482ce6f15e7f3c421b58336d32258966f3d8537904eb1c11c66aae9c99c36e21

Analysis

max time kernel
120s
max time network
21s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19/11/2024, 19:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

482ce6f15e7f3c421b58336d32258966f3d8537904eb1c11c66aae9c99c36e21.exe
Size

468KB
MD5

30758f31f0dfcfca3bc611d902a32f3b
SHA1

06325b84de7639647489a1fa8af09e65cf5af851
SHA256

482ce6f15e7f3c421b58336d32258966f3d8537904eb1c11c66aae9c99c36e21
SHA512

dcf1838cc943885f128095590f22ed64a66837645eb09b4f7ec87986867a9dbfe92c5281f1b0fce6e7a65a191c2c59276f9960eeab804c8c41883022f8acc1b9
SSDEEP

3072:EJ3FogIKIE5TtbY2HOxOcf8/cC5t9LOknSHeKV86iSYLL0RSkEl3J:EJVoDMTtxHiOcfqauCiSiYRSkc

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2964	Unicorn-49598.exe
2768	Unicorn-61933.exe
264	Unicorn-3173.exe
2732	Unicorn-17969.exe
2776	Unicorn-17969.exe
2808	Unicorn-55585.exe
2252	Unicorn-37765.exe
2760	Unicorn-18820.exe
2596	Unicorn-33572.exe
3004	Unicorn-61606.exe
2520	Unicorn-49909.exe
316	Unicorn-34964.exe
2028	Unicorn-37002.exe
1696	Unicorn-51035.exe
1652	Unicorn-43132.exe
1412	Unicorn-17834.exe
1760	Unicorn-19457.exe
2640	Unicorn-26879.exe
2112	Unicorn-6358.exe
2444	Unicorn-37761.exe
1136	Unicorn-17240.exe
2456	Unicorn-23371.exe
944	Unicorn-49821.exe
972	Unicorn-56598.exe
2460	Unicorn-19095.exe
1732	Unicorn-39250.exe
1520	Unicorn-27817.exe
920	Unicorn-47683.exe
2224	Unicorn-31901.exe
772	Unicorn-51767.exe
684	Unicorn-16926.exe
2192	Unicorn-60859.exe
2032	Unicorn-26049.exe
2916	Unicorn-65498.exe
2260	Unicorn-44423.exe
2500	Unicorn-57351.exe
2996	Unicorn-38877.exe
3068	Unicorn-53822.exe
3060	Unicorn-16053.exe
2748	Unicorn-36739.exe
2788	Unicorn-30252.exe
2740	Unicorn-30517.exe
2880	Unicorn-46853.exe
2128	Unicorn-26987.exe
2592	Unicorn-39239.exe
2632	Unicorn-30024.exe
1472	Unicorn-57221.exe
1388	Unicorn-42276.exe
1636	Unicorn-1243.exe
1512	Unicorn-60650.exe
1608	Unicorn-9966.exe
2388	Unicorn-61113.exe
2124	Unicorn-15441.exe
1428	Unicorn-56374.exe
1908	Unicorn-1819.exe
2428	Unicorn-25561.exe
2540	Unicorn-34492.exe
2864	Unicorn-34492.exe
1240	Unicorn-56950.exe
444	Unicorn-43214.exe
688	Unicorn-58996.exe
296	Unicorn-27308.exe
1800	Unicorn-3573.exe
1396	Unicorn-34300.exe

Loads dropped DLL 64 IoCs

pid	Process
2204	482ce6f15e7f3c421b58336d32258966f3d8537904eb1c11c66aae9c99c36e21.exe
2204	482ce6f15e7f3c421b58336d32258966f3d8537904eb1c11c66aae9c99c36e21.exe
2964	Unicorn-49598.exe
2964	Unicorn-49598.exe
2204	482ce6f15e7f3c421b58336d32258966f3d8537904eb1c11c66aae9c99c36e21.exe
2204	482ce6f15e7f3c421b58336d32258966f3d8537904eb1c11c66aae9c99c36e21.exe
2768	Unicorn-61933.exe
264	Unicorn-3173.exe
2204	482ce6f15e7f3c421b58336d32258966f3d8537904eb1c11c66aae9c99c36e21.exe
264	Unicorn-3173.exe
2768	Unicorn-61933.exe
2204	482ce6f15e7f3c421b58336d32258966f3d8537904eb1c11c66aae9c99c36e21.exe
2964	Unicorn-49598.exe
2964	Unicorn-49598.exe
2776	Unicorn-17969.exe
2776	Unicorn-17969.exe
264	Unicorn-3173.exe
264	Unicorn-3173.exe
2732	Unicorn-17969.exe
2732	Unicorn-17969.exe
2768	Unicorn-61933.exe
2768	Unicorn-61933.exe
2252	Unicorn-37765.exe
2252	Unicorn-37765.exe
2964	Unicorn-49598.exe
2204	482ce6f15e7f3c421b58336d32258966f3d8537904eb1c11c66aae9c99c36e21.exe
2808	Unicorn-55585.exe
2964	Unicorn-49598.exe
2204	482ce6f15e7f3c421b58336d32258966f3d8537904eb1c11c66aae9c99c36e21.exe
2808	Unicorn-55585.exe
2760	Unicorn-18820.exe
2760	Unicorn-18820.exe
2776	Unicorn-17969.exe
2776	Unicorn-17969.exe
2596	Unicorn-33572.exe
2596	Unicorn-33572.exe
264	Unicorn-3173.exe
264	Unicorn-3173.exe
2520	Unicorn-49909.exe
2520	Unicorn-49909.exe
2768	Unicorn-61933.exe
2768	Unicorn-61933.exe
3004	Unicorn-61606.exe
3004	Unicorn-61606.exe
2028	Unicorn-37002.exe
2028	Unicorn-37002.exe
2732	Unicorn-17969.exe
2732	Unicorn-17969.exe
1652	Unicorn-43132.exe
1652	Unicorn-43132.exe
2964	Unicorn-49598.exe
2964	Unicorn-49598.exe
2808	Unicorn-55585.exe
2808	Unicorn-55585.exe
316	Unicorn-34964.exe
316	Unicorn-34964.exe
2252	Unicorn-37765.exe
2252	Unicorn-37765.exe
1696	Unicorn-51035.exe
1696	Unicorn-51035.exe
2204	482ce6f15e7f3c421b58336d32258966f3d8537904eb1c11c66aae9c99c36e21.exe
2204	482ce6f15e7f3c421b58336d32258966f3d8537904eb1c11c66aae9c99c36e21.exe
1412	Unicorn-17834.exe
1412	Unicorn-17834.exe

Program crash 64 IoCs

pid	pid_target	Process	procid_target
1792	920	WerFault.exe	58
1476	1760	WerFault.exe	47
1132	1412	WerFault.exe	46
1660	1608	WerFault.exe	82
1172	2996	WerFault.exe	66
2152	3060	WerFault.exe	69
840	2444	WerFault.exe	50
2544	1800	WerFault.exe	94
2420	864	WerFault.exe	103
2496	2192	WerFault.exe	62
2316	296	WerFault.exe	93
1320	1512	WerFault.exe	80
2852	2768	WerFault.exe	32
1420	444	WerFault.exe	90
1048	472	WerFault.exe	109
4072	1244	WerFault.exe	156
3716	1812	WerFault.exe	120
3896	2508	WerFault.exe	174
3972	2856	WerFault.exe	118
3872	1428	WerFault.exe	85
2936	2912	WerFault.exe	108
4700	540	WerFault.exe	130
4680	2092	WerFault.exe	143
4672	2140	WerFault.exe	113
4664	2880	WerFault.exe	73
4656	684	WerFault.exe	61
4736	2916	WerFault.exe	64
4744	2124	WerFault.exe	84
4796	2780	WerFault.exe	110
4804	2592	WerFault.exe	75
5004	3004	WerFault.exe	40
4876	2552	WerFault.exe	136
4868	2196	WerFault.exe	111
4860	688	WerFault.exe	92
5028	1332	WerFault.exe	123
5020	1952	WerFault.exe	115
4852	2432	WerFault.exe	138
4836	972	WerFault.exe	54
5036	2388	WerFault.exe	83
5044	2460	WerFault.exe	55
5084	944	WerFault.exe	53
5092	1292	WerFault.exe	119
5116	1992	WerFault.exe	147
5108	1520	WerFault.exe	57
5076	2568	WerFault.exe	117
5064	3368	WerFault.exe	183
4132	2028	WerFault.exe	43
5052	2224	WerFault.exe	59
4144	2712	WerFault.exe	173
1604	1740	WerFault.exe	166
4372	2788	WerFault.exe	71
2336	1240	WerFault.exe	91
4568	1724	WerFault.exe	121
4712	1984	WerFault.exe	141
932	2540	WerFault.exe	89
4544	2032	WerFault.exe	63
2068	1272	WerFault.exe	107
5368	884	WerFault.exe	96
5432	2428	WerFault.exe	87
5444	1628	WerFault.exe	100
6048	2828	WerFault.exe	131
6068	2604	WerFault.exe	155
6088	2440	WerFault.exe	162
6080	1156	WerFault.exe	137

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32401.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28721.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23371.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31901.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9356.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8892.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30472.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47372.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5960.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30252.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4253.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51316.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56468.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9966.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39187.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12568.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43132.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63630.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2141.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28351.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34300.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43703.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46262.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30543.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39008.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52852.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18829.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56598.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50968.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34901.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6997.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27336.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35544.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40465.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32873.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19805.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22472.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26915.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62275.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45642.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25883.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45509.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26578.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45836.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44720.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11561.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-182.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57939.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17969.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53822.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41024.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44409.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32489.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30735.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2634.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15820.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26879.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43214.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55302.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37665.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2135.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29415.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60381.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28771.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2204	482ce6f15e7f3c421b58336d32258966f3d8537904eb1c11c66aae9c99c36e21.exe
2964	Unicorn-49598.exe
2768	Unicorn-61933.exe
264	Unicorn-3173.exe
2776	Unicorn-17969.exe
2732	Unicorn-17969.exe
2808	Unicorn-55585.exe
2252	Unicorn-37765.exe
2760	Unicorn-18820.exe
2596	Unicorn-33572.exe
3004	Unicorn-61606.exe
2520	Unicorn-49909.exe
316	Unicorn-34964.exe
2028	Unicorn-37002.exe
1652	Unicorn-43132.exe
1696	Unicorn-51035.exe
1412	Unicorn-17834.exe
1760	Unicorn-19457.exe
2640	Unicorn-26879.exe
2112	Unicorn-6358.exe
2444	Unicorn-37761.exe
2456	Unicorn-23371.exe
1136	Unicorn-17240.exe
972	Unicorn-56598.exe
2460	Unicorn-19095.exe
944	Unicorn-49821.exe
1732	Unicorn-39250.exe
1520	Unicorn-27817.exe
920	Unicorn-47683.exe
2224	Unicorn-31901.exe
772	Unicorn-51767.exe
684	Unicorn-16926.exe
2192	Unicorn-60859.exe
2032	Unicorn-26049.exe
2260	Unicorn-44423.exe
2916	Unicorn-65498.exe
2996	Unicorn-38877.exe
2500	Unicorn-57351.exe
3068	Unicorn-53822.exe
3060	Unicorn-16053.exe
2748	Unicorn-36739.exe
2788	Unicorn-30252.exe
2128	Unicorn-26987.exe
2740	Unicorn-30517.exe
2880	Unicorn-46853.exe
2592	Unicorn-39239.exe
2632	Unicorn-30024.exe
1388	Unicorn-42276.exe
1472	Unicorn-57221.exe
1636	Unicorn-1243.exe
1512	Unicorn-60650.exe
2124	Unicorn-15441.exe
2388	Unicorn-61113.exe
1608	Unicorn-9966.exe
1428	Unicorn-56374.exe
1908	Unicorn-1819.exe
2428	Unicorn-25561.exe
1240	Unicorn-56950.exe
2864	Unicorn-34492.exe
2540	Unicorn-34492.exe
444	Unicorn-43214.exe
688	Unicorn-58996.exe
1800	Unicorn-3573.exe
296	Unicorn-27308.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2204 wrote to memory of 2964	2204	482ce6f15e7f3c421b58336d32258966f3d8537904eb1c11c66aae9c99c36e21.exe	31
PID 2204 wrote to memory of 2964	2204	482ce6f15e7f3c421b58336d32258966f3d8537904eb1c11c66aae9c99c36e21.exe	31
PID 2204 wrote to memory of 2964	2204	482ce6f15e7f3c421b58336d32258966f3d8537904eb1c11c66aae9c99c36e21.exe	31
PID 2204 wrote to memory of 2964	2204	482ce6f15e7f3c421b58336d32258966f3d8537904eb1c11c66aae9c99c36e21.exe	31
PID 2964 wrote to memory of 2768	2964	Unicorn-49598.exe	32
PID 2964 wrote to memory of 2768	2964	Unicorn-49598.exe	32
PID 2964 wrote to memory of 2768	2964	Unicorn-49598.exe	32
PID 2964 wrote to memory of 2768	2964	Unicorn-49598.exe	32
PID 2204 wrote to memory of 264	2204	482ce6f15e7f3c421b58336d32258966f3d8537904eb1c11c66aae9c99c36e21.exe	33
PID 2204 wrote to memory of 264	2204	482ce6f15e7f3c421b58336d32258966f3d8537904eb1c11c66aae9c99c36e21.exe	33
PID 2204 wrote to memory of 264	2204	482ce6f15e7f3c421b58336d32258966f3d8537904eb1c11c66aae9c99c36e21.exe	33
PID 2204 wrote to memory of 264	2204	482ce6f15e7f3c421b58336d32258966f3d8537904eb1c11c66aae9c99c36e21.exe	33
PID 264 wrote to memory of 2776	264	Unicorn-3173.exe	35
PID 264 wrote to memory of 2776	264	Unicorn-3173.exe	35
PID 264 wrote to memory of 2776	264	Unicorn-3173.exe	35
PID 264 wrote to memory of 2776	264	Unicorn-3173.exe	35
PID 2768 wrote to memory of 2732	2768	Unicorn-61933.exe	34
PID 2768 wrote to memory of 2732	2768	Unicorn-61933.exe	34
PID 2768 wrote to memory of 2732	2768	Unicorn-61933.exe	34
PID 2768 wrote to memory of 2732	2768	Unicorn-61933.exe	34
PID 2204 wrote to memory of 2808	2204	482ce6f15e7f3c421b58336d32258966f3d8537904eb1c11c66aae9c99c36e21.exe	36
PID 2204 wrote to memory of 2808	2204	482ce6f15e7f3c421b58336d32258966f3d8537904eb1c11c66aae9c99c36e21.exe	36
PID 2204 wrote to memory of 2808	2204	482ce6f15e7f3c421b58336d32258966f3d8537904eb1c11c66aae9c99c36e21.exe	36
PID 2204 wrote to memory of 2808	2204	482ce6f15e7f3c421b58336d32258966f3d8537904eb1c11c66aae9c99c36e21.exe	36
PID 2964 wrote to memory of 2252	2964	Unicorn-49598.exe	37
PID 2964 wrote to memory of 2252	2964	Unicorn-49598.exe	37
PID 2964 wrote to memory of 2252	2964	Unicorn-49598.exe	37
PID 2964 wrote to memory of 2252	2964	Unicorn-49598.exe	37
PID 2776 wrote to memory of 2760	2776	Unicorn-17969.exe	38
PID 2776 wrote to memory of 2760	2776	Unicorn-17969.exe	38
PID 2776 wrote to memory of 2760	2776	Unicorn-17969.exe	38
PID 2776 wrote to memory of 2760	2776	Unicorn-17969.exe	38
PID 264 wrote to memory of 2596	264	Unicorn-3173.exe	39
PID 264 wrote to memory of 2596	264	Unicorn-3173.exe	39
PID 264 wrote to memory of 2596	264	Unicorn-3173.exe	39
PID 264 wrote to memory of 2596	264	Unicorn-3173.exe	39
PID 2732 wrote to memory of 3004	2732	Unicorn-17969.exe	40
PID 2732 wrote to memory of 3004	2732	Unicorn-17969.exe	40
PID 2732 wrote to memory of 3004	2732	Unicorn-17969.exe	40
PID 2732 wrote to memory of 3004	2732	Unicorn-17969.exe	40
PID 2768 wrote to memory of 2520	2768	Unicorn-61933.exe	41
PID 2768 wrote to memory of 2520	2768	Unicorn-61933.exe	41
PID 2768 wrote to memory of 2520	2768	Unicorn-61933.exe	41
PID 2768 wrote to memory of 2520	2768	Unicorn-61933.exe	41
PID 2252 wrote to memory of 316	2252	Unicorn-37765.exe	42
PID 2252 wrote to memory of 316	2252	Unicorn-37765.exe	42
PID 2252 wrote to memory of 316	2252	Unicorn-37765.exe	42
PID 2252 wrote to memory of 316	2252	Unicorn-37765.exe	42
PID 2964 wrote to memory of 2028	2964	Unicorn-49598.exe	43
PID 2964 wrote to memory of 2028	2964	Unicorn-49598.exe	43
PID 2964 wrote to memory of 2028	2964	Unicorn-49598.exe	43
PID 2964 wrote to memory of 2028	2964	Unicorn-49598.exe	43
PID 2204 wrote to memory of 1696	2204	482ce6f15e7f3c421b58336d32258966f3d8537904eb1c11c66aae9c99c36e21.exe	44
PID 2204 wrote to memory of 1696	2204	482ce6f15e7f3c421b58336d32258966f3d8537904eb1c11c66aae9c99c36e21.exe	44
PID 2204 wrote to memory of 1696	2204	482ce6f15e7f3c421b58336d32258966f3d8537904eb1c11c66aae9c99c36e21.exe	44
PID 2204 wrote to memory of 1696	2204	482ce6f15e7f3c421b58336d32258966f3d8537904eb1c11c66aae9c99c36e21.exe	44
PID 2808 wrote to memory of 1652	2808	Unicorn-55585.exe	45
PID 2808 wrote to memory of 1652	2808	Unicorn-55585.exe	45
PID 2808 wrote to memory of 1652	2808	Unicorn-55585.exe	45
PID 2808 wrote to memory of 1652	2808	Unicorn-55585.exe	45
PID 2760 wrote to memory of 1412	2760	Unicorn-18820.exe	46
PID 2760 wrote to memory of 1412	2760	Unicorn-18820.exe	46
PID 2760 wrote to memory of 1412	2760	Unicorn-18820.exe	46
PID 2760 wrote to memory of 1412	2760	Unicorn-18820.exe	46

C:\Users\Admin\AppData\Local\Temp\482ce6f15e7f3c421b58336d32258966f3d8537904eb1c11c66aae9c99c36e21.exe
"C:\Users\Admin\AppData\Local\Temp\482ce6f15e7f3c421b58336d32258966f3d8537904eb1c11c66aae9c99c36e21.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2204
- C:\Users\Admin\AppData\Local\Temp\Unicorn-49598.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-49598.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2964
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61933.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61933.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17969.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17969.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61606.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:3004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23371.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30517.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21420.exe
        8⤵
        
        PID:1664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32489.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:3832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51897.exe
        9⤵
        
        PID:4924
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1664 -s 224
        9⤵
        
        PID:5816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11170.exe
        8⤵
        
        PID:3452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9633.exe
        8⤵
        
        PID:4724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27336.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26615.exe
        8⤵
        
        PID:6668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42939.exe
        8⤵
        
        PID:8064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41024.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49209.exe
        8⤵
        
        PID:3488
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2568 -s 248
        8⤵
        Program crash
        
        PID:5076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38035.exe
        7⤵
        
        PID:3632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15498.exe
        7⤵
        
        PID:4716
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2456 -s 244
        7⤵
        
        PID:5488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26987.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51316.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17113.exe
        8⤵
        
        PID:3428
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1984 -s 228
        8⤵
        Program crash
        
        PID:4712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48202.exe
        7⤵
        
        PID:3108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-95.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-95.exe
        7⤵
        
        PID:5012
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2128 -s 236
        7⤵
        
        PID:5288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24765.exe
        6⤵
        
        PID:1156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6334.exe
        7⤵
        
        PID:4500
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1156 -s 228
        7⤵
        Program crash
        
        PID:6080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65088.exe
        6⤵
        
        PID:4040
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3004 -s 240
        6⤵
        Program crash
        
        PID:5004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56598.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42276.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50968.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62208.exe
        7⤵
        
        PID:3264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-95.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-95.exe
        7⤵
        
        PID:4972
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1388 -s 248
        7⤵
        
        PID:5312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2322.exe
        6⤵
        
        PID:2828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2634.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4552
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2828 -s 216
        7⤵
        Program crash
        
        PID:6048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43079.exe
        6⤵
        
        PID:3404
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 972 -s 236
        6⤵
        Program crash
        
        PID:4836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60650.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1512
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1512 -s 220
        6⤵
        Program crash
        
        PID:1320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14678.exe
        5⤵
        
        PID:2860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56386.exe
        6⤵
        
        PID:4884
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2860 -s 216
        6⤵
        
        PID:6200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17912.exe
        5⤵
        
        PID:3752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14008.exe
        5⤵
        
        PID:4652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35345.exe
        5⤵
        
        PID:5144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5615.exe
        5⤵
        
        PID:6652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4551.exe
        5⤵
        
        PID:7944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49909.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49909.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37761.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46853.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19282.exe
        7⤵
        
        PID:1952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26459.exe
        8⤵
        
        PID:3924
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1952 -s 228
        8⤵
        Program crash
        
        PID:5020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44912.exe
        7⤵
        
        PID:3508
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2880 -s 244
        7⤵
        Program crash
        
        PID:4664
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2444 -s 236
        6⤵
        Program crash
        
        PID:840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39239.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24134.exe
        6⤵
        
        PID:528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30735.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51897.exe
        7⤵
        
        PID:4964
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 528 -s 220
        7⤵
        
        PID:5380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27205.exe
        6⤵
        
        PID:3612
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2592 -s 240
        6⤵
        Program crash
        
        PID:4804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-261.exe
        5⤵
        
        PID:2384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31550.exe
        6⤵
        
        PID:3544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15820.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3183.exe
        6⤵
        
        PID:6780
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2384 -s 248
        6⤵
        
        PID:7672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9857.exe
        5⤵
        
        PID:3792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62832.exe
        5⤵
        
        PID:5100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2135.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40467.exe
        5⤵
        
        PID:6524
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2520 -s 248
        5⤵
        
        PID:7952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17240.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17240.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36739.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43703.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13682.exe
        7⤵
        
        PID:2364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46262.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26583.exe
        8⤵
        
        PID:7608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65106.exe
        8⤵
        
        PID:7288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19805.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42711.exe
        7⤵
        
        PID:2532
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2380 -s 248
        7⤵
        
        PID:6176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45540.exe
        6⤵
        
        PID:2404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14061.exe
        7⤵
        
        PID:5904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42213.exe
        7⤵
        
        PID:6892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56136.exe
        7⤵
        
        PID:7304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50754.exe
        6⤵
        
        PID:3812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17849.exe
        6⤵
        
        PID:4772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37850.exe
        6⤵
        
        PID:6228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41045.exe
        6⤵
        
        PID:6848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22153.exe
        6⤵
        
        PID:7532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39187.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54471.exe
        6⤵
        
        PID:3564
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2140 -s 248
        6⤵
        Program crash
        
        PID:4672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55248.exe
        5⤵
        
        PID:3412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63630.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4636
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1136 -s 244
        5⤵
        
        PID:5504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30252.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30252.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64232.exe
        5⤵
        
        PID:1272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44985.exe
        6⤵
        
        PID:2188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16387.exe
        7⤵
        
        PID:6924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15182.exe
        7⤵
        
        PID:8180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46256.exe
        6⤵
        
        PID:3444
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1272 -s 244
        6⤵
        Program crash
        
        PID:2068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58176.exe
        5⤵
        
        PID:2160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62510.exe
        6⤵
        
        PID:7344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45642.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2669.exe
        5⤵
        
        PID:3516
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2788 -s 248
        5⤵
        Program crash
        
        PID:4372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24575.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24575.exe
      4⤵
      PID:884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48467.exe
        5⤵
        
        PID:3252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34901.exe
        5⤵
        
        PID:4176
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 884 -s 240
        5⤵
        Program crash
        
        PID:5368
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2768 -s 236
      4⤵
      Program crash
      PID:2852
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37765.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37765.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34964.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34964.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47683.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:920
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 920 -s 224
        6⤵
        Program crash
        
        PID:1792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9966.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1608
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1608 -s 244
        6⤵
        Program crash
        
        PID:1660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35544.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13163.exe
        6⤵
        
        PID:3324
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2912 -s 236
        6⤵
        Program crash
        
        PID:2936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33428.exe
        5⤵
        
        PID:2872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18354.exe
        6⤵
        
        PID:7512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37665.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45837.exe
        5⤵
        
        PID:3680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22472.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50114.exe
        5⤵
        
        PID:6624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-182.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35970.exe
        5⤵
        
        PID:7280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31901.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31901.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15441.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19858.exe
        6⤵
        
        PID:1292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2146.exe
        7⤵
        
        PID:3356
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1292 -s 228
        7⤵
        Program crash
        
        PID:5092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44720.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3736
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2124 -s 244
        6⤵
        Program crash
        
        PID:4744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14190.exe
        5⤵
        
        PID:1724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35250.exe
        6⤵
        
        PID:3960
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1724 -s 228
        6⤵
        Program crash
        
        PID:4568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7884.exe
        5⤵
        
        PID:3948
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2224 -s 248
        5⤵
        Program crash
        
        PID:5052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56374.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56374.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53838.exe
        5⤵
        
        PID:1648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55727.exe
        6⤵
        
        PID:4588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52852.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6136
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1648 -s 244
        6⤵
        
        PID:6636
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1428 -s 248
        5⤵
        Program crash
        
        PID:3872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38114.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38114.exe
      4⤵
      PID:2816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39095.exe
        5⤵
        
        PID:3908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9302.exe
        5⤵
        
        PID:4300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2804.exe
        5⤵
        
        PID:5180
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2816 -s 248
        5⤵
        
        PID:6608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16542.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16542.exe
      4⤵
      PID:4008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23375.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23375.exe
      4⤵
      PID:2392
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2252 -s 244
      4⤵
      PID:6188
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37002.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37002.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49821.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49821.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1243.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33693.exe
        6⤵
        
        PID:1072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18829.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34901.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6997.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9048.exe
        6⤵
        
        PID:6764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57939.exe
        6⤵
        
        PID:7700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62107.exe
        6⤵
        
        PID:7552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60615.exe
        5⤵
        
        PID:660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64585.exe
        6⤵
        
        PID:3724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61435.exe
        6⤵
        
        PID:4692
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 660 -s 240
        6⤵
        
        PID:5344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26358.exe
        5⤵
        
        PID:3816
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 944 -s 248
        5⤵
        Program crash
        
        PID:5084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61113.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61113.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1191.exe
        5⤵
        
        PID:620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10122.exe
        6⤵
        
        PID:3828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51897.exe
        6⤵
        
        PID:4980
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 620 -s 220
        6⤵
        
        PID:5392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36935.exe
        5⤵
        
        PID:3032
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2388 -s 244
        5⤵
        Program crash
        
        PID:5036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24417.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24417.exe
      4⤵
      PID:1332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40849.exe
        5⤵
        
        PID:3852
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1332 -s 228
        5⤵
        Program crash
        
        PID:5028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11419.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11419.exe
      4⤵
      PID:3132
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2028 -s 244
      4⤵
      Program crash
      PID:4132
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39250.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39250.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1819.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1819.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55099.exe
        5⤵
        
        PID:1620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2904.exe
        6⤵
        
        PID:6076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29001.exe
        6⤵
        
        PID:6552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62275.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48934.exe
        5⤵
        
        PID:2968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11984.exe
        5⤵
        
        PID:4116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46516.exe
        5⤵
        
        PID:6168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57581.exe
        5⤵
        
        PID:6832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5088.exe
        5⤵
        
        PID:7536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43017.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43017.exe
      4⤵
      PID:1244
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1244 -s 220
        5⤵
        Program crash
        
        PID:4072
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36281.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36281.exe
      4⤵
      PID:3220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5960.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5960.exe
      4⤵
      PID:4956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49397.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49397.exe
      4⤵
      PID:5440
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1732 -s 248
      4⤵
      PID:6184
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25561.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25561.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51482.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51482.exe
      4⤵
      PID:3288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34901.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34901.exe
      4⤵
      PID:4168
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2428 -s 240
      4⤵
      Program crash
      PID:5432
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39363.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39363.exe
    3⤵
    PID:1720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8462.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8462.exe
      4⤵
      PID:6480
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8026.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8026.exe
      4⤵
      PID:7312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11738.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11738.exe
      4⤵
      PID:7896
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8712.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8712.exe
    3⤵
    PID:3344
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18910.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18910.exe
    3⤵
    PID:2948
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11515.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11515.exe
    3⤵
    PID:6236
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35445.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35445.exe
    3⤵
    PID:6916
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37289.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37289.exe
    3⤵
    PID:7420
- C:\Users\Admin\AppData\Local\Temp\Unicorn-3173.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-3173.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:264
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17969.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17969.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18820.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18820.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17834.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:1412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60859.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3573.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1800
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1800 -s 224
        8⤵
        Program crash
        
        PID:2544
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2192 -s 228
        7⤵
        Program crash
        
        PID:2496
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1412 -s 248
        6⤵
        Program crash
        
        PID:1132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65498.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56806.exe
        6⤵
        
        PID:2856
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2856 -s 220
        7⤵
        Program crash
        
        PID:3972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59110.exe
        6⤵
        
        PID:3692
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2916 -s 224
        6⤵
        Program crash
        
        PID:4736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46400.exe
        5⤵
        
        PID:1812
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1812 -s 224
        6⤵
        Program crash
        
        PID:3716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62950.exe
        5⤵
        
        PID:3880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62832.exe
        5⤵
        
        PID:4100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2135.exe
        5⤵
        
        PID:5204
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2760 -s 240
        5⤵
        
        PID:5224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19457.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19457.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26049.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34300.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45836.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47071.exe
        8⤵
        
        PID:3708
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3368 -s 248
        8⤵
        Program crash
        
        PID:5064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7169.exe
        7⤵
        
        PID:3336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56094.exe
        7⤵
        
        PID:4228
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1396 -s 248
        7⤵
        
        PID:5564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35233.exe
        6⤵
        
        PID:1740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61700.exe
        7⤵
        
        PID:3944
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1740 -s 248
        7⤵
        Program crash
        
        PID:1604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6369.exe
        6⤵
        
        PID:4036
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2032 -s 248
        6⤵
        Program crash
        
        PID:4544
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1760 -s 248
        5⤵
        Program crash
        
        PID:1476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44423.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44423.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45758.exe
        5⤵
        
        PID:2780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4253.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3900.exe
        7⤵
        
        PID:3996
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2432 -s 216
        7⤵
        Program crash
        
        PID:4852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62592.exe
        6⤵
        
        PID:4088
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2780 -s 240
        6⤵
        Program crash
        
        PID:4796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8892.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61845.exe
        6⤵
        
        PID:3304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11632.exe
        6⤵
        
        PID:4204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21470.exe
        6⤵
        
        PID:5212
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1436 -s 248
        6⤵
        
        PID:6596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12736.exe
        5⤵
        
        PID:3272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61959.exe
        5⤵
        
        PID:4212
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2260 -s 224
        5⤵
        
        PID:5540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46370.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46370.exe
      4⤵
      PID:2196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34440.exe
        5⤵
        
        PID:2772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19298.exe
        6⤵
        
        PID:3472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38762.exe
        6⤵
        
        PID:5920
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2772 -s 224
        6⤵
        
        PID:6700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2701.exe
        5⤵
        
        PID:3524
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2196 -s 240
        5⤵
        Program crash
        
        PID:4868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50014.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50014.exe
      4⤵
      PID:2412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46407.exe
        5⤵
        
        PID:4280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54523.exe
        5⤵
        
        PID:5688
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2412 -s 220
        5⤵
        
        PID:6740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21605.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21605.exe
      4⤵
      PID:3644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63362.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63362.exe
      4⤵
      PID:4948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28396.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28396.exe
      4⤵
      PID:5876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13601.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13601.exe
      4⤵
      PID:6568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8751.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8751.exe
      4⤵
      PID:7960
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33572.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33572.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26879.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26879.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57351.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33506.exe
        6⤵
        
        PID:864
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 864 -s 224
        7⤵
        Program crash
        
        PID:2420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12628.exe
        6⤵
        
        PID:2972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54767.exe
        7⤵
        
        PID:4232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28072.exe
        7⤵
        
        PID:5412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56468.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1067.exe
        7⤵
        
        PID:7664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13105.exe
        7⤵
        
        PID:7360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61553.exe
        6⤵
        
        PID:3312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5960.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4940
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2500 -s 244
        6⤵
        
        PID:5524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13640.exe
        5⤵
        
        PID:1532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20398.exe
        6⤵
        
        PID:1060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8799.exe
        7⤵
        
        PID:3584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28975.exe
        7⤵
        
        PID:2164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40651.exe
        7⤵
        
        PID:6268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-709.exe
        7⤵
        
        PID:6256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21623.exe
        7⤵
        
        PID:7560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43926.exe
        6⤵
        
        PID:3608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25175.exe
        6⤵
        
        PID:4508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43480.exe
        6⤵
        
        PID:5164
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1532 -s 240
        6⤵
        
        PID:6496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4729.exe
        5⤵
        
        PID:328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35494.exe
        6⤵
        
        PID:5664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32426.exe
        6⤵
        
        PID:6856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38181.exe
        6⤵
        
        PID:7732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21770.exe
        6⤵
        
        PID:7408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26578.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30543.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18279.exe
        5⤵
        
        PID:5140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27146.exe
        5⤵
        
        PID:6504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9886.exe
        5⤵
        
        PID:7916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53822.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53822.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:3068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64232.exe
        5⤵
        
        PID:472
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 472 -s 244
        6⤵
        Program crash
        
        PID:1048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13827.exe
        5⤵
        
        PID:2508
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2508 -s 224
        6⤵
        Program crash
        
        PID:3896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55523.exe
        5⤵
        
        PID:3672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4398.exe
        5⤵
        
        PID:4904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34814.exe
        5⤵
        
        PID:5156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10080.exe
        5⤵
        
        PID:6156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60005.exe
        5⤵
        
        PID:8084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27375.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27375.exe
      4⤵
      PID:3048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14367.exe
        5⤵
        
        PID:2092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47372.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3536
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2092 -s 248
        6⤵
        Program crash
        
        PID:4680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42773.exe
        5⤵
        
        PID:3600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57765.exe
        5⤵
        
        PID:4620
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3048 -s 248
        5⤵
        
        PID:5532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20132.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20132.exe
      4⤵
      PID:1992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63215.exe
        5⤵
        
        PID:3912
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1992 -s 248
        5⤵
        Program crash
        
        PID:5116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64399.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64399.exe
      4⤵
      PID:4012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46296.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46296.exe
      4⤵
      PID:4912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49927.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49927.exe
      4⤵
      PID:5584
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2596 -s 236
      4⤵
      PID:6508
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6358.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6358.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38877.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38877.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2996
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2996 -s 224
        5⤵
        Program crash
        
        PID:1172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44367.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44367.exe
      4⤵
      PID:1628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11134.exe
        5⤵
        
        PID:3100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16390.exe
        6⤵
        
        PID:7644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34901.exe
        5⤵
        
        PID:4184
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1628 -s 220
        5⤵
        Program crash
        
        PID:5444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27562.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27562.exe
      4⤵
      PID:1588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6192.exe
        5⤵
        
        PID:8136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54502.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54502.exe
      4⤵
      PID:4104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39008.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39008.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5356
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2112 -s 248
      4⤵
      PID:6612
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16053.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16053.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3060
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3060 -s 240
      4⤵
      Program crash
      PID:2152
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55302.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55302.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30185.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30185.exe
      4⤵
      PID:3188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34901.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34901.exe
      4⤵
      PID:4160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41808.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41808.exe
      4⤵
      PID:5384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62333.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62333.exe
      4⤵
      PID:6708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57939.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57939.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7708
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2464 -s 248
      4⤵
      PID:7588
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8227.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8227.exe
    3⤵
    PID:2712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59946.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59946.exe
      4⤵
      PID:3704
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2712 -s 228
      4⤵
      Program crash
      PID:4144
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46367.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46367.exe
    3⤵
    PID:4120
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48733.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48733.exe
    3⤵
    PID:5456
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39584.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39584.exe
    3⤵
    PID:6756
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35803.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35803.exe
    3⤵
    PID:7652
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28771.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28771.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:7432
- C:\Users\Admin\AppData\Local\Temp\Unicorn-55585.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-55585.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2808
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43132.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43132.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19095.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19095.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30024.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47699.exe
        6⤵
        
        PID:2376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24366.exe
        7⤵
        
        PID:7880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11876.exe
        6⤵
        
        PID:3284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61761.exe
        6⤵
        
        PID:5232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12748.exe
        6⤵
        
        PID:6516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11561.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23897.exe
        6⤵
        
        PID:8044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45649.exe
        5⤵
        
        PID:3052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40465.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51897.exe
        6⤵
        
        PID:4932
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3052 -s 244
        6⤵
        
        PID:5244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24028.exe
        5⤵
        
        PID:3084
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2460 -s 248
        5⤵
        Program crash
        
        PID:5044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57221.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57221.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27196.exe
        5⤵
        
        PID:2212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42178.exe
        6⤵
        
        PID:6584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28721.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49839.exe
        6⤵
        
        PID:8176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23313.exe
        5⤵
        
        PID:3888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23037.exe
        5⤵
        
        PID:4252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8669.exe
        5⤵
        
        PID:5340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39937.exe
        5⤵
        
        PID:6288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14351.exe
        5⤵
        
        PID:7932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6099.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6099.exe
      4⤵
      PID:2580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12556.exe
        5⤵
        
        PID:4464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9105.exe
        5⤵
        
        PID:6060
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2580 -s 224
        5⤵
        
        PID:6540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20547.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20547.exe
      4⤵
      PID:3500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42988.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42988.exe
      4⤵
      PID:4416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32861.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32861.exe
      4⤵
      PID:5592
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1652 -s 240
      4⤵
      PID:6276
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27817.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27817.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34492.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34492.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30548.exe
        5⤵
        
        PID:752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45509.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38274.exe
        6⤵
        
        PID:4312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52197.exe
        6⤵
        
        PID:5780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35281.exe
        6⤵
        
        PID:6676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59475.exe
        6⤵
        
        PID:8100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57356.exe
        5⤵
        
        PID:3144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-95.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-95.exe
        5⤵
        
        PID:4988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58062.exe
        5⤵
        
        PID:5300
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2864 -s 240
        5⤵
        
        PID:6300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33048.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33048.exe
      4⤵
      PID:540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37943.exe
        5⤵
        
        PID:3780
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 540 -s 248
        5⤵
        Program crash
        
        PID:4700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59031.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59031.exe
      4⤵
      PID:3980
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1520 -s 248
      4⤵
      Program crash
      PID:5108
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56950.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56950.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33226.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33226.exe
      4⤵
      PID:2604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32401.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4400
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2604 -s 228
        5⤵
        Program crash
        
        PID:6068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15721.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15721.exe
      4⤵
      PID:4056
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1240 -s 244
      4⤵
      Program crash
      PID:2336
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21585.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21585.exe
    3⤵
    PID:1600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2141.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2141.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7735.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7735.exe
      4⤵
      PID:5320
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1600 -s 244
      4⤵
      PID:6620
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30740.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30740.exe
    3⤵
    PID:3160
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58186.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58186.exe
    3⤵
    PID:4816
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38381.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38381.exe
    3⤵
    PID:5428
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58069.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58069.exe
    3⤵
    PID:6824
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60825.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60825.exe
    3⤵
    PID:7388
- C:\Users\Admin\AppData\Local\Temp\Unicorn-51035.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-51035.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:1696
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51767.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51767.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34492.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34492.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44409.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21576.exe
        6⤵
        
        PID:3652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26915.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60381.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61015.exe
        6⤵
        
        PID:7584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11637.exe
        5⤵
        
        PID:3064
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2540 -s 244
        5⤵
        Program crash
        
        PID:932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40879.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40879.exe
      4⤵
      PID:2440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8088.exe
        5⤵
        
        PID:4348
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2440 -s 228
        5⤵
        Program crash
        
        PID:6088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62129.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62129.exe
      4⤵
      PID:3460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48576.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48576.exe
      4⤵
      PID:2064
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 772 -s 224
      4⤵
      PID:6260
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43214.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43214.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:444
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 444 -s 224
      4⤵
      Program crash
      PID:1420
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38855.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38855.exe
    3⤵
    PID:2352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29168.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29168.exe
      4⤵
      PID:4360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54606.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54606.exe
      4⤵
      PID:5284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29415.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29415.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2603.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2603.exe
      4⤵
      PID:8036
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-319.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-319.exe
    3⤵
    PID:3656
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9184.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9184.exe
    3⤵
    PID:4824
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21315.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21315.exe
    3⤵
    PID:5724
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14063.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14063.exe
    3⤵
    PID:6840
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-623.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-623.exe
    3⤵
    PID:7400
- C:\Users\Admin\AppData\Local\Temp\Unicorn-16926.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-16926.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:684
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58996.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58996.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10475.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10475.exe
      4⤵
      PID:2552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32873.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3364
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2552 -s 236
        5⤵
        Program crash
        
        PID:4876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8731.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8731.exe
      4⤵
      PID:3732
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 688 -s 240
      4⤵
      Program crash
      PID:4860
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62177.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62177.exe
    3⤵
    PID:900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25883.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25883.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3480
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44030.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44030.exe
      4⤵
      PID:4644
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 900 -s 224
      4⤵
      PID:5788
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33950.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33950.exe
    3⤵
    PID:3660
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 684 -s 248
    3⤵
    - Program crash
    PID:4656
- C:\Users\Admin\AppData\Local\Temp\Unicorn-27308.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-27308.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:296
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 296 -s 220
    3⤵
    - Program crash
    PID:2316
- C:\Users\Admin\AppData\Local\Temp\Unicorn-30472.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-30472.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2744
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49448.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49448.exe
    3⤵
    PID:3128
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59702.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59702.exe
    3⤵
    PID:5128
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2744 -s 224
    3⤵
    PID:6244
- C:\Users\Admin\AppData\Local\Temp\Unicorn-9356.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-9356.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3448
- C:\Users\Admin\AppData\Local\Temp\Unicorn-12568.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-12568.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4340
- C:\Users\Admin\AppData\Local\Temp\Unicorn-27261.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-27261.exe
  2⤵
  PID:5892
- C:\Users\Admin\AppData\Local\Temp\Unicorn-55602.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-55602.exe
  2⤵
  PID:6472
- C:\Users\Admin\AppData\Local\Temp\Unicorn-28351.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-28351.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:7924

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-17969.exe

Filesize
468KB

MD5
4d27440f0aeaf30b0acb662b2627412c

SHA1
abbd2f378b32e34a0a892f9a3342d5eb290ab953

SHA256
6396fbe2bf7d3ada2bb44135c431d4196d16e611b4edfbb62c164f8b77801cd0

SHA512
1a9529888128bb820805ffd356f5d7efc00eafccf514bae3ba177a445635aa484a53d1400ba52c2b0ca9cf5823cdbe7931d46183903af11a96e4469397774729

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-19457.exe

Filesize
468KB

MD5
58052af4c3c34ab71555d22ab499940e

SHA1
63c8f469aae73c4489b274617d8e0c93b03eb2a8

SHA256
1c72aed2d7649d4e759b2b369d4868aef7e20056b913b67cfff19afd5353338c

SHA512
517bb6ce66293a9f9712dd12e09556225f7017038ae157322c6d74409aa8da192569b4ef793b7d1f80ebd20e1f0646da1e4a24f5ca21edfc19c612a6c157769f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-37002.exe

Filesize
468KB

MD5
214480648490503b9a0023e7c4a80340

SHA1
0cd7c393f22d0cd571ee42dfa0e22fb4663a56d6

SHA256
24e9c481524f2ca5615960389a6dee8bc83a5958c3be2e26a7d2656a6bbfd833

SHA512
5617548a2e5cd640dcde6b7c2b21fa424cd62ae60c15b5e743b28dba81c43e45fcdb024bd6ce1c5755e70b98e21d72ebe7e7154812dd3d6c1b8fbf12e2025081

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-40465.exe

Filesize
468KB

MD5
7efc5c804aea2cf96e14505fd382dc9b

SHA1
bb1c087184efcbb1d38c9d083ecfdd1904ccc287

SHA256
7aefa4c4b9d8d2ffeed4d7eb790e99d232083cbabf295cb9d76edcd5bc8615c2

SHA512
6aa91ebe08bc26834d7059c02c7e4bc3490e610096ff0c7d2f629237e59b3815aea1130e2916a486ada03e76e8937fe15225ac18e7b161631b19bf64b74aa705

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-42213.exe

Filesize
468KB

MD5
dce679909fe6e0d40ed97cbcf15e443f

SHA1
68c63baa176207bda39f052ea557c765c390fe33

SHA256
6e759f162c145b3f38dfb74873e220d1ec8dbac6edc8aa8c6c769fc09c7e80f7

SHA512
923c16417509b481e677436927a6c257791f7d2bf06d7657327c81ea3c36671109da69c8d1adb3b1803568a248f62591ac9e4f682099e7cb515125b981b27a9d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-43132.exe

Filesize
468KB

MD5
aa9abfb3ee305dbb8ee9334cbddf70c4

SHA1
98f7b9ccef0d6788626c4bf2d6f05f2b2f7f0264

SHA256
7a88cd53597e342491b679b0f46cd6a265f52596dc0dbb17fc77c3f247d95998

SHA512
c9926f38fc2e1c55174186206313276cdb72e7d2b4cf72f35960045d3b88029ac6f552d2e68356acde0087e623dae10c5914ddd15d218c5fd4426b343a7bbdaa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-49909.exe

Filesize
468KB

MD5
1a3d9c5d016ed026fe591438427b42e7

SHA1
3969db1803482c86d6ec89164cc4222c09aee10e

SHA256
92a1d3191026d353c6e8579f8b995439fca97e63e38912858f61371f744123dd

SHA512
25c694558b25e8e4f2b0a19220463178e6029a3f01b4a64ff457bfae3fb7a7b98fa4948e7b596a807490d6bbdf448cf7f584cba6e24371dba757877d0e0633a3

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-17834.exe

Filesize
468KB

MD5
0f6f65072172188fd296b32e166e303d

SHA1
f544a72a93386d326976803ed6930c379dfbbd44

SHA256
677a05af69c3607caaff8fda9ddb869ab606358ee13f5a54ce19d1cb90487bfb

SHA512
79ea17235a937a4207a230fb6f4daaa891d13b50901144d169e935acc44b811f6f3c5eabea0fd1d33e1e5527907e4f5530adb5d8cf63e264b24c055e5df567b7

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-18820.exe

Filesize
468KB

MD5
c4aebccc6662c480748352131069c16d

SHA1
d4b401111b7f5b6552f9830f6cc9192d0961743d

SHA256
f4fba8a0e5f4cae714297cabe21cb91d82519a2e415f5246e7529f06c4ad5913

SHA512
3ac9e37517bfb20aedda3e3bd4db592cdfd0ed47d17f6f92f4027e7777ac905933e5464db3eeaa11687c65b45f5bb3047b381ec8a329c20cd273b9886f56abb8

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-26879.exe

Filesize
468KB

MD5
377233b887f668b1654305055aacc7c4

SHA1
d7a9a1d0b0cb377b9e2c4c62bbebaf8d94ee056f

SHA256
a182359810fc4119d45cd5ce6d23992512639b8b46c7b2c4b45fd25a1b1746d0

SHA512
e510fcbbdad544177b06c655e5a85157cdf2aa5dc1b2470ac309109722885816ddcf809bcb84479f0801099f30497350a2f3cd9a9343ec3d631fa214a49f84c5

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-3173.exe

Filesize
468KB

MD5
ea3c643998be1f963730e4fae968f322

SHA1
c701815dcd93a711ac51ad1149291e828fef8b36

SHA256
d75ffb89b8b87a4483dde584abbf1d180f63080e1ff4dac316c602f978436d6e

SHA512
78cdf274954d05c1d19abf6bac3893d8c90f9923cfa74c7e552d0459d8574ed5fc573e894894f4a4f5baad66df6433b0d297f9fd415e71e1e9735d07548de92f

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-33572.exe

Filesize
468KB

MD5
874af2aee1eaec512a0273ac80c72691

SHA1
ae0e20df1511c73cd738ee518865a679900424cd

SHA256
37a22f31b1ed2963f0be5b15904a87e8b2ecf9ee48f2e9d695732929e04178d6

SHA512
99219ab7d663850d5bb8c841135fa4c069b1a4426ab3ccf12b7f8a7888933a89745c4f2a3abc0649e721fe1d24bf1efa08eb38890a16a8f5e6ec671d86b58148

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-34964.exe

Filesize
468KB

MD5
3fb9ee5ff8cd92c0c92f9ecb9cd3112f

SHA1
4e32c198d7adcb0fa8559045c419a959af05606b

SHA256
ae930670ff77b848198fd4ebfd7fbe6f0e32083814e7e02560d717e24f0e4ca5

SHA512
5b935e41a360b42654f6a668f0d60b18074cd45b1a792a7e846ceb1be3bde3b9659f9da5dd4850c5c14cd36decee0c1bd6fe20ad395d8dcb9c69537b5bf9f6d6

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-37765.exe

Filesize
468KB

MD5
9854fbbfb9c5a44fab6a5461bf386ffd

SHA1
55b2e641491592c8724ff882c4effd44c39fa22a

SHA256
beb9e4acfaff2bc80ccaed55f5cbbfad8bd03ffbb8357b31bedce4cdc091bc5c

SHA512
b9ff16bdf71d23f0caee459b58f388a3ac1212ba0bb635b83dbdc5912e5ecc97843d9e597232f1a9afc0de8a87ac586eff4f38599761aad20edf0b1070c3d349

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-49598.exe

Filesize
468KB

MD5
4786af93b3e43b9669020edf6f74728e

SHA1
a145ae1fbffbba7bba009aeb41ffa4e03ef47eef

SHA256
c5f11597cedcce26505ff382b89a8eee731f72b65856ba343539f9de714cd3c5

SHA512
3edab410b077b01f0ba55acb43c62c9d853f1c90f636fb1aa54e6536b22389393fd995ea3f09b7b1db480884211b61b57e3a653bafad612996a387497b6813f1

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-51035.exe

Filesize
468KB

MD5
0be2a489fd6a35e63f24a0f51be4cd9e

SHA1
a662c7d884f34e3c1103be46d50e4b7e0755612c

SHA256
7b4172610ed3faacf1857fa8dd9323dd2b6d1861d9f2424eff9845c4406edbfa

SHA512
8d6150f26fa295e27452010f8e2e9a997f2b9d2852c77f6ff682fa3af36bc562b31783a815d26fda0f1c9715ace445b6172b68fbc4e588b1537b286525524a14

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-55585.exe

Filesize
468KB

MD5
05cee9aba3f7e0f6a13eba4a54c3cac4

SHA1
11adf05df4393f566a4e23305675b7b6f87e95e0

SHA256
afa37fa4fe7e6e169fe15a4c8fa9254c23180df64c1fe75e171cbb846b60990b

SHA512
35cd710f4d0f5277951b230442a919602d0a190d2d22e6bd26ead95331b73f39e0d4123f1adb66d2bb3f8b86fe3aefb92cba51f47b3fc52cf94d41e8ccb4b6be

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-61606.exe

Filesize
468KB

MD5
5617382f15de4c11ee302a5d8df96f78

SHA1
d1433e20b3e436d41e9ffaaf5c742c29e02ed7b1

SHA256
c77419240beb15c44b14122fb2035fabca8a13728d80c5c4d2cfe1afb9d2dea5

SHA512
c153a0691e25528dd0db5884faa7a48156635a8211560714bda94e40e262a60760fe744250984daf2ac1682ec22e62d390d5ac18878d00982b22302acf87fd9b

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-61933.exe

Filesize
468KB

MD5
5dc6ec4dab36fc0835d5852f05eaa1b5

SHA1
76e548c45e27197d4d6d7d450393da7b6aa496ef

SHA256
3b95f01d559d85fa5eaae7365e4eba0a0bcf075abda0a4289088385d3a04284d

SHA512
5d1f3f58bdfd534ff92e6b56881ea45a88974f8575014cc3c35054fa2753853a35151f09cf29653c8c74c4eb4b1b3134fd0ebcb73e1eddd5e766654ddb4977c1

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-6358.exe

Filesize
468KB

MD5
edcb6b74df19e521ac0ac6a577965699

SHA1
b8f85ff20db8e8036ae744344bb5bdd00728ab62

SHA256
e242e4cf2a1f4fa028843f4413473cd00c17e2ba752613780c2baf1f6b064c2a

SHA512
618e2cf669ecda181c2e118c8778a962df734603b46ac7254223882feeb795b8678c68fdaef50c6d85172da0411c81b3e7c9ed1a17ac57687a44014f5bd126ce

Download Submit