ac07ff25b04eb7455f991e6c6aad8783e56af21172a69cfe474b8a601ad2918c

Analysis

max time kernel
119s
max time network
118s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
17/10/2024, 16:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ac07ff25b04eb7455f991e6c6aad8783e56af21172a69cfe474b8a601ad2918cN.exe
Size

468KB
MD5

1486754f2383dcaf4e4891f0c6156850
SHA1

843d37632b0b426f92d3aaae1c72c9b7db7cf274
SHA256

ac07ff25b04eb7455f991e6c6aad8783e56af21172a69cfe474b8a601ad2918c
SHA512

e4d9650f5508b30f837c15645a8b2a638f9fba534376d6a37ea25ff4b8f342116819fd7e2887bc5c8191536db2c7f69a40faa8ec6dabf667f114989c6cd6a8a0
SSDEEP

3072:1G3HogISIE5TtbY2HzcOcf8/zCc8P0pkJVHeTVPOQ6RLm7gguBlS:1G3obMTtxH4OcfHY1gQ6NUggu

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2772	Unicorn-39662.exe
2716	Unicorn-20154.exe
2592	Unicorn-35936.exe
2552	Unicorn-14000.exe
2676	Unicorn-16230.exe
3032	Unicorn-26445.exe
1116	Unicorn-31083.exe
1452	Unicorn-54322.exe
2856	Unicorn-55069.exe
2616	Unicorn-42262.exe
544	Unicorn-43886.exe
2880	Unicorn-63751.exe
2652	Unicorn-56552.exe
3056	Unicorn-62682.exe
1528	Unicorn-52002.exe
2272	Unicorn-46512.exe
1924	Unicorn-47067.exe
3044	Unicorn-17924.exe
2868	Unicorn-11793.exe
940	Unicorn-2511.exe
908	Unicorn-49666.exe
1756	Unicorn-6787.exe
1540	Unicorn-3258.exe
3060	Unicorn-23124.exe
1820	Unicorn-27208.exe
2124	Unicorn-31270.exe
2384	Unicorn-50871.exe
2104	Unicorn-43714.exe
2076	Unicorn-62818.exe
2700	Unicorn-8816.exe
1960	Unicorn-51364.exe
1588	Unicorn-18137.exe
2776	Unicorn-18137.exe
2224	Unicorn-32426.exe
2580	Unicorn-39303.exe
2808	Unicorn-59169.exe
2560	Unicorn-9703.exe
2800	Unicorn-14052.exe
2388	Unicorn-18883.exe
1484	Unicorn-46917.exe
2052	Unicorn-50980.exe
2220	Unicorn-17753.exe
2440	Unicorn-1151.exe
1112	Unicorn-5500.exe
872	Unicorn-38365.exe
1084	Unicorn-38365.exe
2848	Unicorn-18499.exe
1336	Unicorn-39879.exe
604	Unicorn-330.exe
1664	Unicorn-18905.exe
2180	Unicorn-39432.exe
2140	Unicorn-64898.exe
828	Unicorn-16466.exe
1872	Unicorn-6251.exe
2928	Unicorn-35031.exe
788	Unicorn-41162.exe
1612	Unicorn-3643.exe
2128	Unicorn-42484.exe
1380	Unicorn-58266.exe
2320	Unicorn-19463.exe
2092	Unicorn-8681.exe
844	Unicorn-49449.exe
2096	Unicorn-53798.exe
2380	Unicorn-57882.exe

Loads dropped DLL 64 IoCs

pid	Process
2420	ac07ff25b04eb7455f991e6c6aad8783e56af21172a69cfe474b8a601ad2918cN.exe
2420	ac07ff25b04eb7455f991e6c6aad8783e56af21172a69cfe474b8a601ad2918cN.exe
2420	ac07ff25b04eb7455f991e6c6aad8783e56af21172a69cfe474b8a601ad2918cN.exe
2772	Unicorn-39662.exe
2420	ac07ff25b04eb7455f991e6c6aad8783e56af21172a69cfe474b8a601ad2918cN.exe
2772	Unicorn-39662.exe
2716	Unicorn-20154.exe
2716	Unicorn-20154.exe
2420	ac07ff25b04eb7455f991e6c6aad8783e56af21172a69cfe474b8a601ad2918cN.exe
2420	ac07ff25b04eb7455f991e6c6aad8783e56af21172a69cfe474b8a601ad2918cN.exe
2592	Unicorn-35936.exe
2592	Unicorn-35936.exe
2772	Unicorn-39662.exe
2772	Unicorn-39662.exe
2552	Unicorn-14000.exe
2552	Unicorn-14000.exe
2716	Unicorn-20154.exe
2716	Unicorn-20154.exe
3032	Unicorn-26445.exe
3032	Unicorn-26445.exe
1116	Unicorn-31083.exe
2592	Unicorn-35936.exe
2592	Unicorn-35936.exe
1116	Unicorn-31083.exe
2772	Unicorn-39662.exe
2676	Unicorn-16230.exe
2772	Unicorn-39662.exe
2676	Unicorn-16230.exe
2420	ac07ff25b04eb7455f991e6c6aad8783e56af21172a69cfe474b8a601ad2918cN.exe
2420	ac07ff25b04eb7455f991e6c6aad8783e56af21172a69cfe474b8a601ad2918cN.exe
1452	Unicorn-54322.exe
1452	Unicorn-54322.exe
2552	Unicorn-14000.exe
2552	Unicorn-14000.exe
2856	Unicorn-55069.exe
2716	Unicorn-20154.exe
2856	Unicorn-55069.exe
2716	Unicorn-20154.exe
544	Unicorn-43886.exe
544	Unicorn-43886.exe
2592	Unicorn-35936.exe
2592	Unicorn-35936.exe
2616	Unicorn-42262.exe
2616	Unicorn-42262.exe
3032	Unicorn-26445.exe
2880	Unicorn-63751.exe
3032	Unicorn-26445.exe
2880	Unicorn-63751.exe
1420	WerFault.exe
1420	WerFault.exe
1420	WerFault.exe
1420	WerFault.exe
1528	Unicorn-52002.exe
1528	Unicorn-52002.exe
1868	WerFault.exe
1868	WerFault.exe
1868	WerFault.exe
1868	WerFault.exe
1116	Unicorn-31083.exe
1116	Unicorn-31083.exe
2772	Unicorn-39662.exe
2772	Unicorn-39662.exe
2676	Unicorn-16230.exe
2676	Unicorn-16230.exe

Program crash 64 IoCs

pid	pid_target	Process	procid_target
1420	2652	WerFault.exe	42
1868	3056	WerFault.exe	43
2444	1540	WerFault.exe	53
960	1588	WerFault.exe	63
2268	2848	WerFault.exe	76
296	2928	WerFault.exe	87
2524	2936	WerFault.exe	114
2588	3032	WerFault.exe	35
2844	1592	WerFault.exe	98
3000	3016	WerFault.exe	112
2296	2124	WerFault.exe	57
1972	2820	WerFault.exe	99
2708	2556	WerFault.exe	101
1660	872	WerFault.exe	77
1880	2580	WerFault.exe	66
3108	2876	WerFault.exe	100
3116	2644	WerFault.exe	107
3124	2536	WerFault.exe	106
3504	572	WerFault.exe	110
3624	2140	WerFault.exe	84
3728	1952	WerFault.exe	124
3720	1584	WerFault.exe	125
3832	2096	WerFault.exe	96
3488	1336	WerFault.exe	80
3900	1456	WerFault.exe	103
3960	1596	WerFault.exe	92
2252	2612	WerFault.exe	126
3660	3020	WerFault.exe	150
3644	1872	WerFault.exe	86
3652	2320	WerFault.exe	93
4028	940	WerFault.exe	49
3320	328	WerFault.exe	139
3148	2104	WerFault.exe	59
3256	2224	WerFault.exe	65
4916	2892	WerFault.exe	157
5072	1492	WerFault.exe	113
5080	788	WerFault.exe	88
5064	2220	WerFault.exe	73
5088	2388	WerFault.exe	70
5096	2808	WerFault.exe	67
4020	1924	WerFault.exe	46
4108	1056	WerFault.exe	117
4124	1896	WerFault.exe	104
4132	2304	WerFault.exe	142
4148	2628	WerFault.exe	102
3516	2196	WerFault.exe	143
3532	2360	WerFault.exe	121
4160	2200	WerFault.exe	118
4240	1900	WerFault.exe	160
4408	2292	WerFault.exe	119
4524	1148	WerFault.exe	137
4484	3064	WerFault.exe	176
4376	2040	WerFault.exe	111
4672	2880	WerFault.exe	40
4548	2440	WerFault.exe	74
4532	2052	WerFault.exe	72
4684	2132	WerFault.exe	132
4736	2856	WerFault.exe	38
4328	2180	WerFault.exe	83
4464	1380	WerFault.exe	91
4508	1928	WerFault.exe	155
4248	2468	WerFault.exe	109
5128	2076	WerFault.exe	60
4268	1960	WerFault.exe	62

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48775.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52131.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64886.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43020.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28607.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22664.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43242.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44611.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62370.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7654.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13388.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52255.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27208.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50871.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16525.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8824.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26184.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35290.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53668.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11143.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19861.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23219.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23917.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62350.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24249.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21256.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13895.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21674.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41093.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28386.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37508.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11456.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28607.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41430.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5905.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31270.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-330.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11115.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39472.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49550.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8602.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51115.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22246.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28607.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39607.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44346.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17975.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56552.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17551.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54377.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19537.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19792.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21129.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56325.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35324.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62682.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34855.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28607.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16743.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7365.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42941.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37132.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27546.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53567.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2420	ac07ff25b04eb7455f991e6c6aad8783e56af21172a69cfe474b8a601ad2918cN.exe
2772	Unicorn-39662.exe
2716	Unicorn-20154.exe
2592	Unicorn-35936.exe
2552	Unicorn-14000.exe
2676	Unicorn-16230.exe
3032	Unicorn-26445.exe
1116	Unicorn-31083.exe
1452	Unicorn-54322.exe
2856	Unicorn-55069.exe
544	Unicorn-43886.exe
2616	Unicorn-42262.exe
3056	Unicorn-62682.exe
1528	Unicorn-52002.exe
2880	Unicorn-63751.exe
2652	Unicorn-56552.exe
2272	Unicorn-46512.exe
2868	Unicorn-11793.exe
3044	Unicorn-17924.exe
1924	Unicorn-47067.exe
940	Unicorn-2511.exe
908	Unicorn-49666.exe
1756	Unicorn-6787.exe
3060	Unicorn-23124.exe
1820	Unicorn-27208.exe
1540	Unicorn-3258.exe
2384	Unicorn-50871.exe
2124	Unicorn-31270.exe
2104	Unicorn-43714.exe
2076	Unicorn-62818.exe
2700	Unicorn-8816.exe
2776	Unicorn-18137.exe
1588	Unicorn-18137.exe
2224	Unicorn-32426.exe
2580	Unicorn-39303.exe
2808	Unicorn-59169.exe
2560	Unicorn-9703.exe
2800	Unicorn-14052.exe
2388	Unicorn-18883.exe
1484	Unicorn-46917.exe
2052	Unicorn-50980.exe
2220	Unicorn-17753.exe
2440	Unicorn-1151.exe
1112	Unicorn-5500.exe
872	Unicorn-38365.exe
2848	Unicorn-18499.exe
1336	Unicorn-39879.exe
604	Unicorn-330.exe
1664	Unicorn-18905.exe
2180	Unicorn-39432.exe
2140	Unicorn-64898.exe
828	Unicorn-16466.exe
1872	Unicorn-6251.exe
2928	Unicorn-35031.exe
788	Unicorn-41162.exe
1612	Unicorn-3643.exe
2128	Unicorn-42484.exe
1380	Unicorn-58266.exe
1596	Unicorn-62350.exe
2320	Unicorn-19463.exe
2092	Unicorn-8681.exe
844	Unicorn-49449.exe
2096	Unicorn-53798.exe
2380	Unicorn-57882.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2420 wrote to memory of 2772	2420	ac07ff25b04eb7455f991e6c6aad8783e56af21172a69cfe474b8a601ad2918cN.exe	30
PID 2420 wrote to memory of 2772	2420	ac07ff25b04eb7455f991e6c6aad8783e56af21172a69cfe474b8a601ad2918cN.exe	30
PID 2420 wrote to memory of 2772	2420	ac07ff25b04eb7455f991e6c6aad8783e56af21172a69cfe474b8a601ad2918cN.exe	30
PID 2420 wrote to memory of 2772	2420	ac07ff25b04eb7455f991e6c6aad8783e56af21172a69cfe474b8a601ad2918cN.exe	30
PID 2420 wrote to memory of 2716	2420	ac07ff25b04eb7455f991e6c6aad8783e56af21172a69cfe474b8a601ad2918cN.exe	31
PID 2420 wrote to memory of 2716	2420	ac07ff25b04eb7455f991e6c6aad8783e56af21172a69cfe474b8a601ad2918cN.exe	31
PID 2420 wrote to memory of 2716	2420	ac07ff25b04eb7455f991e6c6aad8783e56af21172a69cfe474b8a601ad2918cN.exe	31
PID 2420 wrote to memory of 2716	2420	ac07ff25b04eb7455f991e6c6aad8783e56af21172a69cfe474b8a601ad2918cN.exe	31
PID 2772 wrote to memory of 2592	2772	Unicorn-39662.exe	32
PID 2772 wrote to memory of 2592	2772	Unicorn-39662.exe	32
PID 2772 wrote to memory of 2592	2772	Unicorn-39662.exe	32
PID 2772 wrote to memory of 2592	2772	Unicorn-39662.exe	32
PID 2716 wrote to memory of 2552	2716	Unicorn-20154.exe	33
PID 2716 wrote to memory of 2552	2716	Unicorn-20154.exe	33
PID 2716 wrote to memory of 2552	2716	Unicorn-20154.exe	33
PID 2716 wrote to memory of 2552	2716	Unicorn-20154.exe	33
PID 2420 wrote to memory of 2676	2420	ac07ff25b04eb7455f991e6c6aad8783e56af21172a69cfe474b8a601ad2918cN.exe	34
PID 2420 wrote to memory of 2676	2420	ac07ff25b04eb7455f991e6c6aad8783e56af21172a69cfe474b8a601ad2918cN.exe	34
PID 2420 wrote to memory of 2676	2420	ac07ff25b04eb7455f991e6c6aad8783e56af21172a69cfe474b8a601ad2918cN.exe	34
PID 2420 wrote to memory of 2676	2420	ac07ff25b04eb7455f991e6c6aad8783e56af21172a69cfe474b8a601ad2918cN.exe	34
PID 2592 wrote to memory of 3032	2592	Unicorn-35936.exe	35
PID 2592 wrote to memory of 3032	2592	Unicorn-35936.exe	35
PID 2592 wrote to memory of 3032	2592	Unicorn-35936.exe	35
PID 2592 wrote to memory of 3032	2592	Unicorn-35936.exe	35
PID 2772 wrote to memory of 1116	2772	Unicorn-39662.exe	36
PID 2772 wrote to memory of 1116	2772	Unicorn-39662.exe	36
PID 2772 wrote to memory of 1116	2772	Unicorn-39662.exe	36
PID 2772 wrote to memory of 1116	2772	Unicorn-39662.exe	36
PID 2552 wrote to memory of 1452	2552	Unicorn-14000.exe	37
PID 2552 wrote to memory of 1452	2552	Unicorn-14000.exe	37
PID 2552 wrote to memory of 1452	2552	Unicorn-14000.exe	37
PID 2552 wrote to memory of 1452	2552	Unicorn-14000.exe	37
PID 2716 wrote to memory of 2856	2716	Unicorn-20154.exe	38
PID 2716 wrote to memory of 2856	2716	Unicorn-20154.exe	38
PID 2716 wrote to memory of 2856	2716	Unicorn-20154.exe	38
PID 2716 wrote to memory of 2856	2716	Unicorn-20154.exe	38
PID 3032 wrote to memory of 2616	3032	Unicorn-26445.exe	39
PID 3032 wrote to memory of 2616	3032	Unicorn-26445.exe	39
PID 3032 wrote to memory of 2616	3032	Unicorn-26445.exe	39
PID 3032 wrote to memory of 2616	3032	Unicorn-26445.exe	39
PID 2592 wrote to memory of 544	2592	Unicorn-35936.exe	41
PID 2592 wrote to memory of 544	2592	Unicorn-35936.exe	41
PID 2592 wrote to memory of 544	2592	Unicorn-35936.exe	41
PID 2592 wrote to memory of 544	2592	Unicorn-35936.exe	41
PID 1116 wrote to memory of 2880	1116	Unicorn-31083.exe	40
PID 1116 wrote to memory of 2880	1116	Unicorn-31083.exe	40
PID 1116 wrote to memory of 2880	1116	Unicorn-31083.exe	40
PID 1116 wrote to memory of 2880	1116	Unicorn-31083.exe	40
PID 2772 wrote to memory of 2652	2772	Unicorn-39662.exe	42
PID 2772 wrote to memory of 2652	2772	Unicorn-39662.exe	42
PID 2772 wrote to memory of 2652	2772	Unicorn-39662.exe	42
PID 2772 wrote to memory of 2652	2772	Unicorn-39662.exe	42
PID 2676 wrote to memory of 3056	2676	Unicorn-16230.exe	43
PID 2676 wrote to memory of 3056	2676	Unicorn-16230.exe	43
PID 2676 wrote to memory of 3056	2676	Unicorn-16230.exe	43
PID 2676 wrote to memory of 3056	2676	Unicorn-16230.exe	43
PID 2420 wrote to memory of 1528	2420	ac07ff25b04eb7455f991e6c6aad8783e56af21172a69cfe474b8a601ad2918cN.exe	44
PID 2420 wrote to memory of 1528	2420	ac07ff25b04eb7455f991e6c6aad8783e56af21172a69cfe474b8a601ad2918cN.exe	44
PID 2420 wrote to memory of 1528	2420	ac07ff25b04eb7455f991e6c6aad8783e56af21172a69cfe474b8a601ad2918cN.exe	44
PID 2420 wrote to memory of 1528	2420	ac07ff25b04eb7455f991e6c6aad8783e56af21172a69cfe474b8a601ad2918cN.exe	44
PID 1452 wrote to memory of 2272	1452	Unicorn-54322.exe	45
PID 1452 wrote to memory of 2272	1452	Unicorn-54322.exe	45
PID 1452 wrote to memory of 2272	1452	Unicorn-54322.exe	45
PID 1452 wrote to memory of 2272	1452	Unicorn-54322.exe	45

C:\Users\Admin\AppData\Local\Temp\ac07ff25b04eb7455f991e6c6aad8783e56af21172a69cfe474b8a601ad2918cN.exe
"C:\Users\Admin\AppData\Local\Temp\ac07ff25b04eb7455f991e6c6aad8783e56af21172a69cfe474b8a601ad2918cN.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2420
- C:\Users\Admin\AppData\Local\Temp\Unicorn-39662.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-39662.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2772
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35936.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35936.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26445.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26445.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42262.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:2616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6787.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46917.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56751.exe
        8⤵
        
        PID:3016
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3016 -s 244
        9⤵
        Program crash
        
        PID:3000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33024.exe
        8⤵
        
        PID:1216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63988.exe
        9⤵
        
        PID:4984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32519.exe
        9⤵
        
        PID:5572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39374.exe
        9⤵
        
        PID:6928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50465.exe
        9⤵
        
        PID:7416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38186.exe
        9⤵
        
        PID:8332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7458.exe
        8⤵
        
        PID:3528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1637.exe
        8⤵
        
        PID:5864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63927.exe
        8⤵
        
        PID:6956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39789.exe
        8⤵
        
        PID:7532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25169.exe
        8⤵
        
        PID:7648
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1484 -s 248
        8⤵
        
        PID:8888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-129.exe
        7⤵
        
        PID:1492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23726.exe
        8⤵
        
        PID:2672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41920.exe
        9⤵
        
        PID:3396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62515.exe
        10⤵
        
        PID:7792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43586.exe
        10⤵
        
        PID:7452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24745.exe
        9⤵
        
        PID:5104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6566.exe
        9⤵
        
        PID:5936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41430.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:7072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53668.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:7580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12906.exe
        9⤵
        
        PID:8460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22246.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53662.exe
        9⤵
        
        PID:7276
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3464 -s 228
        9⤵
        
        PID:8268
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1492 -s 244
        8⤵
        Program crash
        
        PID:5072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35240.exe
        7⤵
        
        PID:2264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29017.exe
        8⤵
        
        PID:4448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10101.exe
        8⤵
        
        PID:6464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15658.exe
        8⤵
        
        PID:6752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28203.exe
        8⤵
        
        PID:7768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12690.exe
        8⤵
        
        PID:8288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12939.exe
        7⤵
        
        PID:4272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42941.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5783.exe
        7⤵
        
        PID:7128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7654.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24058.exe
        7⤵
        
        PID:7724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64886.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50980.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13855.exe
        7⤵
        
        PID:2132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44559.exe
        8⤵
        
        PID:3716
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2132 -s 248
        8⤵
        Program crash
        
        PID:4684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16525.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3696
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2052 -s 244
        7⤵
        Program crash
        
        PID:4532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21129.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28607.exe
        7⤵
        
        PID:4048
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 876 -s 228
        7⤵
        
        PID:5168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28342.exe
        6⤵
        
        PID:3928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24746.exe
        6⤵
        
        PID:5008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24921.exe
        6⤵
        
        PID:6416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13388.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64074.exe
        6⤵
        
        PID:7760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51891.exe
        6⤵
        
        PID:8200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3258.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38365.exe
        6⤵
        Executes dropped EXE
        
        PID:1084
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1540 -s 236
        6⤵
        Program crash
        
        PID:2444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-330.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7524.exe
        6⤵
        
        PID:2196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1079.exe
        7⤵
        
        PID:3412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57855.exe
        8⤵
        
        PID:7884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27250.exe
        8⤵
        
        PID:8252
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2196 -s 228
        7⤵
        Program crash
        
        PID:3516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39734.exe
        6⤵
        
        PID:3580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26994.exe
        7⤵
        
        PID:7836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48439.exe
        7⤵
        
        PID:8668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38481.exe
        6⤵
        
        PID:5056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12431.exe
        6⤵
        
        PID:2244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32764.exe
        6⤵
        
        PID:7080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37132.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29972.exe
        6⤵
        
        PID:8468
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3032 -s 236
        5⤵
        Program crash
        
        PID:2588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43886.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43886.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2511.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14052.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53798.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9195.exe
        8⤵
        
        PID:1584
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1584 -s 220
        9⤵
        Program crash
        
        PID:3720
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2096 -s 236
        8⤵
        Program crash
        
        PID:3832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6818.exe
        7⤵
        
        PID:2612
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2612 -s 244
        8⤵
        Program crash
        
        PID:2252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15727.exe
        7⤵
        
        PID:3352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29405.exe
        8⤵
        
        PID:8568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36344.exe
        7⤵
        
        PID:4700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8509.exe
        7⤵
        
        PID:6200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54377.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20067.exe
        7⤵
        
        PID:7744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57226.exe
        7⤵
        
        PID:8228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14581.exe
        6⤵
        
        PID:1592
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1592 -s 240
        7⤵
        Program crash
        
        PID:2844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30423.exe
        6⤵
        
        PID:864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1227.exe
        7⤵
        
        PID:4856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12161.exe
        7⤵
        
        PID:5464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46499.exe
        7⤵
        
        PID:6480
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 864 -s 216
        7⤵
        
        PID:8032
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 940 -s 236
        6⤵
        Program crash
        
        PID:4028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18883.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51935.exe
        6⤵
        
        PID:2876
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2876 -s 224
        7⤵
        Program crash
        
        PID:3108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43242.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32967.exe
        7⤵
        
        PID:7476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13620.exe
        7⤵
        
        PID:8128
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3336 -s 224
        7⤵
        
        PID:9032
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2388 -s 244
        6⤵
        Program crash
        
        PID:5088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45997.exe
        5⤵
        
        PID:1456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11115.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28607.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4080
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2940 -s 228
        7⤵
        
        PID:5200
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1456 -s 248
        6⤵
        Program crash
        
        PID:3900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51115.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44914.exe
        6⤵
        
        PID:1652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13863.exe
        7⤵
        
        PID:4692
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1652 -s 228
        7⤵
        
        PID:6120
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 328 -s 236
        6⤵
        Program crash
        
        PID:3320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51744.exe
        5⤵
        
        PID:3064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15779.exe
        6⤵
        
        PID:3244
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3064 -s 236
        6⤵
        Program crash
        
        PID:4484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3141.exe
        5⤵
        
        PID:3952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5095.exe
        5⤵
        
        PID:5268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45235.exe
        5⤵
        
        PID:6684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10254.exe
        5⤵
        
        PID:7292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18756.exe
        5⤵
        
        PID:8152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41350.exe
        5⤵
        
        PID:8908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49666.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49666.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17753.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55635.exe
        6⤵
        
        PID:2644
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2644 -s 224
        7⤵
        Program crash
        
        PID:3116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38006.exe
        6⤵
        
        PID:3088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43444.exe
        7⤵
        
        PID:6304
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3088 -s 228
        7⤵
        
        PID:7368
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2220 -s 244
        6⤵
        Program crash
        
        PID:5064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35961.exe
        5⤵
        
        PID:2468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13720.exe
        6⤵
        
        PID:1412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14055.exe
        7⤵
        
        PID:4784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20137.exe
        7⤵
        
        PID:6104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17142.exe
        7⤵
        
        PID:6248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29085.exe
        7⤵
        
        PID:8040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38186.exe
        7⤵
        
        PID:8340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1232.exe
        6⤵
        
        PID:3676
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2468 -s 244
        6⤵
        Program crash
        
        PID:4248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52131.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2892
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2892 -s 224
        6⤵
        Program crash
        
        PID:4916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21408.exe
        5⤵
        
        PID:4008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1441.exe
        5⤵
        
        PID:5620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58793.exe
        5⤵
        
        PID:6800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37120.exe
        5⤵
        
        PID:7300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19891.exe
        5⤵
        
        PID:7560
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 908 -s 244
        5⤵
        
        PID:9072
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1151.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1151.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30768.exe
        5⤵
        
        PID:2632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28607.exe
        6⤵
        
        PID:3096
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2632 -s 248
        6⤵
        
        PID:5176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14436.exe
        5⤵
        
        PID:3472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22664.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8696
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2440 -s 224
        5⤵
        Program crash
        
        PID:4548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50042.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50042.exe
      4⤵
      PID:2916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28607.exe
        5⤵
        
        PID:4056
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2916 -s 248
        5⤵
        
        PID:5232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64018.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64018.exe
      4⤵
      PID:3600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28209.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28209.exe
      4⤵
      PID:4592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53045.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53045.exe
      4⤵
      PID:6272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44576.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44576.exe
      4⤵
      PID:7144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62939.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62939.exe
      4⤵
      PID:7832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28356.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28356.exe
      4⤵
      PID:8208
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31083.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31083.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63751.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63751.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23124.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38365.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2926.exe
        7⤵
        
        PID:1896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61188.exe
        8⤵
        
        PID:2056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11456.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:6336
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2056 -s 228
        9⤵
        
        PID:7584
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1896 -s 248
        8⤵
        Program crash
        
        PID:4124
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 872 -s 236
        7⤵
        Program crash
        
        PID:1660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52106.exe
        6⤵
        
        PID:1860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42631.exe
        7⤵
        
        PID:2564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41093.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62670.exe
        8⤵
        
        PID:7028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27687.exe
        8⤵
        
        PID:7544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26431.exe
        8⤵
        
        PID:8420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2467.exe
        7⤵
        
        PID:4312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25704.exe
        7⤵
        
        PID:6056
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1860 -s 248
        7⤵
        
        PID:1364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34855.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31726.exe
        7⤵
        
        PID:5988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21554.exe
        7⤵
        
        PID:6864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44600.exe
        7⤵
        
        PID:7436
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 548 -s 228
        7⤵
        
        PID:8324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55124.exe
        6⤵
        
        PID:4456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31072.exe
        6⤵
        
        PID:5288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63344.exe
        6⤵
        
        PID:6188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20949.exe
        6⤵
        
        PID:8064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17185.exe
        6⤵
        
        PID:8348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39879.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43020.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28607.exe
        7⤵
        
        PID:2328
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2544 -s 228
        7⤵
        
        PID:5208
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1336 -s 248
        6⤵
        Program crash
        
        PID:3488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52842.exe
        5⤵
        
        PID:2924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28607.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4064
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2924 -s 228
        6⤵
        
        PID:5192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23682.exe
        5⤵
        
        PID:3604
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2880 -s 224
        5⤵
        Program crash
        
        PID:4672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31270.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31270.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64898.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6626.exe
        6⤵
        
        PID:572
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 572 -s 224
        7⤵
        Program crash
        
        PID:3504
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2140 -s 236
        6⤵
        Program crash
        
        PID:3624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4021.exe
        5⤵
        
        PID:2040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20026.exe
        6⤵
        
        PID:1760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24489.exe
        7⤵
        
        PID:3976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40803.exe
        8⤵
        
        PID:7872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1755.exe
        8⤵
        
        PID:8368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54761.exe
        7⤵
        
        PID:4204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65170.exe
        7⤵
        
        PID:6000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18124.exe
        7⤵
        
        PID:6880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59179.exe
        7⤵
        
        PID:7356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26585.exe
        7⤵
        
        PID:8944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5583.exe
        6⤵
        
        PID:3192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61773.exe
        7⤵
        
        PID:7956
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3192 -s 228
        7⤵
        
        PID:9052
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2040 -s 244
        6⤵
        Program crash
        
        PID:4376
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2124 -s 244
        5⤵
        Program crash
        
        PID:2296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6251.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6251.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37649.exe
        5⤵
        
        PID:1928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33350.exe
        6⤵
        
        PID:3996
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1928 -s 236
        6⤵
        Program crash
        
        PID:4508
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1872 -s 228
        5⤵
        Program crash
        
        PID:3644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39797.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39797.exe
      4⤵
      PID:236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34476.exe
        5⤵
        
        PID:4724
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 236 -s 248
        5⤵
        
        PID:6128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4658.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4658.exe
      4⤵
      PID:3496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41973.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41973.exe
      4⤵
      PID:5856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64457.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64457.exe
      4⤵
      PID:6984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35324.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35324.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19792.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19792.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3549.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3549.exe
      4⤵
      PID:9108
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56552.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56552.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2652
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2652 -s 220
      4⤵
      Loads dropped DLL
      Program crash
      PID:1420
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50871.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50871.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41162.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41162.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40197.exe
        5⤵
        
        PID:2304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42112.exe
        6⤵
        
        PID:3480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17975.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27250.exe
        7⤵
        
        PID:8240
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2304 -s 248
        6⤵
        Program crash
        
        PID:4132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60155.exe
        5⤵
        
        PID:3636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43029.exe
        6⤵
        
        PID:7984
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3636 -s 228
        6⤵
        
        PID:8732
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 788 -s 224
        5⤵
        Program crash
        
        PID:5080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33543.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33543.exe
      4⤵
      PID:1520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56894.exe
        5⤵
        
        PID:3632
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1520 -s 228
        5⤵
        
        PID:5248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9923.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9923.exe
      4⤵
      PID:3948
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2384 -s 248
      4⤵
      PID:4628
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3643.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3643.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12594.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12594.exe
      4⤵
      PID:2200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59792.exe
        5⤵
        
        PID:3740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23917.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3597.exe
        6⤵
        
        PID:9000
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2200 -s 228
        5⤵
        Program crash
        
        PID:4160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11639.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11639.exe
      4⤵
      PID:3844
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3844 -s 224
        5⤵
        
        PID:8112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38673.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38673.exe
      4⤵
      PID:4296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21642.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21642.exe
      4⤵
      PID:5372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58468.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58468.exe
      4⤵
      PID:6724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49550.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49550.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:8188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39567.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39567.exe
      4⤵
      PID:8852
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61327.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61327.exe
    3⤵
    PID:2360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22652.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22652.exe
      4⤵
      PID:3536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16906.exe
        5⤵
        
        PID:7372
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3536 -s 216
        5⤵
        
        PID:8232
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2360 -s 248
      4⤵
      Program crash
      PID:3532
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38948.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38948.exe
    3⤵
    PID:3684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13864.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13864.exe
      4⤵
      PID:8096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47754.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47754.exe
      4⤵
      PID:8724
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14680.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14680.exe
    3⤵
    PID:5112
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42967.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42967.exe
    3⤵
    PID:5264
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10629.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10629.exe
    3⤵
    PID:7120
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7880.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7880.exe
    3⤵
    PID:7728
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26906.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26906.exe
    3⤵
    PID:8476
- C:\Users\Admin\AppData\Local\Temp\Unicorn-20154.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-20154.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2716
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14000.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14000.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54322.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54322.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46512.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8816.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58266.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54561.exe
        8⤵
        
        PID:2340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45794.exe
        9⤵
        
        PID:3920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59167.exe
        9⤵
        
        PID:5184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3499.exe
        9⤵
        
        PID:6648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45255.exe
        9⤵
        
        PID:7328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40892.exe
        9⤵
        
        PID:7344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9149.exe
        9⤵
        
        PID:8956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33136.exe
        8⤵
        
        PID:3552
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1380 -s 244
        8⤵
        Program crash
        
        PID:4464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17783.exe
        7⤵
        
        PID:2284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2343.exe
        8⤵
        
        PID:4944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8160.exe
        8⤵
        
        PID:5356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35290.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6836
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2284 -s 228
        8⤵
        
        PID:7424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39664.exe
        7⤵
        
        PID:3524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13230.exe
        7⤵
        
        PID:4200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-699.exe
        7⤵
        
        PID:6640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20054.exe
        7⤵
        
        PID:7232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41422.exe
        7⤵
        
        PID:8108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4684.exe
        7⤵
        
        PID:8872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42484.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38910.exe
        7⤵
        
        PID:2108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36059.exe
        8⤵
        
        PID:4640
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2108 -s 216
        8⤵
        
        PID:2300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22311.exe
        7⤵
        
        PID:3408
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2128 -s 224
        7⤵
        
        PID:5904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13895.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44611.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62452.exe
        7⤵
        
        PID:5552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35565.exe
        7⤵
        
        PID:7056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62333.exe
        7⤵
        
        PID:7628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29441.exe
        7⤵
        
        PID:8512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13323.exe
        6⤵
        
        PID:3548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58509.exe
        6⤵
        
        PID:5888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47391.exe
        6⤵
        
        PID:6968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56855.exe
        6⤵
        
        PID:7596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3638.exe
        6⤵
        
        PID:7808
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2272 -s 244
        6⤵
        
        PID:8900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51364.exe
        5⤵
        Executes dropped EXE
        
        PID:1960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62350.exe
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27260.exe
        7⤵
        
        PID:2944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16355.exe
        8⤵
        
        PID:3236
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2944 -s 248
        8⤵
        
        PID:5216
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1596 -s 248
        7⤵
        Program crash
        
        PID:3960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48427.exe
        6⤵
        
        PID:2160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28607.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59167.exe
        7⤵
        
        PID:5136
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2160 -s 244
        7⤵
        
        PID:6676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22476.exe
        6⤵
        
        PID:4032
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1960 -s 248
        6⤵
        Program crash
        
        PID:4268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19463.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21256.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28386.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65062.exe
        8⤵
        
        PID:3712
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2624 -s 228
        8⤵
        
        PID:5160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54517.exe
        7⤵
        
        PID:3424
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1724 -s 244
        7⤵
        
        PID:5240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3860.exe
        6⤵
        
        PID:1060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16215.exe
        7⤵
        
        PID:4436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6126.exe
        7⤵
        
        PID:5840
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1060 -s 220
        7⤵
        
        PID:6636
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2320 -s 240
        6⤵
        Program crash
        
        PID:3652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20990.exe
        5⤵
        
        PID:2292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1437.exe
        6⤵
        
        PID:3380
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2292 -s 236
        6⤵
        Program crash
        
        PID:4408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-182.exe
        5⤵
        
        PID:2500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22194.exe
        6⤵
        
        PID:7256
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2500 -s 228
        6⤵
        
        PID:9040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11143.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9039.exe
        5⤵
        
        PID:6208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49911.exe
        5⤵
        
        PID:7124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58738.exe
        5⤵
        
        PID:7788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56092.exe
        5⤵
        
        PID:8220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47067.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47067.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18137.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1588
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1588 -s 224
        6⤵
        Program crash
        
        PID:960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24249.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45428.exe
        6⤵
        
        PID:3100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35001.exe
        7⤵
        
        PID:6300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35929.exe
        7⤵
        
        PID:8184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15490.exe
        7⤵
        
        PID:8392
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1056 -s 228
        6⤵
        Program crash
        
        PID:4108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52894.exe
        5⤵
        
        PID:3300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8078.exe
        6⤵
        
        PID:7748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37823.exe
        6⤵
        
        PID:7448
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3300 -s 224
        6⤵
        
        PID:9092
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1924 -s 248
        5⤵
        Program crash
        
        PID:4020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32426.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32426.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8681.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40638.exe
        6⤵
        
        PID:2884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50428.exe
        7⤵
        
        PID:4824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8077.exe
        7⤵
        
        PID:5440
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2884 -s 224
        7⤵
        
        PID:6884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59260.exe
        6⤵
        
        PID:3500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61309.exe
        6⤵
        
        PID:5880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7055.exe
        6⤵
        
        PID:7016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56325.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29592.exe
        6⤵
        
        PID:7980
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2092 -s 244
        6⤵
        
        PID:9080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8520.exe
        5⤵
        
        PID:2668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15831.exe
        6⤵
        
        PID:4720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6126.exe
        6⤵
        
        PID:5328
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2668 -s 220
        6⤵
        
        PID:6704
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2224 -s 240
        5⤵
        Program crash
        
        PID:3256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49449.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49449.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20566.exe
        5⤵
        
        PID:3036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19775.exe
        6⤵
        
        PID:5528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32763.exe
        6⤵
        
        PID:6492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23219.exe
        6⤵
        
        PID:8072
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3036 -s 216
        6⤵
        
        PID:8276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51860.exe
        5⤵
        
        PID:4356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21620.exe
        5⤵
        
        PID:6040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63848.exe
        5⤵
        
        PID:7156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7124.exe
        5⤵
        
        PID:7704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28523.exe
        5⤵
        
        PID:8060
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 844 -s 244
        5⤵
        
        PID:8976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8620.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8620.exe
      4⤵
      PID:1716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26184.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14860.exe
        5⤵
        
        PID:7008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44574.exe
        5⤵
        
        PID:7444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51786.exe
        5⤵
        
        PID:8928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34007.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34007.exe
      4⤵
      PID:4512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31603.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31603.exe
      4⤵
      PID:6136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58878.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58878.exe
      4⤵
      PID:6176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59620.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59620.exe
      4⤵
      PID:7968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16050.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16050.exe
      4⤵
      PID:8296
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55069.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55069.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17924.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17924.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18137.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48775.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2936
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2936 -s 220
        7⤵
        Program crash
        
        PID:2524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18167.exe
        6⤵
        
        PID:2724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19017.exe
        7⤵
        
        PID:4664
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2724 -s 248
        7⤵
        
        PID:2684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26259.exe
        6⤵
        
        PID:3212
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2776 -s 248
        6⤵
        
        PID:4772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24249.exe
        5⤵
        
        PID:956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11276.exe
        6⤵
        
        PID:3912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57248.exe
        7⤵
        
        PID:8048
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3912 -s 248
        7⤵
        
        PID:8360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9644.exe
        6⤵
        
        PID:5048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19861.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1596.exe
        6⤵
        
        PID:6616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13870.exe
        6⤵
        
        PID:8144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39413.exe
        6⤵
        
        PID:8796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18358.exe
        5⤵
        
        PID:3964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47819.exe
        6⤵
        
        PID:7640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1755.exe
        6⤵
        
        PID:8376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8824.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62370.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58461.exe
        5⤵
        
        PID:6808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30929.exe
        5⤵
        
        PID:7348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22120.exe
        5⤵
        
        PID:8920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39303.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39303.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64187.exe
        5⤵
        
        PID:2556
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2556 -s 220
        6⤵
        Program crash
        
        PID:2708
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2580 -s 216
        5⤵
        Program crash
        
        PID:1880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37061.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37061.exe
      4⤵
      PID:648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23176.exe
        5⤵
        
        PID:2484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17315.exe
        6⤵
        
        PID:3436
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2484 -s 248
        6⤵
        
        PID:5144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8741.exe
        5⤵
        
        PID:3888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27546.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63443.exe
        5⤵
        
        PID:6408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12858.exe
        5⤵
        
        PID:6596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3002.exe
        5⤵
        
        PID:7712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13220.exe
        5⤵
        
        PID:7284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10850.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10850.exe
      4⤵
      PID:1148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57929.exe
        5⤵
        
        PID:4040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49822.exe
        6⤵
        
        PID:7820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14749.exe
        6⤵
        
        PID:9064
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1148 -s 216
        5⤵
        Program crash
        
        PID:4524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58044.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58044.exe
      4⤵
      PID:3356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17620.exe
        5⤵
        
        PID:8652
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2856 -s 248
      4⤵
      Program crash
      PID:4736
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11793.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11793.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59169.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59169.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14986.exe
        5⤵
        
        PID:2628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58064.exe
        6⤵
        
        PID:1956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61425.exe
        7⤵
        
        PID:6944
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1956 -s 228
        7⤵
        
        PID:7412
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2628 -s 228
        6⤵
        Program crash
        
        PID:4148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25562.exe
        5⤵
        
        PID:3076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59697.exe
        6⤵
        
        PID:6980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8602.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7700
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3076 -s 220
        6⤵
        
        PID:9196
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2808 -s 244
        5⤵
        Program crash
        
        PID:5096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35769.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35769.exe
      4⤵
      PID:2536
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2536 -s 224
        5⤵
        Program crash
        
        PID:3124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23921.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23921.exe
      4⤵
      PID:3204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15431.exe
        5⤵
        
        PID:6164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29956.exe
        5⤵
        
        PID:7308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28484.exe
        5⤵
        
        PID:8988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44346.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44346.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3766.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3766.exe
      4⤵
      PID:5320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16229.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16229.exe
      4⤵
      PID:7108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54198.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54198.exe
      4⤵
      PID:7668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8441.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8441.exe
      4⤵
      PID:8504
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9703.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9703.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57882.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57882.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17551.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43978.exe
        6⤵
        
        PID:5612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12343.exe
        6⤵
        
        PID:6556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23219.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46851.exe
        6⤵
        
        PID:8316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39607.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33872.exe
        5⤵
        
        PID:6112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18923.exe
        5⤵
        
        PID:6168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20419.exe
        5⤵
        
        PID:7960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21650.exe
        5⤵
        
        PID:8260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30549.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30549.exe
      4⤵
      PID:2620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52146.exe
        5⤵
        
        PID:5980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21471.exe
        5⤵
        
        PID:6600
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2620 -s 220
        5⤵
        
        PID:7996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48683.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48683.exe
      4⤵
      PID:4576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39738.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39738.exe
      4⤵
      PID:5312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26594.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26594.exe
      4⤵
      PID:6328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3884.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3884.exe
      4⤵
      PID:8052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38716.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38716.exe
      4⤵
      PID:8304
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14224.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14224.exe
    3⤵
    PID:2820
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2820 -s 224
      4⤵
      Program crash
      PID:1972
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2920.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2920.exe
    3⤵
    PID:2072
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12213.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12213.exe
      4⤵
      PID:4996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6126.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6126.exe
      4⤵
      PID:1332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61268.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61268.exe
      4⤵
      PID:6732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9214.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9214.exe
      4⤵
      PID:7248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39037.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39037.exe
      4⤵
      PID:8864
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5188.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5188.exe
    3⤵
    PID:3404
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37508.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37508.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5848
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37591.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37591.exe
    3⤵
    PID:6936
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34189.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34189.exe
    3⤵
    PID:7548
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40304.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40304.exe
    3⤵
    PID:7856
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23149.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23149.exe
    3⤵
    PID:9012
- C:\Users\Admin\AppData\Local\Temp\Unicorn-16230.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-16230.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2676
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62682.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62682.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:3056
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3056 -s 244
      4⤵
      Loads dropped DLL
      Program crash
      PID:1868
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43714.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43714.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16466.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16466.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54177.exe
        5⤵
        
        PID:1008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17948.exe
        6⤵
        
        PID:4908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28196.exe
        6⤵
        
        PID:5648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26078.exe
        6⤵
        
        PID:6568
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1008 -s 216
        6⤵
        
        PID:7988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25928.exe
        5⤵
        
        PID:3880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7365.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9364.exe
        5⤵
        
        PID:6708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36589.exe
        5⤵
        
        PID:7268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24356.exe
        5⤵
        
        PID:8180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26215.exe
        5⤵
        
        PID:8912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16112.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16112.exe
      4⤵
      PID:1900
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1900 -s 224
        5⤵
        Program crash
        
        PID:4240
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2104 -s 240
      4⤵
      Program crash
      PID:3148
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35031.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35031.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2928
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2928 -s 220
      4⤵
      Program crash
      PID:296
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37768.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37768.exe
    3⤵
    PID:2060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21674.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21674.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56043.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56043.exe
      4⤵
      PID:5628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12591.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12591.exe
      4⤵
      PID:6792
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2060 -s 248
      4⤵
      PID:7320
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48156.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48156.exe
    3⤵
    PID:3568
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53567.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53567.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5276
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1229.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1229.exe
    3⤵
    PID:6660
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15589.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15589.exe
    3⤵
    PID:7312
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14556.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14556.exe
    3⤵
    PID:7460
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2676 -s 248
    3⤵
    PID:9112
- C:\Users\Admin\AppData\Local\Temp\Unicorn-52002.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-52002.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:1528
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27208.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27208.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5500.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5500.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25532.exe
        5⤵
        
        PID:1548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17089.exe
        6⤵
        
        PID:4068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20933.exe
        7⤵
        
        PID:7612
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4068 -s 228
        7⤵
        
        PID:9100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16743.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11309.exe
        6⤵
        
        PID:6260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14040.exe
        6⤵
        
        PID:6224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19537.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61692.exe
        6⤵
        
        PID:8384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54784.exe
        5⤵
        
        PID:3132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13976.exe
        6⤵
        
        PID:8012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30478.exe
        5⤵
        
        PID:4332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17174.exe
        5⤵
        
        PID:6216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5375.exe
        5⤵
        
        PID:7092
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1112 -s 248
        5⤵
        
        PID:7716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54867.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54867.exe
      4⤵
      PID:1952
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1952 -s 240
        5⤵
        Program crash
        
        PID:3728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25374.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25374.exe
      4⤵
      PID:3856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28468.exe
        5⤵
        
        PID:8024
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3856 -s 216
        5⤵
        
        PID:9184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44538.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44538.exe
      4⤵
      PID:4292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12977.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12977.exe
      4⤵
      PID:5344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41932.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41932.exe
      4⤵
      PID:6628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14400.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14400.exe
      4⤵
      PID:8132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34948.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34948.exe
      4⤵
      PID:8804
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18499.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18499.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2848
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2848 -s 240
      4⤵
      Program crash
      PID:2268
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40974.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40974.exe
    3⤵
    PID:2312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28607.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28607.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3136
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2312 -s 228
      4⤵
      PID:5152
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34037.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34037.exe
    3⤵
    PID:3448
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27678.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27678.exe
    3⤵
    PID:4584
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57511.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57511.exe
    3⤵
    PID:6236
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5905.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5905.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6196
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1528 -s 248
    3⤵
    PID:7812
- C:\Users\Admin\AppData\Local\Temp\Unicorn-62818.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-62818.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2076
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18905.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18905.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46393.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46393.exe
      4⤵
      PID:1936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-760.exe
        5⤵
        
        PID:4180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47574.exe
        5⤵
        
        PID:5872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1190.exe
        5⤵
        
        PID:6992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64990.exe
        5⤵
        
        PID:7588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24638.exe
        5⤵
        
        PID:7696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9149.exe
        5⤵
        
        PID:8940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37220.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37220.exe
      4⤵
      PID:3588
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1664 -s 224
      4⤵
      PID:5256
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25951.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25951.exe
    3⤵
    PID:2504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47221.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47221.exe
      4⤵
      PID:4420
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2504 -s 248
      4⤵
      PID:4656
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39472.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39472.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3240
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2076 -s 248
    3⤵
    - Program crash
    PID:5128
- C:\Users\Admin\AppData\Local\Temp\Unicorn-39432.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-39432.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2180
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38033.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38033.exe
    3⤵
    PID:2308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6956.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6956.exe
      4⤵
      PID:4756
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2308 -s 228
      4⤵
      PID:5300
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29052.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29052.exe
    3⤵
    PID:3388
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2180 -s 244
    3⤵
    - Program crash
    PID:4328
- C:\Users\Admin\AppData\Local\Temp\Unicorn-33717.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-33717.exe
  2⤵
  PID:3020
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3020 -s 240
    3⤵
    - Program crash
    PID:3660
- C:\Users\Admin\AppData\Local\Temp\Unicorn-18987.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-18987.exe
  2⤵
  PID:3428
- C:\Users\Admin\AppData\Local\Temp\Unicorn-43766.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-43766.exe
  2⤵
  PID:5224
- C:\Users\Admin\AppData\Local\Temp\Unicorn-44100.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-44100.exe
  2⤵
  PID:6696
- C:\Users\Admin\AppData\Local\Temp\Unicorn-52255.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-52255.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:7260
- C:\Users\Admin\AppData\Local\Temp\Unicorn-38357.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-38357.exe
  2⤵
  PID:8156
- C:\Users\Admin\AppData\Local\Temp\Unicorn-38550.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-38550.exe
  2⤵
  PID:8964

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-11793.exe

Filesize
468KB

MD5
4de105d8168910839e6ade436f18acfd

SHA1
147d57d2d3aa2917128b893d9b4703fea668692d

SHA256
b5a5097418fe490c9b5408930ccd236fec0a601aa4d3d493675a403eaf31af8d

SHA512
7d2ff531cde1730e092dd60c4b54dc844024e4ea87fc8adc76773d96c8266758b313579e81efe96fda8cbc1dd9755fe6701e0b337be20695b51eed0450591ff4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-16230.exe

Filesize
468KB

MD5
0540d3f6fd53b86e2c7b4454b63a8bf1

SHA1
8d06bd786600ab49b3da94a4b27e6d9ad7c3e87e

SHA256
770b1120bc0cf9cfa48e1138f912e1e574fcbbc6f7b2ec782ddc4816191d0e3a

SHA512
f19f6affa1ceb276c654e302631cbe34c254a3a6532e12f9519010af5308ce2a4e855cc678b2228fade3e10d230cbe3378bb50e159cbaff873d3b663144798ca

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39734.exe

Filesize
468KB

MD5
6c928df630d120d1daa1e15bf05b20e8

SHA1
f0bf560793f093dbd0f270eee65b4ac366d8ff5a

SHA256
af9e35ac10e6cc333081b2eee065c7cae42e9241bb9ae6ef931e858c866b90fa

SHA512
959d7617dd18d839328253984ffddd570bdab662a6e83778236c63371207abc30287c7690315080e08e7f0ce46fc79e289fc6fc819ec9ef5ace11dbae7c89a15

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39879.exe

Filesize
468KB

MD5
ed15b6d43fba5abdbfe6e227d747dae4

SHA1
181ed62d2d018f325528306e436c6dd607e10781

SHA256
5976ae6a253375e308ce0f89ee87c195bf607fc9f9fd7b8c68a02c6e765ebd12

SHA512
96b12cd524cfb0723437e370212d8e808488e3f547b988732c3dc2cbbb301bffe4df0bdf1904fbb48d28ad9ca3fc1f7d0afc58127fb1c47781f5fcd89c141820

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-43886.exe

Filesize
468KB

MD5
1a0245869a1595d49d2c22690bfd9b47

SHA1
e372199566275937b4a29e35742ad523308b12d2

SHA256
f244d8a6ac4460ba6e79e5279e7aaf25004d5b736290cfc43f11e0e311c64531

SHA512
480d11d54e61264cfdb3f305b10a058e38ff66ad58a8cf0d87798c8e567c07b56fd7d940fd01e11b3c4f414bd5a8028551c6ac0d01ba2e625f501b7d411c58e3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-47067.exe

Filesize
468KB

MD5
0a150bba78ecb983845400aeb2311956

SHA1
0de2f6e1ba69355a8bbf06a0677f7a40e72c9ef6

SHA256
92bc48da4d174d9e5efd57b765b158406fbf88f57f51f189f0dcd90e1d5b40ae

SHA512
fd7a6f082d5afc71a501e3fcd0d3562f191e29e3f655c514522a9838d7d87508b6956fd06326acbdf471d4ace26af53caa4f96506387bb2a7e13358094d46481

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-52002.exe

Filesize
468KB

MD5
d14a90ffe52d14ea08bb35dbb27acef6

SHA1
7b6e252b78826892ff9c34968a3e1b4a4cf63947

SHA256
4d09aa869450602d6909cbf2441d7f5d07b537e35026e77669dde568bf715b19

SHA512
cddb53dcfa5ecdada8159b3346f272342ce4ab3ea6bf04883ff74abe2ed76459ca69c662a28d3f112f2dc1ee0963c1acf7a93680c453dc144de8a65b636dc276

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5500.exe

Filesize
468KB

MD5
4a52b20753fb6460ee8ac6bcf7abaaaa

SHA1
5b1e265a0afa5c51228455f097e026135739d45a

SHA256
e47dfde57ed6880e44f6455d846d37260bd4fc87f02d11c10e2c841c1e55da5d

SHA512
44eafa50e440c280cfa7cbe27dca8043f0047d74a4947141ae3cc92073250d6d934c428317b557f06bac170daa9eb88b542dc85076f815e2ba5c59c27d8f190b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-63751.exe

Filesize
468KB

MD5
d085c156a6bbc7ac6f8c62a6e47aaefb

SHA1
d75ca37f1b7fb543d097b9e64f6e67a9b4dfa0db

SHA256
eb8b99fed9ded0db6bda282ddcaa14704ab9b72b4b087d8f3443c4a0437d1e1a

SHA512
6734e48819a69cfa40facf356eb960c37e06ba354c72583e1ed99b4b9534c664323d9b07a755e7dce2c57c2c36a7ea6374276feb5a372434f93e69ed6c0065e4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-65170.exe

Filesize
468KB

MD5
98a0672d0184cb24d9ac49f756a54346

SHA1
71c50d4bfe62f8ae6bcc42c88d3fab0f5d39b08a

SHA256
5463c7f6d8795ece4d031248efb3490924b6e4d6ec80a09274cd64dd7a82334f

SHA512
8f19de3bf283b6e8ccae58e1e2bc3c8c7b691235e446842e6701ab537d7de607f41a8caa73029617ef680c4c8227f52cca331bd60ee42e51f5c63e001491a296

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-14000.exe

Filesize
468KB

MD5
be9ce20bf6ffa36e0ce2a93e94496f71

SHA1
ecec7cdd87bf0c425204d044aa4b3526d592f0e1

SHA256
d623fa29e2f94b1c448f2903f72f172a668d823a1d8301120a4ddef08900828f

SHA512
ff67c9bf196f23644bed85ea8e5813a664086311f3052aabeffef62ebe7ee1d5f18d129950650b2a99f0b83a0d01a8a04d8fdbf79d0a59fbc2af14835a9992a4

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-17924.exe

Filesize
468KB

MD5
b56b8e324e4de2c92ff549d23a9a56ec

SHA1
d60d7a9e62e44a701b3cf9641288b87a44f90788

SHA256
97a5b0881b1a360c9454f4fecc99560b1e42425d112038ac7b6bb42c70f0fabd

SHA512
e77df1cc883222c602d3e226f2caa231dc8ccc0ba33342f5969e96a01f1923fd31fc4b89eceea7aed30c3c5a3bbcf6c20bff7efcd48d79fc17bf55543c87c129

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-20154.exe

Filesize
468KB

MD5
b1c87e49ddb1ad532fdac90f6fdeeb8c

SHA1
14c955b5cad410774bd8e4e900f8835d92d6d332

SHA256
d8ecd26ca23da5213b0f8363a379f69108a4854edeeda06e054b284eb99182c8

SHA512
394e9b62921d7bfa288a7cf916eba13e0d35dd284c35b9908983b6f38e21ff90985edf0ff0cae2feeebd2dee2d0ab3f3273483ca251b00f31a2d460bb0ce975c

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-26445.exe

Filesize
468KB

MD5
95b1be932f3b67bcf534427613a2668b

SHA1
ca75f52e4378611629f73c3113fcd776aee83be5

SHA256
9f9239e12b65f375a3a104d59d72896bb7c5dca8826effdb5233c486c28d3c0a

SHA512
d5178e57d960c624b06faf7a110912c3ceeb9fa5f70cbebc66ac82fac41e9e5ba562b2da61975135ebe03ca7989f2b3f423b7ee21d228a953f6d5ce428b9c35c

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-31083.exe

Filesize
468KB

MD5
9e01efd126e01a232a5f00a133d21e15

SHA1
f295819db11478a6ae486e215af52a2bd3793e41

SHA256
a7ec4f82c64f17714ee518b3131ab1bddc045b6b43716dd7d4795740419f3edb

SHA512
1932827b14b0918fcb2d3f69007678a56ee343d04ba5dd6cf011f2cbbff7dbcca5b59287b800c88e389bac249b72b100e37aea950584f5a965678d7ceb93737b

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-35936.exe

Filesize
468KB

MD5
2da1eee60e8c669bb17bfcf326a4c22c

SHA1
5b11ea0fe43239ca9cb9ee7db42c004411e0e9df

SHA256
a5e601f1c95bca1ff61d064ae9d56d2dd0740abd3e778038e1c99b2edf8aa85f

SHA512
cd30fa87c60de42c227c863d4970339c9f2f230e196fb4e32d06d5a8846afa2903258b1327925dbf38b913acc514f8bc762f4483594554ebe0d2b4be525e2890

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-39662.exe

Filesize
468KB

MD5
0e30cb8cf7f7e72c1202fba896315095

SHA1
fc330a28f965ca9a5fa7e862d6ec4f512bc2bc80

SHA256
faeb711fb4e8faa0c3e1c034b90e478dc1f64c83f91dc06b1c3cc4f215a9c244

SHA512
d3a2eb4fb1d1be2513e52705e3da8179be388a82be46d462ac57836bd33162e5b93163d7a32c9753eefccc42aff438bcfcf07c6340c0f2ae18be344eab84a734

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-42262.exe

Filesize
468KB

MD5
3293c7e9f47753f900d5a6ff30125bbe

SHA1
7cdc47f39621d44ebc45c5e98df19ad592ab2871

SHA256
eb0be0d6841706c72f43ab5ac73a27414313188563cc843a5d4d40191296828f

SHA512
704920555598fb7e0915c0a326344f626c17f3f05787ac9ddcfa2161733c34a2717dca880dd86eb4f9750803b5d4a21886f54fe90071ecc98fb34399d8d2b7b4

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-46512.exe

Filesize
468KB

MD5
1468afea0d7198e9c42ab710b77f8583

SHA1
e0f3ecd83841ff84f2862385148969df26047a8f

SHA256
6dcceef4379751803095875353e850fee5be233b25a7ae51a1042c00b212d611

SHA512
f3535c728ec35746454e6160fbdada6977121caac219780253295c894e3e49fc87c7c8c3fe42254f10dcf6f2334fda836ef55df338590eb707cf977627f0262d

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-54322.exe

Filesize
468KB

MD5
ac94a441f6e33b9004524bda280d9c76

SHA1
28aa398c828f39486343f61d5458cf018c7839e7

SHA256
fd73d3957b68a219217ac3aa2ff44617398fea0dd989733c642ecf9259286ccf

SHA512
c8edd0946e4b5044cb6db404e9d7b4a7aa83e3b7ecdda0f68921acb80328af43bd280e0d4524707ca6f42fedd0f7a01482eb0150141721c345f8652f43fac579

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-55069.exe

Filesize
468KB

MD5
218285c2bdce9af7413d6e80afb0dad5

SHA1
5a12c2866185f4c5201447cd59b9673d980af350

SHA256
edeb9662d2cbf281acc3d80b356f8bb7253e319bbb21b7556c30d76d3d325e70

SHA512
116bb48cdd94a3700e085856c68d19a0a283d99fcf22d6e0dfa7181a2a8960c596ac9d21e949b574e5b256c475c9656659a881f37f18ee7e353336c116a663cb

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-56552.exe

Filesize
468KB

MD5
57962c6f31be18631612db298b87f01b

SHA1
98f635784b67055896f8f66d5033dd73a5e57df9

SHA256
eec459749b23b354fe86fdc44303fb066f3fc39351c9669a11677a2fdd2f64b5

SHA512
f2d924deeac616623c166520ff32bbb8759649221c379a47e978e066c96fef6e8ecec6206ebdb2900a80745e51c26bfa25d86f9dbb60200571180ff403bf7bc2

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-62682.exe

Filesize
468KB

MD5
e8c0506523eb801c708ff8cf43ce92be

SHA1
17a85674c7f24cdcd2261d8899e37346a3132e0f

SHA256
36f56af6f379fea43baee59176af93b57cbf99f64fb9230b166f2c83cec5e6ed

SHA512
0f98aa55c1be88f7ddb497c692b97dacb5a758450947cce001c808be94129a52ce2e7710272f30cd773ec88e34d5f29fd677e04be3ec483c87f2406959c88ef1

Download Submit
memory/1960-1209-0x00000000029E0000-0x0000000002B3C000-memory.dmp

Filesize
1.4MB

Download
memory/1960-1841-0x00000000029E0000-0x0000000002B3C000-memory.dmp

Filesize
1.4MB

Download