78e0eb893431960bd723998744a855fc1d6e9932e0a17773ef26fcb48926f28f

Analysis

max time kernel
147s
max time network
128s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
07/09/2024, 23:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

78e0eb893431960bd723998744a855fc1d6e9932e0a17773ef26fcb48926f28f.exe
Size

468KB
MD5

c8013aaac2f36bf885ff313ba6312496
SHA1

67201bbee091afda911a962e37b19c9ae27137c7
SHA256

78e0eb893431960bd723998744a855fc1d6e9932e0a17773ef26fcb48926f28f
SHA512

974f2c1b072c45e2f8d720e6e333abf581433581d78a442ea21847f24487f4ade4e73bb4440b1212933f78d8f3859470f646d60d4e68faf01574504be005e94b
SSDEEP

3072:iOAoogIdId5CtbYiYztjcf8/qCtvPTpShmHeLVUGtO78Q/HPBtlx:iObowbCtNYJjcfMNiVtOoWHPB

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2352	Unicorn-39904.exe
804	Unicorn-57200.exe
2644	Unicorn-32181.exe
2776	Unicorn-61367.exe
2684	Unicorn-49862.exe
2572	Unicorn-45123.exe
1444	Unicorn-8274.exe
2600	Unicorn-4273.exe
1096	Unicorn-5404.exe
2876	Unicorn-63972.exe
1664	Unicorn-10687.exe
1868	Unicorn-45233.exe
924	Unicorn-51812.exe
1932	Unicorn-23132.exe
2844	Unicorn-40406.exe
2012	Unicorn-848.exe
392	Unicorn-31937.exe
1732	Unicorn-25161.exe
1500	Unicorn-748.exe
2020	Unicorn-27743.exe
1800	Unicorn-52061.exe
1652	Unicorn-63129.exe
1324	Unicorn-58853.exe
1440	Unicorn-36222.exe
2280	Unicorn-32957.exe
2152	Unicorn-26181.exe
1580	Unicorn-30627.exe
1672	Unicorn-50493.exe
2632	Unicorn-51240.exe
800	Unicorn-15774.exe
2240	Unicorn-28511.exe
2752	Unicorn-19335.exe
2744	Unicorn-53591.exe
2672	Unicorn-12366.exe
2532	Unicorn-64260.exe
1376	Unicorn-12458.exe
2092	Unicorn-26757.exe
2328	Unicorn-46611.exe
2952	Unicorn-50191.exe
1736	Unicorn-44930.exe
1016	Unicorn-25064.exe
2424	Unicorn-10119.exe
2116	Unicorn-39019.exe
828	Unicorn-20810.exe
1984	Unicorn-13196.exe
944	Unicorn-33062.exe
1520	Unicorn-55795.exe
364	Unicorn-2994.exe
1740	Unicorn-15338.exe
2480	Unicorn-856.exe
1600	Unicorn-1167.exe
3008	Unicorn-58039.exe
1540	Unicorn-1432.exe
2700	Unicorn-1432.exe
1544	Unicorn-55272.exe
1116	Unicorn-9600.exe
2992	Unicorn-13684.exe
3052	Unicorn-2424.exe
2624	Unicorn-57026.exe
1620	Unicorn-42635.exe
2504	Unicorn-38573.exe
1144	Unicorn-61686.exe
2944	Unicorn-28267.exe
2840	Unicorn-1816.exe

Loads dropped DLL 64 IoCs

pid	Process
2108	78e0eb893431960bd723998744a855fc1d6e9932e0a17773ef26fcb48926f28f.exe
2108	78e0eb893431960bd723998744a855fc1d6e9932e0a17773ef26fcb48926f28f.exe
2352	Unicorn-39904.exe
2352	Unicorn-39904.exe
2108	78e0eb893431960bd723998744a855fc1d6e9932e0a17773ef26fcb48926f28f.exe
2108	78e0eb893431960bd723998744a855fc1d6e9932e0a17773ef26fcb48926f28f.exe
804	Unicorn-57200.exe
804	Unicorn-57200.exe
2352	Unicorn-39904.exe
2644	Unicorn-32181.exe
2644	Unicorn-32181.exe
2352	Unicorn-39904.exe
2108	78e0eb893431960bd723998744a855fc1d6e9932e0a17773ef26fcb48926f28f.exe
2108	78e0eb893431960bd723998744a855fc1d6e9932e0a17773ef26fcb48926f28f.exe
2776	Unicorn-61367.exe
2776	Unicorn-61367.exe
804	Unicorn-57200.exe
804	Unicorn-57200.exe
2572	Unicorn-45123.exe
2572	Unicorn-45123.exe
2108	78e0eb893431960bd723998744a855fc1d6e9932e0a17773ef26fcb48926f28f.exe
2108	78e0eb893431960bd723998744a855fc1d6e9932e0a17773ef26fcb48926f28f.exe
2684	Unicorn-49862.exe
2684	Unicorn-49862.exe
2352	Unicorn-39904.exe
2352	Unicorn-39904.exe
1444	Unicorn-8274.exe
1444	Unicorn-8274.exe
2644	Unicorn-32181.exe
2644	Unicorn-32181.exe
2600	Unicorn-4273.exe
2600	Unicorn-4273.exe
2776	Unicorn-61367.exe
2776	Unicorn-61367.exe
1096	Unicorn-5404.exe
1096	Unicorn-5404.exe
804	Unicorn-57200.exe
804	Unicorn-57200.exe
1868	Unicorn-45233.exe
1868	Unicorn-45233.exe
2108	78e0eb893431960bd723998744a855fc1d6e9932e0a17773ef26fcb48926f28f.exe
2108	78e0eb893431960bd723998744a855fc1d6e9932e0a17773ef26fcb48926f28f.exe
924	Unicorn-51812.exe
1664	Unicorn-10687.exe
924	Unicorn-51812.exe
1664	Unicorn-10687.exe
2352	Unicorn-39904.exe
2352	Unicorn-39904.exe
2684	Unicorn-49862.exe
2684	Unicorn-49862.exe
2876	Unicorn-63972.exe
2876	Unicorn-63972.exe
2572	Unicorn-45123.exe
2844	Unicorn-40406.exe
2572	Unicorn-45123.exe
2844	Unicorn-40406.exe
1444	Unicorn-8274.exe
1444	Unicorn-8274.exe
2644	Unicorn-32181.exe
2644	Unicorn-32181.exe
2464	WerFault.exe
2464	WerFault.exe
2464	WerFault.exe
2464	WerFault.exe

Program crash 59 IoCs

pid	pid_target	Process	procid_target
2464	1932	WerFault.exe	44
1812	1800	WerFault.exe	51
2560	2328	WerFault.exe	69
1852	944	WerFault.exe	78
952	3048	WerFault.exe	105
2792	2744	WerFault.exe	64
1560	2240	WerFault.exe	62
3340	1704	WerFault.exe	104
3868	2504	WerFault.exe	94
3076	1736	WerFault.exe	70
3352	1620	WerFault.exe	93
3432	1324	WerFault.exe	52
3420	1016	WerFault.exe	72
3392	2152	WerFault.exe	56
3840	2760	WerFault.exe	106
4008	1544	WerFault.exe	87
3980	928	WerFault.exe	100
3968	3040	WerFault.exe	98
3448	2884	WerFault.exe	108
3436	828	WerFault.exe	76
3452	2752	WerFault.exe	63
5008	2876	WerFault.exe	40
5024	1096	WerFault.exe	39
5072	3056	WerFault.exe	129
4216	2952	WerFault.exe	73
4184	2628	WerFault.exe	167
4276	2532	WerFault.exe	66
4208	392	WerFault.exe	47
964	1652	WerFault.exe	53
4160	1868	WerFault.exe	41
4152	804	WerFault.exe	32
4288	3008	WerFault.exe	84
4300	1600	WerFault.exe	83
4128	1732	WerFault.exe	48
4348	1688	WerFault.exe	103
4380	2352	WerFault.exe	31
4356	3052	WerFault.exe	91
4460	2840	WerFault.exe	97
4476	2232	WerFault.exe	101
4560	2672	WerFault.exe	65
4540	1376	WerFault.exe	67
4524	1984	WerFault.exe	77
4580	2424	WerFault.exe	74
4548	1672	WerFault.exe	58
4820	2480	WerFault.exe	82
4872	2632	WerFault.exe	60
6056	1520	WerFault.exe	79
5168	2700	WerFault.exe	85
6088	2992	WerFault.exe	90
6108	2728	WerFault.exe	102
5192	924	WerFault.exe	43
5160	2280	WerFault.exe	55
5220	2092	WerFault.exe	68
5224	2944	WerFault.exe	96
5768	3068	WerFault.exe	112
5744	1884	WerFault.exe	110
6232	2020	WerFault.exe	50
6740	1580	WerFault.exe	57
6872	364	WerFault.exe	80

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39571.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20483.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26979.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22144.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10650.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16876.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26777.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55009.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1754.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19436.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9358.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38579.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42031.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9695.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21706.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54273.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1683.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35762.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10597.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14293.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44930.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3953.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52450.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46281.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42337.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50051.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34945.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30865.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15041.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65065.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17964.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35356.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4219.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-856.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46087.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56553.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5803.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12158.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60359.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63972.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37525.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62340.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37281.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55272.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3643.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54210.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19096.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23132.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51240.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1432.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1256.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25064.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2994.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31372.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33807.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53508.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52610.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18527.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9963.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33062.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50995.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7762.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25040.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15594.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2108	78e0eb893431960bd723998744a855fc1d6e9932e0a17773ef26fcb48926f28f.exe
2352	Unicorn-39904.exe
804	Unicorn-57200.exe
2644	Unicorn-32181.exe
2776	Unicorn-61367.exe
2684	Unicorn-49862.exe
2572	Unicorn-45123.exe
1444	Unicorn-8274.exe
1096	Unicorn-5404.exe
2600	Unicorn-4273.exe
2876	Unicorn-63972.exe
1868	Unicorn-45233.exe
1664	Unicorn-10687.exe
1932	Unicorn-23132.exe
924	Unicorn-51812.exe
2844	Unicorn-40406.exe
2012	Unicorn-848.exe
1732	Unicorn-25161.exe
392	Unicorn-31937.exe
1500	Unicorn-748.exe
1324	Unicorn-58853.exe
2020	Unicorn-27743.exe
1652	Unicorn-63129.exe
1800	Unicorn-52061.exe
1440	Unicorn-36222.exe
1580	Unicorn-30627.exe
2280	Unicorn-32957.exe
2152	Unicorn-26181.exe
2632	Unicorn-51240.exe
1672	Unicorn-50493.exe
800	Unicorn-15774.exe
2240	Unicorn-28511.exe
2752	Unicorn-19335.exe
2744	Unicorn-53591.exe
2672	Unicorn-12366.exe
1016	Unicorn-25064.exe
1376	Unicorn-12458.exe
2328	Unicorn-46611.exe
944	Unicorn-33062.exe
2532	Unicorn-64260.exe
2092	Unicorn-26757.exe
2952	Unicorn-50191.exe
2424	Unicorn-10119.exe
1736	Unicorn-44930.exe
1984	Unicorn-13196.exe
828	Unicorn-20810.exe
2116	Unicorn-39019.exe
1520	Unicorn-55795.exe
364	Unicorn-2994.exe
2480	Unicorn-856.exe
2992	Unicorn-13684.exe
1620	Unicorn-42635.exe
1740	Unicorn-15338.exe
1600	Unicorn-1167.exe
2700	Unicorn-1432.exe
1116	Unicorn-9600.exe
1544	Unicorn-55272.exe
3052	Unicorn-2424.exe
3008	Unicorn-58039.exe
2624	Unicorn-57026.exe
1540	Unicorn-1432.exe
1144	Unicorn-61686.exe
2504	Unicorn-38573.exe
3004	Unicorn-55001.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2108 wrote to memory of 2352	2108	78e0eb893431960bd723998744a855fc1d6e9932e0a17773ef26fcb48926f28f.exe	31
PID 2108 wrote to memory of 2352	2108	78e0eb893431960bd723998744a855fc1d6e9932e0a17773ef26fcb48926f28f.exe	31
PID 2108 wrote to memory of 2352	2108	78e0eb893431960bd723998744a855fc1d6e9932e0a17773ef26fcb48926f28f.exe	31
PID 2108 wrote to memory of 2352	2108	78e0eb893431960bd723998744a855fc1d6e9932e0a17773ef26fcb48926f28f.exe	31
PID 2352 wrote to memory of 804	2352	Unicorn-39904.exe	32
PID 2352 wrote to memory of 804	2352	Unicorn-39904.exe	32
PID 2352 wrote to memory of 804	2352	Unicorn-39904.exe	32
PID 2352 wrote to memory of 804	2352	Unicorn-39904.exe	32
PID 2108 wrote to memory of 2644	2108	78e0eb893431960bd723998744a855fc1d6e9932e0a17773ef26fcb48926f28f.exe	33
PID 2108 wrote to memory of 2644	2108	78e0eb893431960bd723998744a855fc1d6e9932e0a17773ef26fcb48926f28f.exe	33
PID 2108 wrote to memory of 2644	2108	78e0eb893431960bd723998744a855fc1d6e9932e0a17773ef26fcb48926f28f.exe	33
PID 2108 wrote to memory of 2644	2108	78e0eb893431960bd723998744a855fc1d6e9932e0a17773ef26fcb48926f28f.exe	33
PID 804 wrote to memory of 2776	804	Unicorn-57200.exe	34
PID 804 wrote to memory of 2776	804	Unicorn-57200.exe	34
PID 804 wrote to memory of 2776	804	Unicorn-57200.exe	34
PID 804 wrote to memory of 2776	804	Unicorn-57200.exe	34
PID 2644 wrote to memory of 1444	2644	Unicorn-32181.exe	36
PID 2644 wrote to memory of 1444	2644	Unicorn-32181.exe	36
PID 2644 wrote to memory of 1444	2644	Unicorn-32181.exe	36
PID 2644 wrote to memory of 1444	2644	Unicorn-32181.exe	36
PID 2352 wrote to memory of 2684	2352	Unicorn-39904.exe	35
PID 2352 wrote to memory of 2684	2352	Unicorn-39904.exe	35
PID 2352 wrote to memory of 2684	2352	Unicorn-39904.exe	35
PID 2352 wrote to memory of 2684	2352	Unicorn-39904.exe	35
PID 2108 wrote to memory of 2572	2108	78e0eb893431960bd723998744a855fc1d6e9932e0a17773ef26fcb48926f28f.exe	37
PID 2108 wrote to memory of 2572	2108	78e0eb893431960bd723998744a855fc1d6e9932e0a17773ef26fcb48926f28f.exe	37
PID 2108 wrote to memory of 2572	2108	78e0eb893431960bd723998744a855fc1d6e9932e0a17773ef26fcb48926f28f.exe	37
PID 2108 wrote to memory of 2572	2108	78e0eb893431960bd723998744a855fc1d6e9932e0a17773ef26fcb48926f28f.exe	37
PID 2776 wrote to memory of 2600	2776	Unicorn-61367.exe	38
PID 2776 wrote to memory of 2600	2776	Unicorn-61367.exe	38
PID 2776 wrote to memory of 2600	2776	Unicorn-61367.exe	38
PID 2776 wrote to memory of 2600	2776	Unicorn-61367.exe	38
PID 804 wrote to memory of 1096	804	Unicorn-57200.exe	39
PID 804 wrote to memory of 1096	804	Unicorn-57200.exe	39
PID 804 wrote to memory of 1096	804	Unicorn-57200.exe	39
PID 804 wrote to memory of 1096	804	Unicorn-57200.exe	39
PID 2572 wrote to memory of 2876	2572	Unicorn-45123.exe	40
PID 2572 wrote to memory of 2876	2572	Unicorn-45123.exe	40
PID 2572 wrote to memory of 2876	2572	Unicorn-45123.exe	40
PID 2572 wrote to memory of 2876	2572	Unicorn-45123.exe	40
PID 2108 wrote to memory of 1868	2108	78e0eb893431960bd723998744a855fc1d6e9932e0a17773ef26fcb48926f28f.exe	41
PID 2108 wrote to memory of 1868	2108	78e0eb893431960bd723998744a855fc1d6e9932e0a17773ef26fcb48926f28f.exe	41
PID 2108 wrote to memory of 1868	2108	78e0eb893431960bd723998744a855fc1d6e9932e0a17773ef26fcb48926f28f.exe	41
PID 2108 wrote to memory of 1868	2108	78e0eb893431960bd723998744a855fc1d6e9932e0a17773ef26fcb48926f28f.exe	41
PID 2684 wrote to memory of 1664	2684	Unicorn-49862.exe	42
PID 2684 wrote to memory of 1664	2684	Unicorn-49862.exe	42
PID 2684 wrote to memory of 1664	2684	Unicorn-49862.exe	42
PID 2684 wrote to memory of 1664	2684	Unicorn-49862.exe	42
PID 2352 wrote to memory of 924	2352	Unicorn-39904.exe	43
PID 2352 wrote to memory of 924	2352	Unicorn-39904.exe	43
PID 2352 wrote to memory of 924	2352	Unicorn-39904.exe	43
PID 2352 wrote to memory of 924	2352	Unicorn-39904.exe	43
PID 1444 wrote to memory of 1932	1444	Unicorn-8274.exe	44
PID 1444 wrote to memory of 1932	1444	Unicorn-8274.exe	44
PID 1444 wrote to memory of 1932	1444	Unicorn-8274.exe	44
PID 1444 wrote to memory of 1932	1444	Unicorn-8274.exe	44
PID 2644 wrote to memory of 2844	2644	Unicorn-32181.exe	45
PID 2644 wrote to memory of 2844	2644	Unicorn-32181.exe	45
PID 2644 wrote to memory of 2844	2644	Unicorn-32181.exe	45
PID 2644 wrote to memory of 2844	2644	Unicorn-32181.exe	45
PID 2600 wrote to memory of 2012	2600	Unicorn-4273.exe	46
PID 2600 wrote to memory of 2012	2600	Unicorn-4273.exe	46
PID 2600 wrote to memory of 2012	2600	Unicorn-4273.exe	46
PID 2600 wrote to memory of 2012	2600	Unicorn-4273.exe	46

C:\Users\Admin\AppData\Local\Temp\78e0eb893431960bd723998744a855fc1d6e9932e0a17773ef26fcb48926f28f.exe
"C:\Users\Admin\AppData\Local\Temp\78e0eb893431960bd723998744a855fc1d6e9932e0a17773ef26fcb48926f28f.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2108
- C:\Users\Admin\AppData\Local\Temp\Unicorn-39904.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-39904.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2352
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57200.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57200.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61367.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61367.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4273.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-848.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28511.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13684.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1323.exe
        9⤵
        
        PID:2456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13160.exe
        10⤵
        
        PID:2972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26346.exe
        10⤵
        
        PID:3796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7404.exe
        10⤵
        
        PID:5060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3534.exe
        10⤵
        
        PID:1460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1745.exe
        10⤵
        
        PID:5748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49371.exe
        10⤵
        
        PID:6796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5939.exe
        10⤵
        
        PID:7028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35121.exe
        9⤵
        
        PID:1132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39807.exe
        9⤵
        
        PID:3084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21354.exe
        9⤵
        
        PID:4716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18906.exe
        9⤵
        
        PID:4892
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2992 -s 248
        9⤵
        Program crash
        
        PID:6088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2454.exe
        8⤵
        
        PID:2292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2865.exe
        9⤵
        
        PID:4800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48423.exe
        9⤵
        
        PID:5232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20518.exe
        9⤵
        
        PID:5884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65273.exe
        9⤵
        
        PID:6516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10980.exe
        9⤵
        
        PID:6572
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2240 -s 240
        8⤵
        Program crash
        
        PID:1560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42635.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63591.exe
        8⤵
        
        PID:3056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34951.exe
        9⤵
        
        PID:2380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21686.exe
        9⤵
        
        PID:3404
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3056 -s 244
        9⤵
        Program crash
        
        PID:5072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62532.exe
        8⤵
        
        PID:2712
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1620 -s 240
        8⤵
        Program crash
        
        PID:3352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37041.exe
        7⤵
        
        PID:1952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52330.exe
        7⤵
        
        PID:1764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55611.exe
        7⤵
        
        PID:3768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15910.exe
        7⤵
        
        PID:4484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23323.exe
        7⤵
        
        PID:5984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53894.exe
        7⤵
        
        PID:5260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18020.exe
        7⤵
        
        PID:6500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58466.exe
        7⤵
        
        PID:4636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19335.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2994.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21184.exe
        8⤵
        
        PID:3356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34945.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2957.exe
        8⤵
        
        PID:4660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43711.exe
        8⤵
        
        PID:6124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9358.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23928.exe
        8⤵
        
        PID:6264
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 364 -s 244
        8⤵
        Program crash
        
        PID:6872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8505.exe
        7⤵
        
        PID:2112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3953.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3880
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2752 -s 248
        7⤵
        Program crash
        
        PID:3452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15338.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28257.exe
        7⤵
        
        PID:3412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56025.exe
        7⤵
        
        PID:4332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29298.exe
        7⤵
        
        PID:4504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24827.exe
        7⤵
        
        PID:5820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10593.exe
        7⤵
        
        PID:6520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50052.exe
        7⤵
        
        PID:6492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46087.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24884.exe
        7⤵
        
        PID:2000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4219.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60326.exe
        7⤵
        
        PID:4588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39627.exe
        7⤵
        
        PID:6032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27832.exe
        7⤵
        
        PID:5628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50571.exe
        7⤵
        
        PID:7156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15594.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6799.exe
        6⤵
        
        PID:3456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17669.exe
        6⤵
        
        PID:3692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5155.exe
        6⤵
        
        PID:4924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54008.exe
        6⤵
        
        PID:6000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48559.exe
        6⤵
        
        PID:5996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18328.exe
        6⤵
        
        PID:6112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30730.exe
        6⤵
        
        PID:6788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31937.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53591.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1432.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3586.exe
        8⤵
        
        PID:2608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35329.exe
        8⤵
        
        PID:3720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7425.exe
        8⤵
        
        PID:4908
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2700 -s 248
        8⤵
        Program crash
        
        PID:5168
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2744 -s 236
        7⤵
        Program crash
        
        PID:2792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55272.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60270.exe
        7⤵
        
        PID:3196
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1544 -s 228
        7⤵
        Program crash
        
        PID:4008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33807.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35776.exe
        6⤵
        
        PID:3144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55009.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2088
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 392 -s 248
        6⤵
        Program crash
        
        PID:4208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12458.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1432.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18527.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1754.exe
        7⤵
        
        PID:4740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21706.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22497.exe
        7⤵
        
        PID:6076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14293.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62112.exe
        7⤵
        
        PID:6356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11904.exe
        6⤵
        
        PID:1160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56553.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63674.exe
        6⤵
        
        PID:4104
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1376 -s 244
        6⤵
        Program crash
        
        PID:4540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1167.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3565.exe
        6⤵
        
        PID:880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44956.exe
        6⤵
        
        PID:3232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51779.exe
        6⤵
        
        PID:4200
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1600 -s 248
        6⤵
        Program crash
        
        PID:4300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41314.exe
        5⤵
        
        PID:3032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24965.exe
        5⤵
        
        PID:4064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61953.exe
        5⤵
        
        PID:1956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5498.exe
        5⤵
        
        PID:4408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54210.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46537.exe
        5⤵
        
        PID:5948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65065.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5404.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5404.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:1096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25161.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12366.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40711.exe
        7⤵
        
        PID:3040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38101.exe
        8⤵
        
        PID:2956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32812.exe
        8⤵
        
        PID:3708
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3040 -s 244
        8⤵
        Program crash
        
        PID:3968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52361.exe
        7⤵
        
        PID:2664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8037.exe
        7⤵
        
        PID:3932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65428.exe
        7⤵
        
        PID:3728
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2672 -s 244
        7⤵
        Program crash
        
        PID:4560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51380.exe
        6⤵
        
        PID:2728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57748.exe
        7⤵
        
        PID:3160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26777.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60710.exe
        7⤵
        
        PID:4836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16876.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5164
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2728 -s 244
        7⤵
        Program crash
        
        PID:6108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3849.exe
        6⤵
        
        PID:1684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63378.exe
        6⤵
        
        PID:3552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15429.exe
        6⤵
        
        PID:4492
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1732 -s 248
        6⤵
        Program crash
        
        PID:4128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64260.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12745.exe
        6⤵
        
        PID:2100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46119.exe
        7⤵
        
        PID:4448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52289.exe
        7⤵
        
        PID:6016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17093.exe
        7⤵
        
        PID:6372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21775.exe
        7⤵
        
        PID:6384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33943.exe
        6⤵
        
        PID:2784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52334.exe
        6⤵
        
        PID:3928
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2532 -s 228
        6⤵
        Program crash
        
        PID:4276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39288.exe
        5⤵
        
        PID:1568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60359.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35454.exe
        5⤵
        
        PID:2140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37281.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3744
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1096 -s 248
        5⤵
        Program crash
        
        PID:5024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-748.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-748.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26757.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51915.exe
        6⤵
        
        PID:2056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11059.exe
        7⤵
        
        PID:5184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16461.exe
        7⤵
        
        PID:6880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33097.exe
        7⤵
        
        PID:3648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9678.exe
        6⤵
        
        PID:3224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50243.exe
        6⤵
        
        PID:3668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40727.exe
        6⤵
        
        PID:4424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10650.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5848
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2092 -s 236
        6⤵
        Program crash
        
        PID:5220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58417.exe
        5⤵
        
        PID:1628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41841.exe
        5⤵
        
        PID:2676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29419.exe
        5⤵
        
        PID:3644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4604.exe
        5⤵
        
        PID:5000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43870.exe
        5⤵
        
        PID:4780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2275.exe
        5⤵
        
        PID:5716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44906.exe
        5⤵
        
        PID:6692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3578.exe
        5⤵
        
        PID:6868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46611.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46611.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2328
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2328 -s 224
        5⤵
        Program crash
        
        PID:2560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2424.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2424.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34593.exe
        5⤵
        
        PID:1796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10254.exe
        5⤵
        
        PID:3748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59563.exe
        5⤵
        
        PID:3900
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3052 -s 248
        5⤵
        Program crash
        
        PID:4356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46760.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46760.exe
      4⤵
      PID:2916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1683.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1683.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35762.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35762.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3136
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 804 -s 244
      4⤵
      Program crash
      PID:4152
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49862.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49862.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10687.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10687.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:1664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63129.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20810.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34297.exe
        7⤵
        
        PID:928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24095.exe
        8⤵
        
        PID:2408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38650.exe
        8⤵
        
        PID:3576
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 928 -s 244
        8⤵
        Program crash
        
        PID:3980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26979.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28265.exe
        7⤵
        
        PID:3788
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 828 -s 248
        7⤵
        Program crash
        
        PID:3436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2179.exe
        6⤵
        
        PID:1688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38184.exe
        7⤵
        
        PID:2824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35033.exe
        7⤵
        
        PID:3368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30865.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4316
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1688 -s 248
        7⤵
        Program crash
        
        PID:4348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12017.exe
        6⤵
        
        PID:2024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53264.exe
        6⤵
        
        PID:3624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22227.exe
        6⤵
        
        PID:4564
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1652 -s 248
        6⤵
        Program crash
        
        PID:964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13196.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1816.exe
        6⤵
        Executes dropped EXE
        
        PID:2840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35356.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9455.exe
        7⤵
        
        PID:1708
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2840 -s 244
        7⤵
        Program crash
        
        PID:4460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51183.exe
        6⤵
        
        PID:2268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38463.exe
        6⤵
        
        PID:3444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30317.exe
        6⤵
        
        PID:4400
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1984 -s 244
        6⤵
        Program crash
        
        PID:4524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55001.exe
        5⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37442.exe
        6⤵
        
        PID:1772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10597.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56347.exe
        7⤵
        
        PID:5792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3170.exe
        7⤵
        
        PID:6724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38579.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52610.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35422.exe
        6⤵
        
        PID:3388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13269.exe
        6⤵
        
        PID:5036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60406.exe
        6⤵
        
        PID:5144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50747.exe
        6⤵
        
        PID:5764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-900.exe
        6⤵
        
        PID:6804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49945.exe
        6⤵
        
        PID:6992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12480.exe
        5⤵
        
        PID:2400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38268.exe
        6⤵
        
        PID:6736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39041.exe
        5⤵
        
        PID:2528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43112.exe
        5⤵
        
        PID:3696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5134.exe
        5⤵
        
        PID:4984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39405.exe
        5⤵
        
        PID:5152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40946.exe
        5⤵
        
        PID:5728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43771.exe
        5⤵
        
        PID:6708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45579.exe
        5⤵
        
        PID:6896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32957.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32957.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33062.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:944
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 944 -s 224
        6⤵
        Program crash
        
        PID:1852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19906.exe
        5⤵
        
        PID:768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53239.exe
        6⤵
        
        PID:6908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29668.exe
        6⤵
        
        PID:3824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46081.exe
        5⤵
        
        PID:1904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49886.exe
        5⤵
        
        PID:3168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24085.exe
        5⤵
        
        PID:4228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36745.exe
        5⤵
        
        PID:5632
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2280 -s 244
        5⤵
        Program crash
        
        PID:5160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55795.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55795.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43742.exe
        5⤵
        
        PID:3328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30861.exe
        5⤵
        
        PID:3904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60326.exe
        5⤵
        
        PID:4604
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1520 -s 228
        5⤵
        Program crash
        
        PID:6056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34328.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34328.exe
      4⤵
      PID:1724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21189.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21189.exe
      4⤵
      PID:3760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40227.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40227.exe
      4⤵
      PID:2444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27029.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27029.exe
      4⤵
      PID:4240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59545.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59545.exe
      4⤵
      PID:5652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42337.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42337.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19096.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19096.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6768
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51812.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51812.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58853.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58853.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44930.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40218.exe
        6⤵
        
        PID:1884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52450.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44339.exe
        7⤵
        
        PID:5252
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1884 -s 224
        7⤵
        Program crash
        
        PID:5744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25692.exe
        6⤵
        
        PID:2828
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1736 -s 240
        6⤵
        Program crash
        
        PID:3076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28904.exe
        5⤵
        
        PID:1900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30873.exe
        6⤵
        
        PID:6928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41920.exe
        6⤵
        
        PID:6404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50995.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2476
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1324 -s 236
        5⤵
        Program crash
        
        PID:3432
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25064.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25064.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48770.exe
        5⤵
        
        PID:1896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41552.exe
        6⤵
        
        PID:3512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59206.exe
        6⤵
        
        PID:5048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63206.exe
        6⤵
        
        PID:5124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10410.exe
        6⤵
        
        PID:5856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-370.exe
        6⤵
        
        PID:6820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54411.exe
        6⤵
        
        PID:2536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37259.exe
        5⤵
        
        PID:2468
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1016 -s 244
        5⤵
        Program crash
        
        PID:3420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63408.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63408.exe
      4⤵
      PID:2284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37525.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52850.exe
        6⤵
        
        PID:6764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11240.exe
        5⤵
        
        PID:3120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17954.exe
        5⤵
        
        PID:4088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54323.exe
        5⤵
        
        PID:4844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35045.exe
        5⤵
        
        PID:6100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19465.exe
        5⤵
        
        PID:5756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10267.exe
        5⤵
        
        PID:6244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59600.exe
        5⤵
        
        PID:7036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41152.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41152.exe
      4⤵
      PID:2452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28973.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28973.exe
      4⤵
      PID:3252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25261.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25261.exe
      4⤵
      PID:3952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58056.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58056.exe
      4⤵
      PID:4544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9961.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9961.exe
      4⤵
      PID:6040
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 924 -s 244
      4⤵
      Program crash
      PID:5192
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36222.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36222.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-856.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-856.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59367.exe
        5⤵
        
        PID:3776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1754.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4724
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2480 -s 220
        5⤵
        Program crash
        
        PID:4820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22210.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22210.exe
      4⤵
      PID:1120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49646.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49646.exe
      4⤵
      PID:4024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33140.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33140.exe
      4⤵
      PID:3564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26498.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26498.exe
      4⤵
      PID:4212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64011.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64011.exe
      4⤵
      PID:5612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59473.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59473.exe
      4⤵
      PID:5536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28399.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28399.exe
      4⤵
      PID:6744
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58039.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58039.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54328.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54328.exe
      4⤵
      PID:1100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42817.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42817.exe
      4⤵
      PID:3100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57809.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57809.exe
      4⤵
      PID:4116
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3008 -s 248
      4⤵
      Program crash
      PID:4288
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28862.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28862.exe
    3⤵
    PID:2948
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42031.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42031.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4056
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40422.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40422.exe
    3⤵
    PID:3680
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2352 -s 244
    3⤵
    - Program crash
    PID:4380
- C:\Users\Admin\AppData\Local\Temp\Unicorn-32181.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-32181.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2644
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8274.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8274.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23132.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23132.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1932
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1932 -s 244
        5⤵
        Loads dropped DLL
        Program crash
        
        PID:2464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51240.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51240.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20483.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3048
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3048 -s 200
        6⤵
        Program crash
        
        PID:952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35230.exe
        5⤵
        
        PID:864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45069.exe
        5⤵
        
        PID:3732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-934.exe
        5⤵
        
        PID:4648
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2632 -s 244
        5⤵
        Program crash
        
        PID:4872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48478.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48478.exe
      4⤵
      PID:2884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22144.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3660
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2884 -s 228
        5⤵
        Program crash
        
        PID:3448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15827.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15827.exe
      4⤵
      PID:2860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28838.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28838.exe
      4⤵
      PID:4052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61691.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61691.exe
      4⤵
      PID:4680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19436.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19436.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38139.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38139.exe
      4⤵
      PID:5876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53494.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53494.exe
      4⤵
      PID:6344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56512.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56512.exe
      4⤵
      PID:6380
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40406.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40406.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50493.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50493.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38573.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2504
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2504 -s 240
        6⤵
        Program crash
        
        PID:3868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18318.exe
        5⤵
        
        PID:2552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48769.exe
        5⤵
        
        PID:3336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36731.exe
        5⤵
        
        PID:4304
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1672 -s 244
        5⤵
        Program crash
        
        PID:4548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61686.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61686.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27603.exe
        5⤵
        
        PID:1340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34758.exe
        5⤵
        
        PID:3492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22614.exe
        5⤵
        
        PID:3920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26996.exe
        5⤵
        
        PID:5088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12871.exe
        5⤵
        
        PID:5324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29771.exe
        5⤵
        
        PID:5204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39240.exe
        5⤵
        
        PID:6604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6316.exe
        5⤵
        
        PID:7132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17964.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17964.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1458.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1458.exe
      4⤵
      PID:3604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56763.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56763.exe
      4⤵
      PID:3044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9963.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9963.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15539.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15539.exe
      4⤵
      PID:5580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47672.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47672.exe
      4⤵
      PID:5540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14896.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14896.exe
      4⤵
      PID:6756
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15774.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15774.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10119.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10119.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38957.exe
        5⤵
        
        PID:1704
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1704 -s 224
        6⤵
        Program crash
        
        PID:3340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18702.exe
        5⤵
        
        PID:1196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24840.exe
        5⤵
        
        PID:3684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43145.exe
        5⤵
        
        PID:4596
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2424 -s 244
        5⤵
        Program crash
        
        PID:4580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51956.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51956.exe
      4⤵
      PID:2760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35875.exe
        5⤵
        
        PID:2988
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2760 -s 248
        5⤵
        Program crash
        
        PID:3840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57134.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57134.exe
      4⤵
      PID:1436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1733.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1733.exe
      4⤵
      PID:3800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12689.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12689.exe
      4⤵
      PID:4688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2371.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2371.exe
      4⤵
      PID:4828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59670.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59670.exe
      4⤵
      PID:5920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54745.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54745.exe
      4⤵
      PID:6312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39867.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39867.exe
      4⤵
      PID:7136
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39019.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39019.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28267.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28267.exe
      4⤵
      Executes dropped EXE
      PID:2944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58246.exe
        5⤵
        
        PID:576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10063.exe
        6⤵
        
        PID:1508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57042.exe
        5⤵
        
        PID:1512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35853.exe
        5⤵
        
        PID:2648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32751.exe
        5⤵
        
        PID:4268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57365.exe
        5⤵
        
        PID:5660
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2944 -s 236
        5⤵
        Program crash
        
        PID:5224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52086.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52086.exe
      4⤵
      PID:2740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29744.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29744.exe
      4⤵
      PID:1572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19735.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19735.exe
      4⤵
      PID:3844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5803.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5803.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14426.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14426.exe
      4⤵
      PID:6068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1720.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1720.exe
      4⤵
      PID:5668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46105.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46105.exe
      4⤵
      PID:6184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54265.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54265.exe
      4⤵
      PID:6832
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62315.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62315.exe
    3⤵
    PID:2232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56954.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56954.exe
      4⤵
      PID:3632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45828.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45828.exe
      4⤵
      PID:3724
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2232 -s 224
      4⤵
      Program crash
      PID:4476
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50051.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50051.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1476
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32685.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32685.exe
    3⤵
    PID:3588
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15041.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15041.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4532
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-163.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-163.exe
    3⤵
    PID:5084
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23600.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23600.exe
    3⤵
    PID:5352
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41360.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41360.exe
    3⤵
    PID:5532
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28390.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28390.exe
    3⤵
    PID:6676
- C:\Users\Admin\AppData\Local\Temp\Unicorn-45123.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-45123.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2572
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63972.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63972.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26181.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26181.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17022.exe
        5⤵
        
        PID:1996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45310.exe
        6⤵
        
        PID:6204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4129.exe
        6⤵
        
        PID:6560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62340.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1944
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2152 -s 244
        5⤵
        Program crash
        
        PID:3392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45433.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45433.exe
      4⤵
      PID:3068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29305.exe
        5⤵
        
        PID:1980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38598.exe
        5⤵
        
        PID:3916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26885.exe
        5⤵
        
        PID:916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-493.exe
        5⤵
        
        PID:5676
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3068 -s 244
        5⤵
        Program crash
        
        PID:5768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30766.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30766.exe
      4⤵
      PID:1336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41287.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41287.exe
      4⤵
      PID:3464
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2876 -s 244
      4⤵
      Program crash
      PID:5008
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30627.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30627.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38080.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38080.exe
      4⤵
      PID:1524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36669.exe
        5⤵
        
        PID:4136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60244.exe
        5⤵
        
        PID:5572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12158.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36685.exe
        5⤵
        
        PID:6448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15064.exe
        5⤵
        
        PID:6924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62833.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62833.exe
      4⤵
      PID:2628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1256.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3643.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3176
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2628 -s 244
        5⤵
        Program crash
        
        PID:4184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7762.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7762.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2072
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9045.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9045.exe
      4⤵
      PID:3548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9695.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9695.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4340
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1743.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1743.exe
      4⤵
      PID:5772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9888.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9888.exe
      4⤵
      PID:6116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54273.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54273.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6208
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1580 -s 224
      4⤵
      Program crash
      PID:6740
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-65390.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-65390.exe
    3⤵
    PID:2568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40193.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40193.exe
      4⤵
      PID:5912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55792.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55792.exe
      4⤵
      PID:5648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4369.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4369.exe
      4⤵
      PID:7144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23730.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23730.exe
      4⤵
      PID:6864
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44800.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44800.exe
    3⤵
    PID:1596
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32621.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32621.exe
    3⤵
    PID:3472
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53606.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53606.exe
    3⤵
    PID:5016
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60936.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60936.exe
    3⤵
    PID:5136
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46281.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46281.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5816
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39571.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39571.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6684
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7778.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7778.exe
    3⤵
    PID:4040
- C:\Users\Admin\AppData\Local\Temp\Unicorn-45233.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-45233.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:1868
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27743.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27743.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9600.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9600.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6798.exe
        5⤵
        
        PID:2188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37882.exe
        5⤵
        
        PID:3108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3180.exe
        5⤵
        
        PID:3568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3778.exe
        5⤵
        
        PID:4384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25040.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58360.exe
        5⤵
        
        PID:5528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57138.exe
        5⤵
        
        PID:6532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20706.exe
        5⤵
        
        PID:2360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21551.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21551.exe
      4⤵
      PID:2888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35858.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35858.exe
      4⤵
      PID:3284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23820.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23820.exe
      4⤵
      PID:4048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14214.exe
        5⤵
        
        PID:4860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45875.exe
        5⤵
        
        PID:6120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55988.exe
        5⤵
        
        PID:6324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48226.exe
        5⤵
        
        PID:6304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-157.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-157.exe
      4⤵
      PID:4428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57213.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57213.exe
      4⤵
      PID:4760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36531.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36531.exe
      4⤵
      PID:6052
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2020 -s 248
      4⤵
      Program crash
      PID:6232
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57026.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57026.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20478.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20478.exe
      4⤵
      PID:1912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53508.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53508.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32619.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32619.exe
      4⤵
      PID:4436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35164.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35164.exe
      4⤵
      PID:4312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6841.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6841.exe
      4⤵
      PID:5512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56222.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56222.exe
      4⤵
      PID:5980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49930.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49930.exe
      4⤵
      PID:6840
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9879.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9879.exe
    3⤵
    PID:2344
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37914.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37914.exe
    3⤵
    PID:3280
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48979.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48979.exe
    3⤵
    PID:4188
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1868 -s 248
    3⤵
    - Program crash
    PID:4160
- C:\Users\Admin\AppData\Local\Temp\Unicorn-52061.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-52061.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1800
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1800 -s 244
    3⤵
    - Program crash
    PID:1812
- C:\Users\Admin\AppData\Local\Temp\Unicorn-50191.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-50191.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2952
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24998.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24998.exe
    3⤵
    PID:2320
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57042.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57042.exe
    3⤵
    PID:1960
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23792.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23792.exe
    3⤵
    PID:4032
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2952 -s 236
    3⤵
    - Program crash
    PID:4216
- C:\Users\Admin\AppData\Local\Temp\Unicorn-31372.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-31372.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2756
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59212.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59212.exe
    3⤵
    PID:6248
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7437.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7437.exe
    3⤵
    PID:2052
- C:\Users\Admin\AppData\Local\Temp\Unicorn-22280.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-22280.exe
  2⤵
  PID:1000
- C:\Users\Admin\AppData\Local\Temp\Unicorn-53779.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-53779.exe
  2⤵
  PID:3316
- C:\Users\Admin\AppData\Local\Temp\Unicorn-1950.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-1950.exe
  2⤵
  PID:4164
- C:\Users\Admin\AppData\Local\Temp\Unicorn-38220.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-38220.exe
  2⤵
  PID:5604
- C:\Users\Admin\AppData\Local\Temp\Unicorn-6823.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-6823.exe
  2⤵
  PID:5292
- C:\Users\Admin\AppData\Local\Temp\Unicorn-40885.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-40885.exe
  2⤵
  PID:6460
- C:\Users\Admin\AppData\Local\Temp\Unicorn-52865.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-52865.exe
  2⤵
  PID:6836

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-29771.exe

Filesize
468KB

MD5
20140b1ba806b94ff0d4fab15be5aea6

SHA1
10b6f4ef3bbcf3e761415e7908916a628173a797

SHA256
ceb8ec53b8271b0d967df33d21223c1488d28053826b9cd92a8075aec46f3f0b

SHA512
5a6eee02d5bb94a8b0b9f722c6f540c0bb92cd0f30eaa2e7cd9295786e4b26b34552b93e35826bbb91b5694bb929dc6432ec39c0a635751cd50708c2dcbeece0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-31937.exe

Filesize
468KB

MD5
670984b8e06c5daaa155f172269ac8e4

SHA1
76e402dcd425aa2e474d000086c8af1aafd07517

SHA256
bf666a59521f3d3196bb3ea86fd5af8c461f86fe9bc9db566d28712ec927c3e9

SHA512
2a76a04b63e57024b2b5a7f646d41355d29ac86a62d437ee42f2bf1affa88c9fa8d1875737912fee8a3f322bc2b389388a5eb92ceb8418dcc38c2f3a4c6b3614

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-32181.exe

Filesize
468KB

MD5
fcda572d44e7e1b8eb6aa0f533ceefad

SHA1
c0ed69759672fb82551c1f84eb439d2c428ac741

SHA256
a3c18eccb6343d53cf510fd116fe9937a81de7c76d9228bc2f7cb837167d971b

SHA512
2173ea7a1756afe5a1f4ca2faab4e873e1c4ded9c26dd2e5ef30407050eeac806728589c2663a7368c9ae8bbd1a66ffbfdfe007af39f89d9336329d06a9b083c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39904.exe

Filesize
468KB

MD5
666a1386e62fb6d39d7b908a218b2204

SHA1
eabe737b86e996ef38f3ca3ab73a75016e7e91aa

SHA256
5a2faec6a61efda4506c5531712465821a8c0190b776f19d8fdb69c3b930e8e6

SHA512
279e911f98bfd3aca24053ce9478ca3264dfb8ded1bc2b6e904d8537eeff10ceab66d1851f7ea2572e1f75efbcb20a1b921d09a85b83d920d6c5f9a27b5d1c0e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-40406.exe

Filesize
468KB

MD5
3e8ed2ff1319c11e83baec210b80a8a3

SHA1
f84fc914db99e024c7c5f8f40a2356b33cd9ce98

SHA256
dd28da9cae68afd26662186b02750b585e2708904dc1915903e1ebce0d59b60c

SHA512
0b130e0f4531f0c38fe9d75cd65c93fb8e2bf0f0018646fc90b788fd094bc920706696008b06155cda7b1a4670a890b57c92ae07de119f360fcc845864f529b7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-45123.exe

Filesize
468KB

MD5
8400be152df8c6a8351e3ebb7b6a8eec

SHA1
cd6979e536ed7b501322937d535ac0b70f9fbc39

SHA256
c1aa7e274aa4eee6fcddd0795345ac54926f31b27eb0525aa246e228bd7f7d8c

SHA512
e7a209ddf78ac64573a950ab4987a3cee3796c76e03b7b5e24ebdc093ae590b50f196626b494bbce27629f6f1d4786017864b61e969d11df0044c657294a7381

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-49862.exe

Filesize
468KB

MD5
286294bfab582ac174f68cf977dca4cd

SHA1
c372b0e56acd2cfecff5a9ba503973cb77e8eee3

SHA256
db33fd1339f36c0eac8d99003a73853900a67689cc88e046eebd03bd6befb89e

SHA512
61f756fe85f0e89ee574f6445bdd8080ca035aef10ba298c8dbc169ac1434d527168439d4c0860f1cdb7d3ca9a2da64ca7f03cc3756e75d2cc2b9de99727964a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-52865.exe

Filesize
468KB

MD5
cd1199e1f34e25be7f14967f20b26d56

SHA1
f247b2279d8ba787ebf15bd23d77eb52a788e843

SHA256
9e76d7eb0d0e7c80240aeca6a4839999be7082f63a649c53d816f1fa7c9eb866

SHA512
0602733b6413ead6915f92caccbe0012a630a8d53bb41e1d04ac849d02a6785fe76be9d4af8a9d0100ea37423fea3de00d004b9bfb40a196e094cef90f4abb15

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5404.exe

Filesize
468KB

MD5
be6f100fc63621019b04cda9b1b8aaa9

SHA1
c43753ceadbdc2f9ab0f2a18d06e3c725a0e9994

SHA256
bc25d45dc1f30368fdbdaafd4df19b552e1a76d5a5b5246b186bd9b060d720da

SHA512
1c437f735c5f5b856854e7c0890f48300efc26445331873965e670299671416dfcd46d59361f2f79600e56ed0e7ae841823dd5e943662c6136d15911d3ad2516

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-10687.exe

Filesize
468KB

MD5
fe49542c7df35380b129cdd9deb0759b

SHA1
8bc20dde5ef663e34eb92524f8dd9c0d105ed495

SHA256
bcbcc65bbbd8f01a81afde56970ade83d30767d71992f8bb5bbd7da33a74b4be

SHA512
afc74dbe027e10823f76d65f9dc8f51ad200bf1234823d600bdce9e98c68edefc143ba926e24c11d61f208d9ce7cc44e47c0f19e4fbbbe3f3201ce4c8b8c3c91

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-23132.exe

Filesize
468KB

MD5
f44defda78c167c4b4ae33a3914283cf

SHA1
098a54a00dcaa9a577a5a30d6f32a5643cec5411

SHA256
95698e7ed5b863b62bfd3714f1d003dcff2927a83c17d81a4b06b6029a673a23

SHA512
2ebfa2a296b9c9904d7bef14a4397073b55f72abbbb9466d06d7a148b5377b0ab523c99d1cb5adcd717b886b50ecfcfe1eea993b7b6bc7e066b72724afa2a91d

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-25161.exe

Filesize
468KB

MD5
3efb2e3a2b964878d5fa111f8cd25b56

SHA1
3fb88ced33f049be22560581909035ac26bd0a94

SHA256
dfd560f1adc3a88cad987cad3d45ed58fe13deca5777a58b1987f19b7c0ea06f

SHA512
7160bad6a90779dd683f3d6b9bcf01ac1a22df330035e42a41feea5b655f4728a602d53fe12b0be895d5dae0e30b03638460b594de87d4d2302557dc89e59ad7

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-4273.exe

Filesize
468KB

MD5
fd8b3a553784e84bb0815535c4d7d5a7

SHA1
9dd61bb9a8eba2ca5f8463dfe4f6d5300409698c

SHA256
2512fdce53c390aa2c58e2b6f63ba453fbce196974c63becba03cf9f4e4480a2

SHA512
825580e5cf0cf9b0f765a982ab0a0d179d0fa9ad5040550aa1764b7c3cee2816dd6218fa52d7133a041c3120e18e16c49e57b2ea4a6f9a59074e2023e32feddb

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-45233.exe

Filesize
468KB

MD5
cce486552de49435bbc9b97e4ab8e82e

SHA1
8977a3e0836318810c298c45ccfa9ef50e0ebcef

SHA256
33e197bdcfa94d2e9940e26106c7429164222208855988b33d59d7e56436a09c

SHA512
844efd2210eda0be5805a992cf0060f354971c0954ea70abfff2c5d9c1f92093bc7ded49fe1726b9885ea8fc553ba9ed70aacf2163d400de007212f0700c1de2

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-51812.exe

Filesize
468KB

MD5
258dfbb012d31d441d2775827dd3d1e5

SHA1
74d0e682d35cf695ba07f4381ae38abfce441664

SHA256
3cb515a15511ba5993440748e3625eb33b1eaf3f043edbb537b8aa3e2dd0198c

SHA512
9df21546e3613dc6d650c337da6131258352db8784d02ac59af008b9e9be22be9c1c623fbe6befa1588ae6c10410bc575c278e5e8634bd6a6ba2ed7ea9cddbe2

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-57200.exe

Filesize
468KB

MD5
1636d9a1664d93702624816918657793

SHA1
f52ad146358d895e6a86f0da74e1136c965b0c39

SHA256
642c247a9589c03d42217d4cb836ce48d44a9524b7567c9e79091144e72b196c

SHA512
55a3fae1e337275a9640bdf18ab961a27b74c396f55a7f9a0bf6b402320db897799f8fa54df54ca9228b6aabb2af668ed00bfadae8fa00b4f5fea63bf5221e3b

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-61367.exe

Filesize
468KB

MD5
7918f17f1a56607d06c1a7d5cc92ed2c

SHA1
9e23f8aa12be1af33878358964e9a83f1d59705d

SHA256
4738a145b8c5d2e385f407623f0c616d9b22b10d33667863b97f5fbe3721d40e

SHA512
7e934f3ed33bbbfbbed83c243b0b9b78a947412b3ade2867f2d05d1dc5f83113dadb3a0bee479ba892fb983289628b3e055e1e71802bc4f84e1829ae11e16c0d

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-63972.exe

Filesize
468KB

MD5
45516286377b7cfe4954b5f748c0be04

SHA1
2c63a3be59f72c5922f9c767056b51252d66aba0

SHA256
995793e8f1c9daee4c6943476fe28aac3c5b05a29c0ef98157c04fbc65fb58ad

SHA512
c6d41b7072113572934762ee436f5a8ffb059c58a191ebca0f6a5cbe0fc80354e4557f8165312641cd9b725cbcc16bac3cd1e78bd1dc52740ddc9412729571a1

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-748.exe

Filesize
468KB

MD5
678d8d33eba1e1515c1c396378558522

SHA1
4c9815f197d43d4f922eb6cb12c3d64a3df1733e

SHA256
729f50100d8ab2eed6625f7a6a08ffa15907d0c39349f795f9304b868731ec6a

SHA512
299def909547596debdb08b20b19c69b4d30807c0c46b322152f8a0cc46da3904eefa8730b0df6794c38c4d0d195d0833213eae974c0e7d324f2e51695309e42

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-8274.exe

Filesize
468KB

MD5
f2617f01d05d7d986dcd1cfee2f8f1a1

SHA1
b256f31527e3021722d73cbe39eff76602588560

SHA256
8677da0c7967361cf7d0afad0de1101af8c821ed18ad954bd88e67788cc4ae3e

SHA512
800d99a5b90132758f0e7e35050ad4e8d3e65229d1798d955b2eb4ec1fefacc8d63e7c21917ee64180c4fe0cd123544ae1d31b38fd416504498a531455c13ef1

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-848.exe

Filesize
468KB

MD5
aad21064bb8d32f02579237907baa565

SHA1
5e898a0d14ea361f2a9d285ffd7c1439f4582788

SHA256
d9deee91177e55dfe1c6b6f08c20d7c2e6184f79a259260d722050a2c28cfaa1

SHA512
28b40b4898991455cb543659d5511b326df0dbad9ab1aff0c8e8bb4cd4059f1c25ede0d93d56d52c2320485f55365de141fe16edbc0e44365aa7e52a86239c09

Download Submit
memory/392-228-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/392-371-0x0000000002820000-0x0000000002895000-memory.dmp

Filesize
468KB

Download
memory/392-370-0x0000000002820000-0x0000000002895000-memory.dmp

Filesize
468KB

Download
memory/800-333-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/804-47-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/804-230-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/804-231-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/924-159-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/924-267-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/1096-399-0x0000000002630000-0x00000000026A5000-memory.dmp

Filesize
468KB

Download
memory/1096-229-0x0000000002630000-0x00000000026A5000-memory.dmp

Filesize
468KB

Download
memory/1096-232-0x0000000002630000-0x00000000026A5000-memory.dmp

Filesize
468KB

Download
memory/1096-395-0x0000000002630000-0x00000000026A5000-memory.dmp

Filesize
468KB

Download
memory/1096-104-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1324-274-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1376-405-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1440-284-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1444-158-0x0000000000550000-0x00000000005C5000-memory.dmp

Filesize
468KB

Download
memory/1444-165-0x0000000000550000-0x00000000005C5000-memory.dmp

Filesize
468KB

Download
memory/1444-324-0x0000000000550000-0x00000000005C5000-memory.dmp

Filesize
468KB

Download
memory/1444-322-0x0000000000550000-0x00000000005C5000-memory.dmp

Filesize
468KB

Download
memory/1444-80-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1500-407-0x0000000002810000-0x0000000002885000-memory.dmp

Filesize
468KB

Download
memory/1500-234-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1500-406-0x0000000002810000-0x0000000002885000-memory.dmp

Filesize
468KB

Download
memory/1580-315-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1652-269-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1664-155-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1664-270-0x00000000024A0000-0x0000000002515000-memory.dmp

Filesize
468KB

Download
memory/1664-268-0x00000000024A0000-0x0000000002515000-memory.dmp

Filesize
468KB

Download
memory/1672-317-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1732-378-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/1732-233-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1732-379-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/1800-256-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1868-156-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1868-243-0x00000000028A0000-0x0000000002915000-memory.dmp

Filesize
468KB

Download
memory/1868-244-0x00000000028A0000-0x0000000002915000-memory.dmp

Filesize
468KB

Download
memory/1932-166-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2012-352-0x0000000002390000-0x0000000002405000-memory.dmp

Filesize
468KB

Download
memory/2012-200-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2012-350-0x0000000002390000-0x0000000002405000-memory.dmp

Filesize
468KB

Download
memory/2092-408-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2108-411-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2108-255-0x0000000002600000-0x0000000002675000-memory.dmp

Filesize
468KB

Download
memory/2108-251-0x0000000002600000-0x0000000002675000-memory.dmp

Filesize
468KB

Download
memory/2108-139-0x0000000002600000-0x0000000002675000-memory.dmp

Filesize
468KB

Download
memory/2108-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2108-14-0x0000000002600000-0x0000000002675000-memory.dmp

Filesize
468KB

Download
memory/2108-150-0x0000000002600000-0x0000000002675000-memory.dmp

Filesize
468KB

Download
memory/2108-11-0x0000000002600000-0x0000000002675000-memory.dmp

Filesize
468KB

Download
memory/2152-304-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2240-351-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2280-301-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2352-282-0x0000000002570000-0x00000000025E5000-memory.dmp

Filesize
468KB

Download
memory/2352-281-0x0000000002570000-0x00000000025E5000-memory.dmp

Filesize
468KB

Download
memory/2352-12-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2352-22-0x0000000002570000-0x00000000025E5000-memory.dmp

Filesize
468KB

Download
memory/2352-412-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2352-157-0x0000000002570000-0x00000000025E5000-memory.dmp

Filesize
468KB

Download
memory/2352-147-0x0000000002570000-0x00000000025E5000-memory.dmp

Filesize
468KB

Download
memory/2532-397-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2572-308-0x0000000002660000-0x00000000026D5000-memory.dmp

Filesize
468KB

Download
memory/2572-314-0x0000000002660000-0x00000000026D5000-memory.dmp

Filesize
468KB

Download
memory/2572-79-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2572-113-0x0000000002660000-0x00000000026D5000-memory.dmp

Filesize
468KB

Download
memory/2600-359-0x0000000002610000-0x0000000002685000-memory.dmp

Filesize
468KB

Download
memory/2600-197-0x0000000002610000-0x0000000002685000-memory.dmp

Filesize
468KB

Download
memory/2600-96-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2600-199-0x0000000002610000-0x0000000002685000-memory.dmp

Filesize
468KB

Download
memory/2600-360-0x0000000002610000-0x0000000002685000-memory.dmp

Filesize
468KB

Download
memory/2632-325-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2644-183-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2644-332-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2644-328-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2644-38-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2644-182-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2672-380-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2684-145-0x00000000027C0000-0x0000000002835000-memory.dmp

Filesize
468KB

Download
memory/2684-296-0x00000000027C0000-0x0000000002835000-memory.dmp

Filesize
468KB

Download
memory/2684-300-0x00000000027C0000-0x0000000002835000-memory.dmp

Filesize
468KB

Download
memory/2684-153-0x00000000027C0000-0x0000000002835000-memory.dmp

Filesize
468KB

Download
memory/2684-75-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2744-372-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2752-361-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2776-213-0x0000000002710000-0x0000000002785000-memory.dmp

Filesize
468KB

Download
memory/2776-400-0x0000000002710000-0x0000000002785000-memory.dmp

Filesize
468KB

Download
memory/2776-214-0x0000000002710000-0x0000000002785000-memory.dmp

Filesize
468KB

Download
memory/2776-89-0x0000000002710000-0x0000000002785000-memory.dmp

Filesize
468KB

Download
memory/2776-404-0x0000000002710000-0x0000000002785000-memory.dmp

Filesize
468KB

Download
memory/2844-309-0x0000000001C50000-0x0000000001CC5000-memory.dmp

Filesize
468KB

Download
memory/2844-184-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2844-316-0x0000000001C50000-0x0000000001CC5000-memory.dmp

Filesize
468KB

Download
memory/2876-302-0x0000000002390000-0x0000000002405000-memory.dmp

Filesize
468KB

Download
memory/2876-303-0x0000000002390000-0x0000000002405000-memory.dmp

Filesize
468KB

Download
memory/2876-148-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download