffe1c57aa34d2f1991d76ed29e6098c7cab19eed3e48ee511dc2N.exe	31
PID 2016 wrote to memory of 2832	2016	a8cf5422e2adffe1c57aa34d2f1991d76ed29e6098c7cab19eed3e48ee511dc2N.exe	31
PID 2016 wrote to memory of 2832	2016	a8cf5422e2adffe1c57aa34d2f1991d76ed29e6098c7cab19eed3e48ee511dc2N.exe	31
PID 2016 wrote to memory of 2832	2016	a8cf5422e2adffe1c57aa34d2f1991d76ed29e6098c7cab19eed3e48ee511dc2N.exe	31
PID 2832 wrote to memory of 2728	2832	Unicorn-51492.exe	32
PID 2832 wrote to memory of 2728	2832	Unicorn-51492.exe	32
PID 2832 wrote to memory of 2728	2832	Unicorn-51492.exe	32
PID 2832 wrote to memory of 2728	2832	Unicorn-51492.exe	32
PID 2016 wrote to memory of 1944	2016	a8cf5422e2adffe1c57aa34d2f1991d76ed29e6098c7cab19eed3e48ee511dc2N.exe	33
PID 2016 wrote to memory of 1944	2016	a8cf5422e2adffe1c57aa34d2f1991d76ed29e6098c7cab19eed3e48ee511dc2N.exe	33
PID 2016 wrote to memory of 1944	2016	a8cf5422e2adffe1c57aa34d2f1991d76ed29e6098c7cab19eed3e48ee511dc2N.exe	33
PID 2016 wrote to memory of 1944	2016	a8cf5422e2adffe1c57aa34d2f1991d76ed29e6098c7cab19eed3e48ee511dc2N.exe	33
PID 1944 wrote to memory of 2676	1944	Unicorn-21808.exe	35
PID 1944 wrote to memory of 2676	1944	Unicorn-21808.exe	35
PID 1944 wrote to memory of 2676	1944	Unicorn-21808.exe	35
PID 1944 wrote to memory of 2676	1944	Unicorn-21808.exe	35
PID 2728 wrote to memory of 2688	2728	Unicorn-41674.exe	34
PID 2728 wrote to memory of 2688	2728	Unicorn-41674.exe	34
PID 2728 wrote to memory of 2688	2728	Unicorn-41674.exe	34
PID 2728 wrote to memory of 2688	2728	Unicorn-41674.exe	34
PID 2832 wrote to memory of 2752	2832	Unicorn-51492.exe	36
PID 2832 wrote to memory of 2752	2832	Unicorn-51492.exe	36
PID 2832 wrote to memory of 2752	2832	Unicorn-51492.exe	36
PID 2832 wrote to memory of 2752	2832	Unicorn-51492.exe	36
PID 2016 wrote to memory of 2556	2016	a8cf5422e2adffe1c57aa34d2f1991d76ed29e6098c7cab19eed3e48ee511dc2N.exe	37
PID 2016 wrote to memory of 2556	2016	a8cf5422e2adffe1c57aa34d2f1991d76ed29e6098c7cab19eed3e48ee511dc2N.exe	37
PID 2016 wrote to memory of 2556	2016	a8cf5422e2adffe1c57aa34d2f1991d76ed29e6098c7cab19eed3e48ee511dc2N.exe	37
PID 2016 wrote to memory of 2556	2016	a8cf5422e2adffe1c57aa34d2f1991d76ed29e6098c7cab19eed3e48ee511dc2N.exe	37
PID 2676 wrote to memory of 2420	2676	Unicorn-13490.exe	38
PID 2676 wrote to memory of 2420	2676	Unicorn-13490.exe	38
PID 2676 wrote to memory of 2420	2676	Unicorn-13490.exe	38
PID 2676 wrote to memory of 2420	2676	Unicorn-13490.exe	38
PID 1944 wrote to memory of 872	1944	Unicorn-21808.exe	39
PID 1944 wrote to memory of 872	1944	Unicorn-21808.exe	39
PID 1944 wrote to memory of 872	1944	Unicorn-21808.exe	39
PID 1944 wrote to memory of 872	1944	Unicorn-21808.exe	39
PID 2752 wrote to memory of 2760	2752	Unicorn-34465.exe	40
PID 2752 wrote to memory of 2760	2752	Unicorn-34465.exe	40
PID 2752 wrote to memory of 2760	2752	Unicorn-34465.exe	40
PID 2752 wrote to memory of 2760	2752	Unicorn-34465.exe	40
PID 2832 wrote to memory of 996	2832	Unicorn-51492.exe	41
PID 2832 wrote to memory of 996	2832	Unicorn-51492.exe	41
PID 2832 wrote to memory of 996	2832	Unicorn-51492.exe	41
PID 2832 wrote to memory of 996	2832	Unicorn-51492.exe	41
PID 2556 wrote to memory of 304	2556	Unicorn-40033.exe	42
PID 2556 wrote to memory of 304	2556	Unicorn-40033.exe	42
PID 2556 wrote to memory of 304	2556	Unicorn-40033.exe	42
PID 2556 wrote to memory of 304	2556	Unicorn-40033.exe	42
PID 2016 wrote to memory of 1320	2016	a8cf5422e2adffe1c57aa34d2f1991d76ed29e6098c7cab19eed3e48ee511dc2N.exe	43
PID 2016 wrote to memory of 1320	2016	a8cf5422e2adffe1c57aa34d2f1991d76ed29e6098c7cab19eed3e48ee511dc2N.exe	43
PID 2016 wrote to memory of 1320	2016	a8cf5422e2adffe1c57aa34d2f1991d76ed29e6098c7cab19eed3e48ee511dc2N.exe	43
PID 2016 wrote to memory of 1320	2016	a8cf5422e2adffe1c57aa34d2f1991d76ed29e6098c7cab19eed3e48ee511dc2N.exe	43
PID 872 wrote to memory of 1604	872	Unicorn-60947.exe	44
PID 872 wrote to memory of 1604	872	Unicorn-60947.exe	44
PID 872 wrote to memory of 1604	872	Unicorn-60947.exe	44
PID 872 wrote to memory of 1604	872	Unicorn-60947.exe	44
PID 1944 wrote to memory of 2880	1944	Unicorn-21808.exe	45
PID 1944 wrote to memory of 2880	1944	Unicorn-21808.exe	45
PID 1944 wrote to memory of 2880	1944	Unicorn-21808.exe	45
PID 1944 wrote to memory of 2880	1944	Unicorn-21808.exe	45
PID 2420 wrote to memory of 2220	2420	Unicorn-56308.exe	46
PID 2420 wrote to memory of 2220	2420	Unicorn-56308.exe	46
PID 2420 wrote to memory of 2220	2420	Unicorn-56308.exe	46
PID 2420 wrote to memory of 2220	2420	Unicorn-56308.exe	46

C:\Users\Admin\AppData\Local\Temp\a8cf5422e2adffe1c57aa34d2f1991d76ed29e6098c7cab19eed3e48ee511dc2N.exe
"C:\Users\Admin\AppData\Local\Temp\a8cf5422e2adffe1c57aa34d2f1991d76ed29e6098c7cab19eed3e48ee511dc2N.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2016
- C:\Users\Admin\AppData\Local\Temp\Unicorn-51492.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-51492.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2832
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41674.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41674.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2728
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2728 -s 240
      4⤵
      Loads dropped DLL
      Program crash
      PID:2688
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34465.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34465.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7107.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7107.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64061.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63947.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18738.exe
        7⤵
        
        PID:1092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62622.exe
        8⤵
        
        PID:3768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64934.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:8224
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1092 -s 248
        8⤵
        Program crash
        
        PID:4232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10468.exe
        7⤵
        
        PID:3820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16388.exe
        8⤵
        
        PID:8348
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3020 -s 244
        7⤵
        Program crash
        
        PID:4264
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2868 -s 248
        6⤵
        Program crash
        
        PID:2136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43012.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52842.exe
        6⤵
        
        PID:2680
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2680 -s 240
        7⤵
        Program crash
        
        PID:1736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52357.exe
        6⤵
        
        PID:1956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50277.exe
        7⤵
        
        PID:3496
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1956 -s 248
        7⤵
        Program crash
        
        PID:2272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15428.exe
        6⤵
        
        PID:3688
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1548 -s 228
        6⤵
        Program crash
        
        PID:4352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11071.exe
        5⤵
        
        PID:1328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49171.exe
        6⤵
        
        PID:920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4755.exe
        7⤵
        
        PID:4004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19737.exe
        7⤵
        
        PID:4940
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 920 -s 224
        7⤵
        
        PID:884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49275.exe
        6⤵
        
        PID:3136
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1328 -s 240
        6⤵
        Program crash
        
        PID:4688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39861.exe
        5⤵
        
        PID:2352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12456.exe
        6⤵
        
        PID:3332
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2352 -s 216
        6⤵
        Program crash
        
        PID:4656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50890.exe
        5⤵
        
        PID:3584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63805.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49011.exe
        5⤵
        
        PID:6196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25908.exe
        5⤵
        
        PID:7664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12398.exe
        5⤵
        
        PID:7984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59764.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59764.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36262.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61420.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1690.exe
        7⤵
        
        PID:288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28959.exe
        8⤵
        
        PID:3788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28564.exe
        8⤵
        
        PID:4996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59449.exe
        8⤵
        
        PID:5944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55574.exe
        8⤵
        
        PID:7648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38734.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:7824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-266.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33472.exe
        7⤵
        
        PID:4896
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2116 -s 236
        7⤵
        
        PID:6244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45642.exe
        6⤵
        
        PID:1032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15040.exe
        7⤵
        
        PID:3944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10565.exe
        8⤵
        
        PID:8748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54745.exe
        7⤵
        
        PID:3120
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1032 -s 224
        7⤵
        
        PID:5324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8334.exe
        6⤵
        
        PID:4072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2672.exe
        7⤵
        
        PID:9060
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1908 -s 248
        6⤵
        Program crash
        
        PID:4552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57891.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6685.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38087.exe
        7⤵
        
        PID:3628
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1436 -s 228
        7⤵
        Program crash
        
        PID:4812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1693.exe
        6⤵
        
        PID:3700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1651.exe
        6⤵
        
        PID:4260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65314.exe
        6⤵
        
        PID:6164
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2368 -s 244
        6⤵
        
        PID:7588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26787.exe
        5⤵
        
        PID:2604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5907.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3380
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2604 -s 228
        6⤵
        Program crash
        
        PID:4784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20141.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3932
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 952 -s 240
        5⤵
        Program crash
        
        PID:4488
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2752 -s 240
      4⤵
      Program crash
      PID:1756
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33649.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33649.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38597.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38597.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46926.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1908.exe
        6⤵
        
        PID:2512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24117.exe
        7⤵
        
        PID:1004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23748.exe
        8⤵
        
        PID:6788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18083.exe
        8⤵
        
        PID:8172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48903.exe
        8⤵
        
        PID:8952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63328.exe
        7⤵
        
        PID:4000
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2512 -s 244
        7⤵
        
        PID:6140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10795.exe
        6⤵
        
        PID:3144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40966.exe
        7⤵
        
        PID:6644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59025.exe
        7⤵
        
        PID:8004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33448.exe
        7⤵
        
        PID:7988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59959.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3243.exe
        6⤵
        
        PID:5272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47106.exe
        6⤵
        
        PID:6604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20459.exe
        6⤵
        
        PID:7768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32497.exe
        6⤵
        
        PID:8656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5203.exe
        5⤵
        
        PID:2412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13888.exe
        6⤵
        
        PID:4044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13686.exe
        6⤵
        
        PID:4452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4332.exe
        6⤵
        
        PID:5136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60696.exe
        6⤵
        
        PID:7316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49704.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43345.exe
        6⤵
        
        PID:8320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51012.exe
        5⤵
        
        PID:3916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12677.exe
        6⤵
        
        PID:8784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8808.exe
        5⤵
        
        PID:3168
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1684 -s 244
        5⤵
        
        PID:6036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43204.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43204.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2532
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2532 -s 240
        5⤵
        Program crash
        
        PID:1096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27106.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27106.exe
      4⤵
      PID:2924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30526.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48401.exe
        6⤵
        
        PID:8236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56971.exe
        5⤵
        
        PID:4804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65302.exe
        5⤵
        
        PID:5732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47987.exe
        5⤵
        
        PID:6860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3554.exe
        5⤵
        
        PID:7348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21783.exe
        5⤵
        
        PID:9084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37853.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37853.exe
      4⤵
      PID:3712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62594.exe
        5⤵
        
        PID:8652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-143.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-143.exe
      4⤵
      PID:4240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50534.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50534.exe
      4⤵
      PID:5140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52561.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52561.exe
      4⤵
      PID:7272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28703.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28703.exe
      4⤵
      PID:7404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7972.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7972.exe
      4⤵
      PID:8472
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5467.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5467.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54710.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54710.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59775.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2972
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2972 -s 224
        6⤵
        Program crash
        
        PID:1532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20971.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39726.exe
        6⤵
        
        PID:6308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63190.exe
        6⤵
        
        PID:7924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7896.exe
        6⤵
        
        PID:9180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28246.exe
        5⤵
        
        PID:4220
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2320 -s 228
        5⤵
        
        PID:5128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34045.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34045.exe
      4⤵
      PID:1596
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1596 -s 220
        5⤵
        Program crash
        
        PID:2792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17986.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17986.exe
      4⤵
      PID:968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11299.exe
        5⤵
        
        PID:4856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51567.exe
        5⤵
        
        PID:5716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42122.exe
        5⤵
        
        PID:6880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37684.exe
        5⤵
        
        PID:8184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46103.exe
        5⤵
        
        PID:8976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17391.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17391.exe
      4⤵
      PID:3556
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1008 -s 224
      4⤵
      Program crash
      PID:6068
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4939.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4939.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29215.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29215.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46239.exe
        5⤵
        
        PID:2828
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2828 -s 224
        6⤵
        Program crash
        
        PID:4084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13287.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3192
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3192 -s 224
        6⤵
        
        PID:9052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17203.exe
        5⤵
        
        PID:4692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60912.exe
        5⤵
        
        PID:6116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7244.exe
        5⤵
        
        PID:7324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28980.exe
        5⤵
        
        PID:7520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40392.exe
        5⤵
        
        PID:8544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13135.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13135.exe
      4⤵
      PID:2096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36577.exe
        5⤵
        
        PID:3232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37998.exe
        5⤵
        
        PID:4680
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2096 -s 244
        5⤵
        
        PID:5156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46015.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46015.exe
      4⤵
      PID:3184
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2860 -s 248
      4⤵
      Program crash
      PID:4644
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36613.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36613.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1808
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1808 -s 244
      4⤵
      Program crash
      PID:1680
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47704.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47704.exe
    3⤵
    PID:3112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22857.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22857.exe
      4⤵
      PID:4492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53498.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53498.exe
      4⤵
      PID:6452
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3112 -s 224
      4⤵
      PID:7640
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3486.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3486.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4248
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33779.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33779.exe
    3⤵
    PID:5192
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24970.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24970.exe
    3⤵
    PID:6372
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52660.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52660.exe
    3⤵
    PID:7688
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29431.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29431.exe
    3⤵
    PID:8576
- C:\Users\Admin\AppData\Local\Temp\Unicorn-21808.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-21808.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1944
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13490.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13490.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56308.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56308.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15244.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63070.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51882.exe
        7⤵
        
        PID:2796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62648.exe
        8⤵
        
        PID:3312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61511.exe
        9⤵
        
        PID:7524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20206.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:7844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56696.exe
        8⤵
        
        PID:4396
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2796 -s 244
        8⤵
        
        PID:5236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17510.exe
        7⤵
        
        PID:3456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51981.exe
        8⤵
        
        PID:7372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63901.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:8448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37074.exe
        7⤵
        
        PID:4556
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2668 -s 248
        7⤵
        
        PID:5400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6080.exe
        6⤵
        
        PID:1376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57282.exe
        7⤵
        
        PID:2056
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2056 -s 244
        8⤵
        Program crash
        
        PID:4384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25289.exe
        7⤵
        
        PID:4040
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1376 -s 244
        7⤵
        Program crash
        
        PID:5596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-306.exe
        6⤵
        
        PID:2968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17740.exe
        7⤵
        
        PID:4696
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2968 -s 236
        7⤵
        
        PID:5372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32877.exe
        6⤵
        
        PID:4032
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2220 -s 244
        6⤵
        Program crash
        
        PID:6100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58581.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50450.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24833.exe
        7⤵
        
        PID:1560
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1560 -s 240
        8⤵
        Program crash
        
        PID:3872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40800.exe
        7⤵
        
        PID:3412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50066.exe
        7⤵
        
        PID:1044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57146.exe
        7⤵
        
        PID:6256
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1800 -s 224
        7⤵
        
        PID:7600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39258.exe
        6⤵
        
        PID:2464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45456.exe
        7⤵
        
        PID:3152
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2464 -s 248
        7⤵
        Program crash
        
        PID:5336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28277.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39503.exe
        7⤵
        
        PID:7828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53154.exe
        7⤵
        
        PID:2260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64099.exe
        6⤵
        
        PID:3052
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 888 -s 224
        6⤵
        
        PID:6152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2135.exe
        5⤵
        
        PID:636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38803.exe
        6⤵
        
        PID:3508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12728.exe
        7⤵
        
        PID:7560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26475.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14402.exe
        6⤵
        
        PID:4668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62915.exe
        6⤵
        
        PID:5176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55771.exe
        6⤵
        
        PID:6364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36994.exe
        6⤵
        
        PID:7584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15431.exe
        6⤵
        
        PID:8624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23162.exe
        5⤵
        
        PID:3548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63201.exe
        6⤵
        
        PID:8984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2369.exe
        5⤵
        
        PID:4816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45966.exe
        5⤵
        
        PID:5620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39852.exe
        5⤵
        
        PID:6836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8018.exe
        5⤵
        
        PID:8112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19767.exe
        5⤵
        
        PID:9000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28051.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28051.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36262.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53060.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1060
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1060 -s 240
        7⤵
        Program crash
        
        PID:2724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62912.exe
        6⤵
        
        PID:2000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34408.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36330.exe
        7⤵
        
        PID:932
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2000 -s 224
        7⤵
        
        PID:5940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40016.exe
        6⤵
        
        PID:3204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55931.exe
        6⤵
        
        PID:4356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56649.exe
        6⤵
        
        PID:2392
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1288 -s 248
        6⤵
        
        PID:7624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41746.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65507.exe
        6⤵
        
        PID:1140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60889.exe
        7⤵
        
        PID:3636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43172.exe
        7⤵
        
        PID:4128
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1140 -s 224
        7⤵
        
        PID:5468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9010.exe
        6⤵
        
        PID:3852
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1940 -s 240
        6⤵
        Program crash
        
        PID:4568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10176.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46146.exe
        6⤵
        
        PID:3240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36330.exe
        6⤵
        
        PID:1816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43772.exe
        6⤵
        
        PID:6568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55958.exe
        6⤵
        
        PID:7772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56990.exe
        6⤵
        
        PID:7836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11013.exe
        5⤵
        
        PID:3256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64388.exe
        5⤵
        
        PID:4676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40113.exe
        5⤵
        
        PID:5748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47439.exe
        5⤵
        
        PID:7672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17733.exe
        5⤵
        
        PID:7792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57817.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57817.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2616
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2616 -s 244
        5⤵
        Program crash
        
        PID:696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8000.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8000.exe
      4⤵
      PID:628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29976.exe
        5⤵
        
        PID:3248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24355.exe
        6⤵
        
        PID:5988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16866.exe
        6⤵
        
        PID:7460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61523.exe
        6⤵
        
        PID:7352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60736.exe
        6⤵
        
        PID:9016
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 628 -s 228
        5⤵
        Program crash
        
        PID:4412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11533.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11533.exe
      4⤵
      PID:3420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3164.exe
        5⤵
        
        PID:7448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62749.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2471.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2471.exe
      4⤵
      PID:4524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60645.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60645.exe
      4⤵
      PID:5248
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2676 -s 248
      4⤵
      PID:6576
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60947.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60947.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56770.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56770.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:1604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5042.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52401.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33704.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53764.exe
        8⤵
        
        PID:3756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11377.exe
        8⤵
        
        PID:4952
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2980 -s 224
        8⤵
        
        PID:6176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58128.exe
        7⤵
        
        PID:3288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51734.exe
        7⤵
        
        PID:4616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10197.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52031.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33168.exe
        7⤵
        
        PID:7736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60411.exe
        7⤵
        
        PID:8304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24694.exe
        6⤵
        
        PID:1000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21284.exe
        7⤵
        
        PID:3912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20204.exe
        7⤵
        
        PID:4744
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1000 -s 224
        7⤵
        
        PID:5524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45138.exe
        6⤵
        
        PID:3452
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2140 -s 248
        6⤵
        Program crash
        
        PID:4584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57808.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59552.exe
        6⤵
        
        PID:2824
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2824 -s 224
        7⤵
        Program crash
        
        PID:1112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52108.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1524
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1524 -s 224
        7⤵
        Program crash
        
        PID:4304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27011.exe
        6⤵
        
        PID:3160
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1232 -s 248
        6⤵
        Program crash
        
        PID:6108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28149.exe
        5⤵
        
        PID:2764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13115.exe
        6⤵
        
        PID:3952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2991.exe
        6⤵
        
        PID:4196
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2764 -s 224
        6⤵
        
        PID:6220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3063.exe
        5⤵
        
        PID:3400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48934.exe
        5⤵
        
        PID:4572
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1604 -s 248
        5⤵
        
        PID:5184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26017.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26017.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52100.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16818.exe
        6⤵
        
        PID:2348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8932.exe
        7⤵
        
        PID:576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5158.exe
        8⤵
        
        PID:5436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46072.exe
        8⤵
        
        PID:7044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62763.exe
        8⤵
        
        PID:8132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9412.exe
        8⤵
        
        PID:8260
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2348 -s 228
        7⤵
        Program crash
        
        PID:3804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4251.exe
        6⤵
        
        PID:1928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40276.exe
        7⤵
        
        PID:6696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18275.exe
        7⤵
        
        PID:2192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24398.exe
        7⤵
        
        PID:8804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11526.exe
        6⤵
        
        PID:3092
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2020 -s 228
        6⤵
        
        PID:1056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5395.exe
        5⤵
        
        PID:2292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30910.exe
        6⤵
        
        PID:3676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62101.exe
        7⤵
        
        PID:8932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30266.exe
        6⤵
        
        PID:4976
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2292 -s 244
        6⤵
        
        PID:1520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17763.exe
        5⤵
        
        PID:3880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14026.exe
        6⤵
        
        PID:9204
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2960 -s 248
        5⤵
        Program crash
        
        PID:4208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45778.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45778.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9116.exe
        5⤵
        
        PID:1692
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1692 -s 244
        6⤵
        Program crash
        
        PID:3336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36015.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5391.exe
        6⤵
        
        PID:9064
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1668 -s 244
        5⤵
        Program crash
        
        PID:4204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60164.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60164.exe
      4⤵
      PID:1760
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1760 -s 220
        5⤵
        Program crash
        
        PID:2696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57511.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57511.exe
      4⤵
      PID:2884
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2884 -s 220
        5⤵
        Program crash
        
        PID:3904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3768.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3768.exe
      4⤵
      PID:3104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29239.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29239.exe
      4⤵
      PID:5168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44008.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44008.exe
      4⤵
      PID:5728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20573.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20573.exe
      4⤵
      PID:7572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16598.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16598.exe
      4⤵
      PID:7788
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41211.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41211.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21763.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21763.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27212.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60704.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21751.exe
        7⤵
        
        PID:3560
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1764 -s 248
        7⤵
        Program crash
        
        PID:5004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39954.exe
        6⤵
        
        PID:3568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17603.exe
        6⤵
        
        PID:4752
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2784 -s 216
        6⤵
        
        PID:6232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49391.exe
        5⤵
        
        PID:2572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21175.exe
        6⤵
        
        PID:3484
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2572 -s 248
        6⤵
        Program crash
        
        PID:4276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28993.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43622.exe
        6⤵
        
        PID:8708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23469.exe
        5⤵
        
        PID:4728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65009.exe
        5⤵
        
        PID:5492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30373.exe
        5⤵
        
        PID:7616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39264.exe
        5⤵
        
        PID:7756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39250.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39250.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32085.exe
        5⤵
        
        PID:1788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-764.exe
        6⤵
        
        PID:776
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 776 -s 224
        7⤵
        Program crash
        
        PID:4332
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1788 -s 228
        6⤵
        Program crash
        
        PID:3800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45668.exe
        5⤵
        
        PID:1664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61619.exe
        6⤵
        
        PID:5904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3306.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29789.exe
        6⤵
        
        PID:7400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29688.exe
        6⤵
        
        PID:9140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52943.exe
        5⤵
        
        PID:4176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27940.exe
        5⤵
        
        PID:6084
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1628 -s 240
        5⤵
        
        PID:6312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19130.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19130.exe
      4⤵
      PID:1852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13447.exe
        5⤵
        
        PID:3276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34194.exe
        6⤵
        
        PID:6612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57523.exe
        6⤵
        
        PID:7752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56547.exe
        6⤵
        
        PID:8760
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1852 -s 228
        5⤵
        Program crash
        
        PID:4404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20198.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20198.exe
      4⤵
      PID:3392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63540.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61732.exe
        5⤵
        
        PID:7800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35342.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35342.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4480
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43579.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43579.exe
      4⤵
      PID:5208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47636.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47636.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15994.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15994.exe
      4⤵
      PID:7536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5631.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5631.exe
      4⤵
      PID:8600
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61378.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61378.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26252.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26252.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57850.exe
        5⤵
        
        PID:2092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22057.exe
        6⤵
        
        PID:4012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46917.exe
        7⤵
        
        PID:8800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39259.exe
        6⤵
        
        PID:4440
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2092 -s 244
        6⤵
        
        PID:5464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18252.exe
        5⤵
        
        PID:3728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46450.exe
        6⤵
        
        PID:8616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2943.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4140
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1780 -s 236
        5⤵
        
        PID:4992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14139.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14139.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56099.exe
        5⤵
        
        PID:3576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24369.exe
        6⤵
        
        PID:8772
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2628 -s 216
        5⤵
        Program crash
        
        PID:4788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24779.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24779.exe
      4⤵
      PID:3648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31162.exe
        5⤵
        
        PID:8496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49867.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49867.exe
      4⤵
      PID:4956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62502.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62502.exe
      4⤵
      PID:5568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22786.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22786.exe
      4⤵
      PID:6824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29549.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29549.exe
      4⤵
      PID:8116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25102.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25102.exe
      4⤵
      PID:8940
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33657.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33657.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59552.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59552.exe
      4⤵
      PID:2812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4371.exe
        5⤵
        
        PID:3780
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2812 -s 248
        5⤵
        Program crash
        
        PID:4984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33239.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33239.exe
      4⤵
      PID:3132
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2028 -s 224
      4⤵
      Program crash
      PID:4628
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8814.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8814.exe
    3⤵
    PID:1724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44636.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44636.exe
      4⤵
      PID:3208
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1724 -s 236
      4⤵
      Program crash
      PID:4912
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36729.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36729.exe
    3⤵
    PID:3356
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27933.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27933.exe
    3⤵
    PID:4600
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40733.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40733.exe
    3⤵
    PID:6124
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29895.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29895.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:7236
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-65369.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-65369.exe
    3⤵
    PID:7364
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31772.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31772.exe
    3⤵
    PID:8440
- C:\Users\Admin\AppData\Local\Temp\Unicorn-40033.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-40033.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2556
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31612.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31612.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:304
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 304 -s 220
      4⤵
      Loads dropped DLL
      Program crash
      PID:1640
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10563.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10563.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46350.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46350.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51882.exe
        5⤵
        
        PID:2800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63722.exe
        6⤵
        
        PID:2360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10832.exe
        7⤵
        
        PID:4636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49180.exe
        7⤵
        
        PID:5404
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2360 -s 224
        7⤵
        
        PID:6412
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2800 -s 216
        6⤵
        Program crash
        
        PID:3344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27136.exe
        5⤵
        
        PID:2984
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2984 -s 224
        6⤵
        Program crash
        
        PID:4372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46809.exe
        5⤵
        
        PID:3272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4701.exe
        5⤵
        
        PID:5484
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2180 -s 224
        5⤵
        
        PID:7056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38752.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38752.exe
      4⤵
      PID:1392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33437.exe
        5⤵
        
        PID:1608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8293.exe
        6⤵
        
        PID:6628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10893.exe
        6⤵
        
        PID:7968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33448.exe
        6⤵
        
        PID:7356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39892.exe
        5⤵
        
        PID:3180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22074.exe
        5⤵
        
        PID:6128
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1392 -s 228
        5⤵
        
        PID:6396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59403.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59403.exe
      4⤵
      PID:2508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31340.exe
        5⤵
        
        PID:7004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65063.exe
        5⤵
        
        PID:7480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23822.exe
        5⤵
        
        PID:9128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58808.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58808.exe
      4⤵
      PID:4168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19274.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19274.exe
      4⤵
      PID:6052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30570.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30570.exe
      4⤵
      PID:6448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37525.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37525.exe
      4⤵
      PID:7696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10966.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10966.exe
      4⤵
      PID:8564
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7739.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7739.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54103.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54103.exe
      4⤵
      PID:1856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30474.exe
        5⤵
        
        PID:3016
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3016 -s 224
        6⤵
        Program crash
        
        PID:4340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25481.exe
        5⤵
        
        PID:3588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-97.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-97.exe
        5⤵
        
        PID:5300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58189.exe
        5⤵
        
        PID:6928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59963.exe
        5⤵
        
        PID:8144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49748.exe
        5⤵
        
        PID:8284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61729.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61729.exe
      4⤵
      PID:3032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51263.exe
        5⤵
        
        PID:4916
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3032 -s 228
        5⤵
        
        PID:5624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2315.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2315.exe
      4⤵
      PID:3156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56398.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56398.exe
      4⤵
      PID:5576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24142.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24142.exe
      4⤵
      PID:7084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43427.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43427.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42502.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42502.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:8476
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61814.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61814.exe
    3⤵
    PID:3064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33162.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33162.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40755.exe
        5⤵
        
        PID:4200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45714.exe
        5⤵
        
        PID:6184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49709.exe
        5⤵
        
        PID:7632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47399.exe
        5⤵
        
        PID:7596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37588.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37588.exe
      4⤵
      PID:3520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50533.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50533.exe
      4⤵
      PID:5584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32808.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32808.exe
      4⤵
      PID:7100
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3064 -s 224
      4⤵
      PID:8176
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63043.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63043.exe
    3⤵
    PID:1272
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1272 -s 220
      4⤵
      Program crash
      PID:4836
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7676.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7676.exe
    3⤵
    PID:3968
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19804.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19804.exe
    3⤵
    PID:6092
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26105.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26105.exe
    3⤵
    PID:6480
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10659.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10659.exe
    3⤵
    PID:7704
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9831.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9831.exe
    3⤵
    PID:8584
- C:\Users\Admin\AppData\Local\Temp\Unicorn-45483.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-45483.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:1320
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31389.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31389.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54710.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54710.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61612.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19205.exe
        6⤵
        
        PID:2744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40863.exe
        7⤵
        
        PID:1496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36380.exe
        8⤵
        
        PID:4732
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1496 -s 248
        8⤵
        
        PID:5444
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2744 -s 248
        7⤵
        Program crash
        
        PID:3432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51641.exe
        6⤵
        
        PID:1208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9073.exe
        7⤵
        
        PID:4284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56134.exe
        7⤵
        
        PID:1064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54831.exe
        7⤵
        
        PID:7300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58369.exe
        7⤵
        
        PID:7472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34307.exe
        7⤵
        
        PID:8396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5776.exe
        6⤵
        
        PID:3600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6621.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57007.exe
        6⤵
        
        PID:7036
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1356 -s 248
        6⤵
        
        PID:7420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39686.exe
        5⤵
        
        PID:2912
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2912 -s 244
        6⤵
        Program crash
        
        PID:3660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46975.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30939.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57599.exe
        5⤵
        
        PID:4536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1532.exe
        5⤵
        
        PID:5996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35495.exe
        5⤵
        
        PID:7244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50234.exe
        5⤵
        
        PID:7380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13307.exe
        5⤵
        
        PID:8468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40786.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40786.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18969.exe
        5⤵
        
        PID:2256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3079.exe
        6⤵
        
        PID:3284
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2256 -s 248
        6⤵
        Program crash
        
        PID:5308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30219.exe
        5⤵
        
        PID:3524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58234.exe
        5⤵
        
        PID:2928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8137.exe
        5⤵
        
        PID:5820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46909.exe
        5⤵
        
        PID:7564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22198.exe
        5⤵
        
        PID:7956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11001.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11001.exe
      4⤵
      PID:3004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61875.exe
        5⤵
        
        PID:3468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51899.exe
        5⤵
        
        PID:5284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52324.exe
        5⤵
        
        PID:6892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3091.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-747.exe
        5⤵
        
        PID:8272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34143.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34143.exe
      4⤵
      PID:3760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47266.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47266.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48473.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48473.exe
      4⤵
      PID:5608
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2940 -s 224
      4⤵
      PID:7680
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10532.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10532.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35463.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35463.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57422.exe
        5⤵
        
        PID:2528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60282.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36330.exe
        6⤵
        
        PID:5032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51281.exe
        6⤵
        
        PID:6204
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2528 -s 248
        6⤵
        
        PID:7656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52622.exe
        5⤵
        
        PID:4064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14788.exe
        5⤵
        
        PID:5252
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1916 -s 248
        5⤵
        
        PID:6940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52632.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52632.exe
      4⤵
      PID:2768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37703.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53453.exe
        5⤵
        
        PID:4652
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2768 -s 224
        5⤵
        
        PID:5500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14276.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14276.exe
      4⤵
      PID:3864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3274.exe
        5⤵
        
        PID:8500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7516.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7516.exe
      4⤵
      PID:4280
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2540 -s 244
      4⤵
      PID:5552
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61813.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61813.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1676
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1676 -s 220
      4⤵
      Program crash
      PID:2336
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30017.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30017.exe
    3⤵
    PID:2216
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2216 -s 220
      4⤵
      Program crash
      PID:4844
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4128.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4128.exe
    3⤵
    PID:3992
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46298.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46298.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5328
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50054.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50054.exe
    3⤵
    PID:6868
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38962.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38962.exe
    3⤵
    PID:8124
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23612.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23612.exe
    3⤵
    PID:8328
- C:\Users\Admin\AppData\Local\Temp\Unicorn-55131.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-55131.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2376
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46926.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46926.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2406.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2406.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31927.exe
        5⤵
        
        PID:2700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52633.exe
        6⤵
        
        PID:4464
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2700 -s 248
        6⤵
        
        PID:5416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42009.exe
        5⤵
        
        PID:3384
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2952 -s 224
        5⤵
        Program crash
        
        PID:5316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10416.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10416.exe
      4⤵
      PID:672
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 672 -s 244
        5⤵
        Program crash
        
        PID:4876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6928.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6928.exe
      4⤵
      PID:4020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5962.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5962.exe
      4⤵
      PID:5292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49524.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49524.exe
      4⤵
      PID:6900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43427.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43427.exe
      4⤵
      PID:8188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50478.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50478.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:8340
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34237.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34237.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56623.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56623.exe
      4⤵
      PID:2600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17657.exe
        5⤵
        
        PID:4100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8339.exe
        5⤵
        
        PID:6076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49906.exe
        5⤵
        
        PID:6404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45660.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31966.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8592
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 880 -s 228
      4⤵
      Program crash
      PID:3472
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24151.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24151.exe
    3⤵
    PID:2004
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2004 -s 224
      4⤵
      Program crash
      PID:4884
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12793.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12793.exe
    3⤵
    PID:3980
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62834.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62834.exe
    3⤵
    PID:5348
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32988.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32988.exe
    3⤵
    PID:6908
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60493.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60493.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:7252
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28947.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28947.exe
    3⤵
    PID:8368
- C:\Users\Admin\AppData\Local\Temp\Unicorn-37604.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-37604.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2576
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2576 -s 220
    3⤵
    - Program crash
    PID:3056
- C:\Users\Admin\AppData\Local\Temp\Unicorn-20238.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-20238.exe
  2⤵
  PID:1748
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54672.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54672.exe
    3⤵
    PID:3212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-530.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-530.exe
      4⤵
      PID:6924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53294.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53294.exe
      4⤵
      PID:7816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7237.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7237.exe
      4⤵
      PID:9092
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56696.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56696.exe
    3⤵
    PID:4420
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1748 -s 224
    3⤵
    PID:5280
- C:\Users\Admin\AppData\Local\Temp\Unicorn-6869.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-6869.exe
  2⤵
  PID:3364
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6446.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6446.exe
    3⤵
    PID:7728
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21550.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21550.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6976
- C:\Users\Admin\AppData\Local\Temp\Unicorn-25535.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-25535.exe
  2⤵
  PID:4432
- C:\Users\Admin\AppData\Local\Temp\Unicorn-37979.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-37979.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5452
- C:\Users\Admin\AppData\Local\Temp\Unicorn-62771.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-62771.exe
  2⤵
  PID:6472
- C:\Users\Admin\AppData\Local\Temp\Unicorn-34459.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-34459.exe
  2⤵
  PID:7720
- C:\Users\Admin\AppData\Local\Temp\Unicorn-44832.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-44832.exe
  2⤵
  PID:8608

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-13490.exe

Filesize
468KB

MD5
8f82599b1626971b2ef4aec38efadf35

SHA1
cf0d9c7e104ae45bc319d4408d5e77461a1bd7e8

SHA256
68204ae24ed04720eca7eb2720a1cbb1ab726c22918eae9c174cb83658ef0af8

SHA512
9f5fa8b5daa8855d31327f8af07de667466b6cb7f7505c0ff0c0d92b1f55fac729b733a5898bc15491b44db8294d6c9bd7997bc694052fdd809da71625a1b886

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-28246.exe

Filesize
468KB

MD5
598e26a808c6aacd80fc4ce9f68fa651

SHA1
d168720b713a4ae2647662c73b5d20b46594a4f8

SHA256
9e82408762e57ed2552fdf60a3cf0e04986d2bddee7c6aad12abf4234af158db

SHA512
96583c797a1e24c1a4f4a3eb1464574f81f0294dcc7e11e5676f8487e3d03e746558c1620b6e99a59611cb720e49a2ef7848d980763ab361407475b8d8d408f8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-31612.exe

Filesize
468KB

MD5
c93c9b2db2e336b597d431a8daf0cad0

SHA1
476a1b39f3355d21d54869957464cb31a47c4c1d

SHA256
c6dee5251d9dacafa7addbc5f1be41a3276905cf8cce96ef8b29ad0c7075a8e9

SHA512
a3d1f5ae07160538c1b3f0b0a816959c0fd6f14354b21997bbbe3095baeba8e5b302a67a626cd5d508288f25a0eca3aa3f85fae4f8b65484ffe35edacb7f4209

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-34465.exe

Filesize
468KB

MD5
1ff0b27b6eedef90428df6bc48ecd2e2

SHA1
6151446ac197b943220fc5dce69de638b8b31cdf

SHA256
b43488daa3f5ebfea1d4378e29e236cf64fc427b4ea78b4dd4f3b265edef4f73

SHA512
a4830e4ce30efac5c5015924be9c0a054a102f298f8ac98dad0515c4a70912fa46ff4147dfadee792a738984f84b07693e7e4aa8a9bb9972ef2e07c000de6301

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39686.exe

Filesize
468KB

MD5
e4a7ab9c282cde745b449bf5e320bec5

SHA1
87cc75e212b20c8936607fe791b1b7b78b159720

SHA256
2adcec11fda023467a5a8cb075f0987db90e9d71cbadb6210bcf598c5e2bb9b4

SHA512
8026279ac03db98a352e30bedf2dcbc67a1e2c9fb40a3dce43b92a69a98ff9d242d24804aaebdb4b5cffdc27a3accc833d9bef5cffafad91da2cd5ed9f6e77d5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-41674.exe

Filesize
468KB

MD5
44e0a9add9207c21d97aeb22b6b37de0

SHA1
4eb9141f11aa4bc5292039b9318cffbbedd62bec

SHA256
aa37e5f3dd7778b7e889579e091f35533b40c9862c76366713cb4fbf11f65bf1

SHA512
2eed8089ff0a60c6ccbda2b76e53d6928657cb22ec164a1a4ef5bf6dd86602b248e75c89752e2062def227ebbfb5ddfb12990de9a9191c1f95a70969589c7efa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-52324.exe

Filesize
468KB

MD5
bb6310c417295872ff22c7b5ad7ee8b2

SHA1
ea31dd95aa03d08605baeaed588b8ad9594de057

SHA256
f5fa38eec8eed5b9389bc0ea5e38bdda1a29a1f41fbe1bdaa8d0f4966d7ebe97

SHA512
985124dc8935433d5bf590fa3438d81111c09884d308ab49502696380cb1217394d5f78ff1d714562227c7449c28647ece31c962151889491a7266a38b292197

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-56770.exe

Filesize
468KB

MD5
fe7203f2818591892109de1f188942bf

SHA1
17cc70f0efcc076747140ac507bedd8796bcc3fb

SHA256
476554db9aefc94f493aa8fc604d69b62f276de8b55444d49fc97a65863d66e2

SHA512
9455bf9b3040422bfffbd0f0ec237fc646b15c6daa90a6a0dfa52750215a91000114adee979dd13eb6773cccbe68d5f8724e1525b669b2a7e0276b240b7339ce

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-61814.exe

Filesize
468KB

MD5
69cf312267e038779467eab4cb38ce0a

SHA1
6039799e4a551b3e6193c80fd554e2306a020898

SHA256
a7b19dd16b947fc9a789532d8cf293b4433ad272b3d4077a1d4718bce459be1d

SHA512
e56a649bd3613cde4572c67c7c27909b604396e7879692fce8aba98e6e478bdf8eda648e8d2ce85cafe4ad915e3b7b729761fa9653756db02e2f72b3965abfdc

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-15244.exe

Filesize
468KB

MD5
cce63b75961cfcb5ba27aafb51c98365

SHA1
412544dd44b1d3bda92c8a054f27ac4571a41c04

SHA256
8c2cd5f7db911fa383c5df22dd2da8b5ee8eacb36aa0732550beb62eb3c2c275

SHA512
fc7448c4f1e7cff3bf41957f7afcabb61aff2839b902908f1261cfcf73ce77acc70734f78ce66494a7010d64c6314c18b4bf2f1b40ab5fb5dc2f7e15569cbc7d

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-21808.exe

Filesize
468KB

MD5
2034f3e6858bb73870bc7df7c0573b4a

SHA1
0ae9569a3310df30c14a4abfa1cde3dd65eba5ed

SHA256
a692139bb078c7f1977a17ef995c65042249ddc89bb22a19c1a1b460d182e68f

SHA512
1f69b58064dba8c1d510ae526b857c1657307aaea5535beee8b018c471e4cae2985c09966f8efd389a858544888211ab742545f2ed6a89e243d2590bb9089e57

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-28051.exe

Filesize
468KB

MD5
3620631cbe5063680f86e3c6252fe33f

SHA1
59598ebfffd51895666d06049fb2ba05fc360b9a

SHA256
a5d6ad2be318dd866de5bd64a33d1c8482485ecd113fa5d39c274090e239850b

SHA512
e5a2a384f27840a4b8459f8c9fe6a44be1ed39747dccaf73357de8b2d763ef671f0a9d301029ff2b016a9c592d2ba0b54f10ffc338322d2b50c268d4d82ae95c

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-31389.exe

Filesize
468KB

MD5
679fa6923cfcb39149d4a69269f01993

SHA1
6ed811e5eeaa46d0bfe81a29e7b7f5ad2b9b16d5

SHA256
8d850c852892deda1ec7ee1dd20762b2286bdd1c741f92ab0d11d8a51957d013

SHA512
86772f887fad75921fa5277b47301661788f5063fecf6f7fdb0db5bd67cf3aa995fff809cc25076a26567aef9ec64e6851adec45595a38f1e39a23c34a4cffd6

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-33649.exe

Filesize
468KB

MD5
5399e409d5b3fd5a25e143aecb7cc15b

SHA1
92cf8f3060253590c6b29d82ca63be148cf24756

SHA256
5e74557029c3a7ae6ac0b2b67a3f3c3b79252e27f201bedb7969bfa8891e0aef

SHA512
c39b43ae46eb641bf467e7bf6659a26238b9ebcad059f86e3ce6eb023fb8eea1b8e6b57a68092058dcb3a8d133bd905aeeb56c27e9548d45b43769f0981f761d

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-40033.exe

Filesize
468KB

MD5
702493436d56bae071e6cf9afee1c212

SHA1
ef2ae3075434b31ab0e2b4a20bee49ca6474e5c7

SHA256
a7565af52a82a6a89798d71cd7d5825f6a165f32278e1dd58f3f11b2c9fcf069

SHA512
6f3001748af20a69afc6d8eb7a03e618d66272a830f88ab5c420b9095f19f6fb93035f4a8727ff8cb95c1d8bfcec2e3e4232c782b35af920428461d0a6e81f37

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-41211.exe

Filesize
468KB

MD5
ec9f7bb7ad4d5e2b365f0337caf40648

SHA1
d3e238bf4c097df3003ca04a67fab5b17d217539

SHA256
05cb8c913f7ece3ce52fba0c3d711e5c1921e078bae476c202b445974207e65b

SHA512
3314a4f39503efe784e9459c9c851b33a59c2703ca6a94b42d864da9071b019e3d557bdb6cb3ae7645b6a52457e1673899db8c9017956481b84ad22a4c0723d9

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-45483.exe

Filesize
468KB

MD5
441190616ed1cfc06575f37e8afcf2cc

SHA1
5c1b5b442bf330ed149d7482603868eafe24ec57

SHA256
ef1ae8235300d326872d1a505f42b3c7213551abb03452413acaac115c4cbc01

SHA512
dd7bee11149e6b937270c2615baf1db99d7d76c8f071c4f205f0e51193beb2665d817ad80ea4e93402a17140d9609f6f9c6bee0e5e467131c3a0ef851d666777

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-51492.exe

Filesize
468KB

MD5
4d56962aa5f47aa4b5d4dc89369783a4

SHA1
c7f08e480798f4a01c99a77d1512c0ff98d01343

SHA256
80f2e6f976531c156235985c118df478c9d6ccc607df26f7f629ab8d746a5561

SHA512
f6606eb6e77d2d39b4bbc244b6fdd2fe0a203340d9603773e48331c80be464a61592631887dcf7e4fb7fb515bb7e22d110df47fd11cafc03159fddd67c54566e

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-56308.exe

Filesize
468KB

MD5
66257d83097c1102393aa9381ea5edd5

SHA1
30c97c3374bfbb20a177b9e1a9e224efd1368cc1

SHA256
bf1fa4959b63435838c37a61ff72e640e23bf27beaa5791d9d78b9f000f9266c

SHA512
646400c626b98d75a82af4d702ea86ee5b55be8ed5c30deba3a75de126286c995700642249a767d006b270a224b74e0dbf70781a33f01e43b58b6e2cbaadc306

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-60947.exe

Filesize
468KB

MD5
56023215bd1285c092d0faed2d37ae9d

SHA1
83b7227b5de5dea991b84dea1c0dab317a70f200

SHA256
12e7e1b1440f65820d7e28c50238e0f06b6ddbe0aaddae4b5804fd58d1396396

SHA512
51fa0326725ea96d54f2b7a734625288e709514ac1db523cfa5b74b0dea42f4a11cbebd0fea425489b46a666836840872c3e53ddc5d9993c4e8b84432cd1dbe4

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-7107.exe

Filesize
468KB

MD5
3fe0eace5b03ce003a1735702e561ab3

SHA1
1bfe6a48c971e1bdc28979e7409e5574d59a9016

SHA256
6c8fe8a674abea70a6a991591decdcdb28b454fe9e819e3fc0e7e94bd853cc39

SHA512
21dc9915ad971ce1d13f017a729c79a30d9188d1c87bba9970c1f1c54a64aa7ded3a75d374d97dedd0d6c90c76471e75484e95f6f37c68810803d997f5c88c42

Download Submit