6b2ac2fc63492a8ac1bd73bdfccd7d0d8041d35fbce7b0bdcc9678a8e557b92b

Analysis

max time kernel
150s
max time network
19s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
07-09-2024 22:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6b2ac2fc63492a8ac1bd73bdfccd7d0d8041d35fbce7b0bdcc9678a8e557b92b.exe
Size

468KB
MD5

c2eb4c853506acd9e47910714e030742
SHA1

6257074e1b7761f49e03277ecd67af5ada6bf7e8
SHA256

6b2ac2fc63492a8ac1bd73bdfccd7d0d8041d35fbce7b0bdcc9678a8e557b92b
SHA512

9a510a2f991591547689d1ab48bb187e7d73b799518a5e8086c007ac4ce767aff38f6b27f60f6fe991ef233c6a29b5a0d939c6b7212191f90e1f08dfad16b30d
SSDEEP

3072:1U3HogISIE5TtbYXHzcOjf8/zCcaP0pvJVHeTVPFM6TLR7ggEflL:1U3obMTtIH4OjfVY6fM63VggE

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2552	Unicorn-46490.exe
2860	Unicorn-65.exe
2768	Unicorn-62909.exe
1160	Unicorn-133.exe
2924	Unicorn-37636.exe
2976	Unicorn-57502.exe
2668	Unicorn-8393.exe
1776	Unicorn-11399.exe
2576	Unicorn-58716.exe
2584	Unicorn-31519.exe
3040	Unicorn-64191.exe
3044	Unicorn-58061.exe
2832	Unicorn-13163.exe
1048	Unicorn-59100.exe
584	Unicorn-50377.exe
2420	Unicorn-41393.exe
2272	Unicorn-52899.exe
960	Unicorn-39639.exe
2188	Unicorn-44622.exe
748	Unicorn-2827.exe
1464	Unicorn-11757.exe
928	Unicorn-32924.exe
2464	Unicorn-17980.exe
1528	Unicorn-54471.exe
1012	Unicorn-50652.exe
1688	Unicorn-24586.exe
2840	Unicorn-18455.exe
2532	Unicorn-5819.exe
2160	Unicorn-6303.exe
1956	Unicorn-28862.exe
2612	Unicorn-4165.exe
2724	Unicorn-20593.exe
936	Unicorn-6858.exe
2332	Unicorn-48467.exe
1220	Unicorn-64248.exe
2772	Unicorn-51896.exe
2864	Unicorn-23216.exe
2752	Unicorn-44191.exe
2060	Unicorn-45966.exe
2956	Unicorn-25281.exe
1648	Unicorn-8140.exe
700	Unicorn-51674.exe
2384	Unicorn-20969.exe
2880	Unicorn-25607.exe
2192	Unicorn-10662.exe
1904	Unicorn-39805.exe
2172	Unicorn-8259.exe
2816	Unicorn-8524.exe
2828	Unicorn-19306.exe
1028	Unicorn-5016.exe
1176	Unicorn-5379.exe
2184	Unicorn-35551.exe
320	Unicorn-548.exe
1612	Unicorn-54373.exe
1920	Unicorn-51466.exe
1760	Unicorn-11129.exe
2080	Unicorn-54928.exe
1488	Unicorn-19947.exe
1564	Unicorn-63117.exe
1808	Unicorn-43251.exe
916	Unicorn-36283.exe
2064	Unicorn-30615.exe
2416	Unicorn-61455.exe
3024	Unicorn-30637.exe

Loads dropped DLL 64 IoCs

pid	Process
1656	6b2ac2fc63492a8ac1bd73bdfccd7d0d8041d35fbce7b0bdcc9678a8e557b92b.exe
1656	6b2ac2fc63492a8ac1bd73bdfccd7d0d8041d35fbce7b0bdcc9678a8e557b92b.exe
2552	Unicorn-46490.exe
1656	6b2ac2fc63492a8ac1bd73bdfccd7d0d8041d35fbce7b0bdcc9678a8e557b92b.exe
1656	6b2ac2fc63492a8ac1bd73bdfccd7d0d8041d35fbce7b0bdcc9678a8e557b92b.exe
2552	Unicorn-46490.exe
2768	Unicorn-62909.exe
2860	Unicorn-65.exe
2768	Unicorn-62909.exe
2860	Unicorn-65.exe
2552	Unicorn-46490.exe
2552	Unicorn-46490.exe
1656	6b2ac2fc63492a8ac1bd73bdfccd7d0d8041d35fbce7b0bdcc9678a8e557b92b.exe
1656	6b2ac2fc63492a8ac1bd73bdfccd7d0d8041d35fbce7b0bdcc9678a8e557b92b.exe
1160	Unicorn-133.exe
1160	Unicorn-133.exe
2768	Unicorn-62909.exe
2768	Unicorn-62909.exe
2924	Unicorn-37636.exe
2924	Unicorn-37636.exe
2976	Unicorn-57502.exe
2552	Unicorn-46490.exe
2552	Unicorn-46490.exe
2976	Unicorn-57502.exe
1656	6b2ac2fc63492a8ac1bd73bdfccd7d0d8041d35fbce7b0bdcc9678a8e557b92b.exe
1656	6b2ac2fc63492a8ac1bd73bdfccd7d0d8041d35fbce7b0bdcc9678a8e557b92b.exe
2860	Unicorn-65.exe
1060	WerFault.exe
1060	WerFault.exe
1060	WerFault.exe
1060	WerFault.exe
2860	Unicorn-65.exe
1060	WerFault.exe
1776	Unicorn-11399.exe
1776	Unicorn-11399.exe
1160	Unicorn-133.exe
1160	Unicorn-133.exe
2584	Unicorn-31519.exe
2584	Unicorn-31519.exe
2924	Unicorn-37636.exe
2924	Unicorn-37636.exe
2832	Unicorn-13163.exe
2832	Unicorn-13163.exe
1656	6b2ac2fc63492a8ac1bd73bdfccd7d0d8041d35fbce7b0bdcc9678a8e557b92b.exe
3040	Unicorn-64191.exe
3040	Unicorn-64191.exe
1656	6b2ac2fc63492a8ac1bd73bdfccd7d0d8041d35fbce7b0bdcc9678a8e557b92b.exe
2976	Unicorn-57502.exe
2976	Unicorn-57502.exe
3044	Unicorn-58061.exe
3044	Unicorn-58061.exe
2552	Unicorn-46490.exe
2552	Unicorn-46490.exe
1048	Unicorn-59100.exe
1048	Unicorn-59100.exe
2576	Unicorn-58716.exe
2860	Unicorn-65.exe
2576	Unicorn-58716.exe
2860	Unicorn-65.exe
2768	Unicorn-62909.exe
2768	Unicorn-62909.exe
960	Unicorn-39639.exe
960	Unicorn-39639.exe
584	Unicorn-50377.exe

Program crash 64 IoCs

pid	pid_target	Process	procid_target
1060	2668	WerFault.exe	35
1660	1464	WerFault.exe	50
2564	2332	WerFault.exe	63
3008	2192	WerFault.exe	75
2408	928	WerFault.exe	51
2204	700	WerFault.exe	71
2336	2724	WerFault.exe	62
3080	2880	WerFault.exe	74
3296	2924	WerFault.exe	34
3328	2188	WerFault.exe	48
3376	2968	WerFault.exe	97
3384	956	WerFault.exe	118
3436	1048	WerFault.exe	43
3420	2772	WerFault.exe	65
3408	1744	WerFault.exe	119
3484	2060	WerFault.exe	68
3256	2832	WerFault.exe	42
3248	1776	WerFault.exe	36
3308	748	WerFault.exe	49
3336	960	WerFault.exe	47
3492	2752	WerFault.exe	67
3472	1528	WerFault.exe	53
3776	2916	WerFault.exe	110
3792	1488	WerFault.exe	89
4108	2420	WerFault.exe	45
4120	1760	WerFault.exe	85
4296	2864	WerFault.exe	66
4428	2080	WerFault.exe	87
4392	2560	WerFault.exe	113
4680	1904	WerFault.exe	76
4800	2268	WerFault.exe	117
4876	2384	WerFault.exe	73
4884	2640	WerFault.exe	100
4900	1312	WerFault.exe	112
4960	1724	WerFault.exe	96
4964	1956	WerFault.exe	59
4968	2532	WerFault.exe	57
5076	1592	WerFault.exe	95
5068	936	WerFault.exe	61
5152	1920	WerFault.exe	86
5160	2612	WerFault.exe	60
5168	1604	WerFault.exe	148
5176	2392	WerFault.exe	105
5204	916	WerFault.exe	91
5196	2452	WerFault.exe	149
5216	1176	WerFault.exe	81
5444	3044	WerFault.exe	41
5132	1504	WerFault.exe	101
6020	3040	WerFault.exe	40
6048	2160	WerFault.exe	58
6068	320	WerFault.exe	83
5236	1012	WerFault.exe	54
6076	1612	WerFault.exe	84
2756	1220	WerFault.exe	64
6568	2860	WerFault.exe	31
6608	2624	WerFault.exe	109
6616	2844	WerFault.exe	98
6656	864	WerFault.exe	146
6648	2896	WerFault.exe	108
6624	2064	WerFault.exe	92
6584	2464	WerFault.exe	52
6520	2956	WerFault.exe	69
6512	2416	WerFault.exe	93
6916	2840	WerFault.exe	56

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44867.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55503.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55343.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47808.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22225.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38864.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43251.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50704.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14037.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-548.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54608.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50717.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61718.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10332.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51674.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53562.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22225.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65084.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54471.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-133.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47580.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6b2ac2fc63492a8ac1bd73bdfccd7d0d8041d35fbce7b0bdcc9678a8e557b92b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59858.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53365.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53222.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56822.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14172.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1505.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44061.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49106.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51397.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50652.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59102.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38829.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37356.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64824.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28422.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7286.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44191.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20347.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29230.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58400.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30506.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20798.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61681.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40974.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20398.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11399.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45966.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29213.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52899.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51232.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19263.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56571.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46812.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59897.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9011.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13039.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63698.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54032.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16993.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53220.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60631.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64872.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
1656	6b2ac2fc63492a8ac1bd73bdfccd7d0d8041d35fbce7b0bdcc9678a8e557b92b.exe
2552	Unicorn-46490.exe
2768	Unicorn-62909.exe
2860	Unicorn-65.exe
1160	Unicorn-133.exe
2668	Unicorn-8393.exe
2924	Unicorn-37636.exe
2976	Unicorn-57502.exe
1776	Unicorn-11399.exe
2584	Unicorn-31519.exe
2832	Unicorn-13163.exe
1048	Unicorn-59100.exe
3040	Unicorn-64191.exe
2576	Unicorn-58716.exe
3044	Unicorn-58061.exe
584	Unicorn-50377.exe
2420	Unicorn-41393.exe
2272	Unicorn-52899.exe
960	Unicorn-39639.exe
2188	Unicorn-44622.exe
928	Unicorn-32924.exe
748	Unicorn-2827.exe
1464	Unicorn-11757.exe
2464	Unicorn-17980.exe
1012	Unicorn-50652.exe
2840	Unicorn-18455.exe
1528	Unicorn-54471.exe
1688	Unicorn-24586.exe
2532	Unicorn-5819.exe
2160	Unicorn-6303.exe
2612	Unicorn-4165.exe
1956	Unicorn-28862.exe
936	Unicorn-6858.exe
2724	Unicorn-20593.exe
2332	Unicorn-48467.exe
1220	Unicorn-64248.exe
2772	Unicorn-51896.exe
2864	Unicorn-23216.exe
2752	Unicorn-44191.exe
2060	Unicorn-45966.exe
700	Unicorn-51674.exe
1648	Unicorn-8140.exe
2956	Unicorn-25281.exe
2192	Unicorn-10662.exe
2384	Unicorn-20969.exe
2816	Unicorn-8524.exe
2880	Unicorn-25607.exe
2172	Unicorn-8259.exe
2828	Unicorn-19306.exe
1904	Unicorn-39805.exe
1028	Unicorn-5016.exe
1176	Unicorn-5379.exe
2184	Unicorn-35551.exe
320	Unicorn-548.exe
1920	Unicorn-51466.exe
1760	Unicorn-11129.exe
2080	Unicorn-54928.exe
1612	Unicorn-54373.exe
1488	Unicorn-19947.exe
1564	Unicorn-63117.exe
1808	Unicorn-43251.exe
2064	Unicorn-30615.exe
916	Unicorn-36283.exe
2416	Unicorn-61455.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1656 wrote to memory of 2552	1656	6b2ac2fc63492a8ac1bd73bdfccd7d0d8041d35fbce7b0bdcc9678a8e557b92b.exe	29
PID 1656 wrote to memory of 2552	1656	6b2ac2fc63492a8ac1bd73bdfccd7d0d8041d35fbce7b0bdcc9678a8e557b92b.exe	29
PID 1656 wrote to memory of 2552	1656	6b2ac2fc63492a8ac1bd73bdfccd7d0d8041d35fbce7b0bdcc9678a8e557b92b.exe	29
PID 1656 wrote to memory of 2552	1656	6b2ac2fc63492a8ac1bd73bdfccd7d0d8041d35fbce7b0bdcc9678a8e557b92b.exe	29
PID 1656 wrote to memory of 2860	1656	6b2ac2fc63492a8ac1bd73bdfccd7d0d8041d35fbce7b0bdcc9678a8e557b92b.exe	31
PID 1656 wrote to memory of 2860	1656	6b2ac2fc63492a8ac1bd73bdfccd7d0d8041d35fbce7b0bdcc9678a8e557b92b.exe	31
PID 1656 wrote to memory of 2860	1656	6b2ac2fc63492a8ac1bd73bdfccd7d0d8041d35fbce7b0bdcc9678a8e557b92b.exe	31
PID 1656 wrote to memory of 2860	1656	6b2ac2fc63492a8ac1bd73bdfccd7d0d8041d35fbce7b0bdcc9678a8e557b92b.exe	31
PID 2552 wrote to memory of 2768	2552	Unicorn-46490.exe	30
PID 2552 wrote to memory of 2768	2552	Unicorn-46490.exe	30
PID 2552 wrote to memory of 2768	2552	Unicorn-46490.exe	30
PID 2552 wrote to memory of 2768	2552	Unicorn-46490.exe	30
PID 2768 wrote to memory of 1160	2768	Unicorn-62909.exe	32
PID 2768 wrote to memory of 1160	2768	Unicorn-62909.exe	32
PID 2768 wrote to memory of 1160	2768	Unicorn-62909.exe	32
PID 2768 wrote to memory of 1160	2768	Unicorn-62909.exe	32
PID 2860 wrote to memory of 2976	2860	Unicorn-65.exe	33
PID 2860 wrote to memory of 2976	2860	Unicorn-65.exe	33
PID 2860 wrote to memory of 2976	2860	Unicorn-65.exe	33
PID 2860 wrote to memory of 2976	2860	Unicorn-65.exe	33
PID 2552 wrote to memory of 2924	2552	Unicorn-46490.exe	34
PID 2552 wrote to memory of 2924	2552	Unicorn-46490.exe	34
PID 2552 wrote to memory of 2924	2552	Unicorn-46490.exe	34
PID 2552 wrote to memory of 2924	2552	Unicorn-46490.exe	34
PID 1656 wrote to memory of 2668	1656	6b2ac2fc63492a8ac1bd73bdfccd7d0d8041d35fbce7b0bdcc9678a8e557b92b.exe	35
PID 1656 wrote to memory of 2668	1656	6b2ac2fc63492a8ac1bd73bdfccd7d0d8041d35fbce7b0bdcc9678a8e557b92b.exe	35
PID 1656 wrote to memory of 2668	1656	6b2ac2fc63492a8ac1bd73bdfccd7d0d8041d35fbce7b0bdcc9678a8e557b92b.exe	35
PID 1656 wrote to memory of 2668	1656	6b2ac2fc63492a8ac1bd73bdfccd7d0d8041d35fbce7b0bdcc9678a8e557b92b.exe	35
PID 1160 wrote to memory of 1776	1160	Unicorn-133.exe	36
PID 1160 wrote to memory of 1776	1160	Unicorn-133.exe	36
PID 1160 wrote to memory of 1776	1160	Unicorn-133.exe	36
PID 1160 wrote to memory of 1776	1160	Unicorn-133.exe	36
PID 2768 wrote to memory of 2576	2768	Unicorn-62909.exe	37
PID 2768 wrote to memory of 2576	2768	Unicorn-62909.exe	37
PID 2768 wrote to memory of 2576	2768	Unicorn-62909.exe	37
PID 2768 wrote to memory of 2576	2768	Unicorn-62909.exe	37
PID 2924 wrote to memory of 2584	2924	Unicorn-37636.exe	38
PID 2924 wrote to memory of 2584	2924	Unicorn-37636.exe	38
PID 2924 wrote to memory of 2584	2924	Unicorn-37636.exe	38
PID 2924 wrote to memory of 2584	2924	Unicorn-37636.exe	38
PID 2668 wrote to memory of 1060	2668	Unicorn-8393.exe	39
PID 2668 wrote to memory of 1060	2668	Unicorn-8393.exe	39
PID 2668 wrote to memory of 1060	2668	Unicorn-8393.exe	39
PID 2668 wrote to memory of 1060	2668	Unicorn-8393.exe	39
PID 2552 wrote to memory of 3044	2552	Unicorn-46490.exe	41
PID 2552 wrote to memory of 3044	2552	Unicorn-46490.exe	41
PID 2552 wrote to memory of 3044	2552	Unicorn-46490.exe	41
PID 2552 wrote to memory of 3044	2552	Unicorn-46490.exe	41
PID 2976 wrote to memory of 3040	2976	Unicorn-57502.exe	40
PID 2976 wrote to memory of 3040	2976	Unicorn-57502.exe	40
PID 2976 wrote to memory of 3040	2976	Unicorn-57502.exe	40
PID 2976 wrote to memory of 3040	2976	Unicorn-57502.exe	40
PID 1656 wrote to memory of 2832	1656	6b2ac2fc63492a8ac1bd73bdfccd7d0d8041d35fbce7b0bdcc9678a8e557b92b.exe	42
PID 1656 wrote to memory of 2832	1656	6b2ac2fc63492a8ac1bd73bdfccd7d0d8041d35fbce7b0bdcc9678a8e557b92b.exe	42
PID 1656 wrote to memory of 2832	1656	6b2ac2fc63492a8ac1bd73bdfccd7d0d8041d35fbce7b0bdcc9678a8e557b92b.exe	42
PID 1656 wrote to memory of 2832	1656	6b2ac2fc63492a8ac1bd73bdfccd7d0d8041d35fbce7b0bdcc9678a8e557b92b.exe	42
PID 2860 wrote to memory of 1048	2860	Unicorn-65.exe	43
PID 2860 wrote to memory of 1048	2860	Unicorn-65.exe	43
PID 2860 wrote to memory of 1048	2860	Unicorn-65.exe	43
PID 2860 wrote to memory of 1048	2860	Unicorn-65.exe	43
PID 1776 wrote to memory of 584	1776	Unicorn-11399.exe	44
PID 1776 wrote to memory of 584	1776	Unicorn-11399.exe	44
PID 1776 wrote to memory of 584	1776	Unicorn-11399.exe	44
PID 1776 wrote to memory of 584	1776	Unicorn-11399.exe	44

C:\Users\Admin\AppData\Local\Temp\6b2ac2fc63492a8ac1bd73bdfccd7d0d8041d35fbce7b0bdcc9678a8e557b92b.exe
"C:\Users\Admin\AppData\Local\Temp\6b2ac2fc63492a8ac1bd73bdfccd7d0d8041d35fbce7b0bdcc9678a8e557b92b.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1656
- C:\Users\Admin\AppData\Local\Temp\Unicorn-46490.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-46490.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2552
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62909.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62909.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-133.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-133.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11399.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50377.exe
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28862.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20798.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18777.exe
        9⤵
        
        PID:4328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6472.exe
        9⤵
        
        PID:4896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14172.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:6000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25845.exe
        9⤵
        
        PID:5392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60345.exe
        9⤵
        
        PID:6948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9186.exe
        9⤵
        
        PID:7152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46812.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:2484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54608.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2715.exe
        8⤵
        
        PID:4696
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1956 -s 244
        8⤵
        Program crash
        
        PID:4964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15130.exe
        7⤵
        
        PID:2124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13862.exe
        8⤵
        
        PID:4860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57619.exe
        8⤵
        
        PID:4572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14172.exe
        8⤵
        
        PID:6012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56571.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56261.exe
        8⤵
        
        PID:7040
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2124 -s 228
        8⤵
        
        PID:7092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9208.exe
        7⤵
        
        PID:920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40053.exe
        7⤵
        
        PID:3732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27490.exe
        7⤵
        
        PID:4724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-872.exe
        7⤵
        
        PID:4824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11902.exe
        7⤵
        
        PID:5880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61716.exe
        7⤵
        
        PID:6152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34009.exe
        7⤵
        
        PID:6964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64847.exe
        7⤵
        
        PID:6756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6858.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24114.exe
        7⤵
        
        PID:2640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64962.exe
        8⤵
        
        PID:4244
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2640 -s 228
        8⤵
        Program crash
        
        PID:4884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59858.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10477.exe
        7⤵
        
        PID:4064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49731.exe
        7⤵
        
        PID:4176
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 936 -s 244
        7⤵
        Program crash
        
        PID:5068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58824.exe
        6⤵
        
        PID:1504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2165.exe
        7⤵
        
        PID:3952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9129.exe
        7⤵
        
        PID:4664
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1504 -s 224
        7⤵
        Program crash
        
        PID:5132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34918.exe
        6⤵
        
        PID:2028
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1776 -s 240
        6⤵
        Program crash
        
        PID:3248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41393.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64248.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13039.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5587.exe
        8⤵
        
        PID:1372
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2968 -s 248
        8⤵
        Program crash
        
        PID:3376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30646.exe
        7⤵
        
        PID:2260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15980.exe
        7⤵
        
        PID:3508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50717.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50983.exe
        7⤵
        
        PID:4456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30742.exe
        7⤵
        
        PID:5976
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1220 -s 224
        7⤵
        Program crash
        
        PID:2756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30506.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49280.exe
        7⤵
        
        PID:3088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63571.exe
        7⤵
        
        PID:4284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20207.exe
        7⤵
        
        PID:4956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20037.exe
        7⤵
        
        PID:6080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9011.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39725.exe
        7⤵
        
        PID:7052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26252.exe
        7⤵
        
        PID:6276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13702.exe
        6⤵
        
        PID:2940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27959.exe
        6⤵
        
        PID:3992
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2420 -s 244
        6⤵
        Program crash
        
        PID:4108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51896.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-548.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11345.exe
        7⤵
        
        PID:4024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57396.exe
        7⤵
        
        PID:4904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59102.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4580
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 320 -s 228
        7⤵
        Program crash
        
        PID:6068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1674.exe
        6⤵
        
        PID:2404
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2772 -s 224
        6⤵
        Program crash
        
        PID:3420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11129.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47518.exe
        6⤵
        
        PID:1916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48548.exe
        6⤵
        
        PID:3680
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1760 -s 220
        6⤵
        Program crash
        
        PID:4120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-741.exe
        5⤵
        
        PID:1080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58098.exe
        5⤵
        
        PID:3320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18077.exe
        5⤵
        
        PID:3808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29982.exe
        5⤵
        
        PID:4352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20942.exe
        5⤵
        
        PID:6024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37965.exe
        5⤵
        
        PID:5964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56109.exe
        5⤵
        
        PID:7096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38864.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58716.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58716.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24586.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8140.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49106.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21679.exe
        7⤵
        
        PID:4000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41920.exe
        7⤵
        
        PID:4136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5377.exe
        7⤵
        
        PID:4308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31901.exe
        7⤵
        
        PID:5544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48417.exe
        7⤵
        
        PID:5472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47580.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26236.exe
        7⤵
        
        PID:6540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18311.exe
        6⤵
        
        PID:2244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44766.exe
        7⤵
        
        PID:5788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1699.exe
        6⤵
        
        PID:1000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52196.exe
        6⤵
        
        PID:3640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49940.exe
        6⤵
        
        PID:4536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9087.exe
        6⤵
        
        PID:5124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21077.exe
        6⤵
        
        PID:5428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46002.exe
        6⤵
        
        PID:6532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49022.exe
        6⤵
        
        PID:6796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51674.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36283.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35741.exe
        7⤵
        
        PID:3524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8086.exe
        7⤵
        
        PID:5060
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 916 -s 224
        7⤵
        Program crash
        
        PID:5204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31570.exe
        6⤵
        
        PID:2452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51602.exe
        7⤵
        
        PID:1148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48548.exe
        7⤵
        
        PID:3660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40104.exe
        7⤵
        
        PID:5108
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2452 -s 228
        7⤵
        Program crash
        
        PID:5196
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 700 -s 244
        6⤵
        Program crash
        
        PID:2204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61455.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22225.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37356.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61681.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51397.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45057.exe
        6⤵
        
        PID:5460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6534.exe
        6⤵
        
        PID:5800
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2416 -s 244
        6⤵
        Program crash
        
        PID:6512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26921.exe
        5⤵
        
        PID:2164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13481.exe
        5⤵
        
        PID:3124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11619.exe
        5⤵
        
        PID:3720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12535.exe
        5⤵
        
        PID:4852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24056.exe
        5⤵
        
        PID:5436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18716.exe
        5⤵
        
        PID:5144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44867.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25487.exe
        5⤵
        
        PID:6804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5819.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5819.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10662.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2192
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2192 -s 244
        6⤵
        Program crash
        
        PID:3008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31850.exe
        5⤵
        
        PID:2896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40209.exe
        6⤵
        
        PID:4036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28890.exe
        6⤵
        
        PID:4368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28422.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29213.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5524
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2896 -s 244
        6⤵
        Program crash
        
        PID:6648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8248.exe
        5⤵
        
        PID:1524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59897.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12716.exe
        5⤵
        
        PID:4540
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2532 -s 248
        5⤵
        Program crash
        
        PID:4968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8259.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8259.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49957.exe
        5⤵
        
        PID:2960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50987.exe
        5⤵
        
        PID:3936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7732.exe
        5⤵
        
        PID:4828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26073.exe
        5⤵
        
        PID:4740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7288.exe
        5⤵
        
        PID:6056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31370.exe
        5⤵
        
        PID:6184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56791.exe
        5⤵
        
        PID:7084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4721.exe
        5⤵
        
        PID:6280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18255.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18255.exe
      4⤵
      PID:1532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62483.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62483.exe
      4⤵
      PID:3164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55327.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55327.exe
      4⤵
      PID:3532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56541.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56541.exe
      4⤵
      PID:4844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18721.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18721.exe
      4⤵
      PID:5416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22916.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22916.exe
      4⤵
      PID:5256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17132.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17132.exe
      4⤵
      PID:6560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7286.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7286.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6768
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37636.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37636.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31519.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31519.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52899.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4165.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19947.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55691.exe
        8⤵
        
        PID:1744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56158.exe
        9⤵
        
        PID:2476
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1744 -s 228
        9⤵
        Program crash
        
        PID:3408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61373.exe
        8⤵
        
        PID:864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11812.exe
        9⤵
        
        PID:3340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45611.exe
        9⤵
        
        PID:4752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10332.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:5332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57801.exe
        9⤵
        
        PID:6108
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 864 -s 224
        9⤵
        Program crash
        
        PID:6656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50791.exe
        8⤵
        
        PID:3500
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1488 -s 248
        8⤵
        Program crash
        
        PID:3792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56822.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28331.exe
        8⤵
        
        PID:4996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9612.exe
        8⤵
        
        PID:5644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4266.exe
        8⤵
        
        PID:6664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10318.exe
        8⤵
        
        PID:7128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33987.exe
        7⤵
        
        PID:2800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7271.exe
        7⤵
        
        PID:3904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11237.exe
        7⤵
        
        PID:4276
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2612 -s 248
        7⤵
        Program crash
        
        PID:5160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30615.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1415.exe
        7⤵
        
        PID:2504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59814.exe
        7⤵
        
        PID:4052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1977.exe
        7⤵
        
        PID:4716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16197.exe
        7⤵
        
        PID:5344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53220.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6140
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2064 -s 248
        7⤵
        Program crash
        
        PID:6624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45306.exe
        6⤵
        
        PID:1604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6677.exe
        7⤵
        
        PID:2224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11791.exe
        7⤵
        
        PID:3592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56632.exe
        7⤵
        
        PID:5044
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1604 -s 228
        7⤵
        Program crash
        
        PID:5168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47637.exe
        6⤵
        
        PID:1992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39063.exe
        6⤵
        
        PID:3756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26798.exe
        6⤵
        
        PID:4160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3594.exe
        6⤵
        
        PID:4292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65084.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40667.exe
        6⤵
        
        PID:6496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53222.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48467.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2332
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2332 -s 244
        6⤵
        Program crash
        
        PID:2564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2415.exe
        5⤵
        
        PID:2624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34942.exe
        6⤵
        
        PID:4628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29461.exe
        6⤵
        
        PID:5248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19263.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5840
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2624 -s 248
        6⤵
        Program crash
        
        PID:6608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40756.exe
        5⤵
        
        PID:1400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51232.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61718.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17937.exe
        5⤵
        
        PID:4732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55908.exe
        5⤵
        
        PID:5952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60464.exe
        5⤵
        
        PID:5404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38209.exe
        5⤵
        
        PID:7020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37111.exe
        5⤵
        
        PID:1368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39639.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39639.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6303.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18276.exe
        6⤵
        
        PID:2392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58400.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49124.exe
        7⤵
        
        PID:3988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40680.exe
        7⤵
        
        PID:2424
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2392 -s 248
        7⤵
        Program crash
        
        PID:5176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2873.exe
        6⤵
        
        PID:328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54032.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17297.exe
        6⤵
        
        PID:4524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17407.exe
        6⤵
        
        PID:4920
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2160 -s 248
        6⤵
        Program crash
        
        PID:6048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63947.exe
        5⤵
        
        PID:3036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40313.exe
        6⤵
        
        PID:4948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25185.exe
        6⤵
        
        PID:4448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35600.exe
        6⤵
        
        PID:5352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10131.exe
        6⤵
        
        PID:6596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40548.exe
        6⤵
        
        PID:6828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55503.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2212
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 960 -s 248
        5⤵
        Program crash
        
        PID:3336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20593.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20593.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35655.exe
        5⤵
        
        PID:2732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39172.exe
        6⤵
        
        PID:6672
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2724 -s 248
        5⤵
        Program crash
        
        PID:2336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55426.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55426.exe
      4⤵
      PID:956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64518.exe
        5⤵
        
        PID:2676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47916.exe
        6⤵
        
        PID:4060
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 956 -s 248
        5⤵
        Program crash
        
        PID:3384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55588.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55588.exe
      4⤵
      PID:2136
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2924 -s 236
      4⤵
      Program crash
      PID:3296
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58061.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58061.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:3044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17980.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17980.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20969.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13200.exe
        6⤵
        
        PID:1140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65377.exe
        6⤵
        
        PID:3816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5786.exe
        6⤵
        
        PID:4784
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2384 -s 248
        6⤵
        Program crash
        
        PID:4876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42815.exe
        5⤵
        
        PID:2808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29909.exe
        6⤵
        
        PID:6984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42540.exe
        5⤵
        
        PID:2884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42466.exe
        5⤵
        
        PID:3928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56738.exe
        5⤵
        
        PID:4592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23861.exe
        5⤵
        
        PID:5260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16993.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5996
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2464 -s 248
        5⤵
        Program crash
        
        PID:6584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25607.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25607.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22225.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8771.exe
        6⤵
        
        PID:3620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32263.exe
        6⤵
        
        PID:4940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7291.exe
        6⤵
        
        PID:5328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3229.exe
        6⤵
        
        PID:6088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40444.exe
        6⤵
        
        PID:7112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24863.exe
        6⤵
        
        PID:7160
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2880 -s 236
        5⤵
        Program crash
        
        PID:3080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16094.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16094.exe
      4⤵
      PID:2284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56957.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56957.exe
      4⤵
      PID:1636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28154.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28154.exe
      4⤵
      PID:3888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61007.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61007.exe
      4⤵
      PID:4632
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3044 -s 240
      4⤵
      Program crash
      PID:5444
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54471.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54471.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4461.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4461.exe
      4⤵
      PID:2916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45380.exe
        5⤵
        
        PID:2680
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2916 -s 248
        5⤵
        Program crash
        
        PID:3776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39629.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39629.exe
      4⤵
      PID:2876
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1528 -s 244
      4⤵
      Program crash
      PID:3472
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24119.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24119.exe
    3⤵
    PID:1312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2824.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2824.exe
      4⤵
      PID:4380
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1312 -s 228
      4⤵
      Program crash
      PID:4900
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57548.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57548.exe
    3⤵
    PID:3060
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45540.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45540.exe
    3⤵
    PID:3572
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46946.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46946.exe
    3⤵
    PID:4656
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56608.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56608.exe
    3⤵
    PID:4748
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54773.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54773.exe
    3⤵
    PID:6060
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41013.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41013.exe
    3⤵
    PID:5368
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57810.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57810.exe
    3⤵
    PID:6988
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38587.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38587.exe
    3⤵
    PID:7060
- C:\Users\Admin\AppData\Local\Temp\Unicorn-65.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-65.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2860
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57502.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57502.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64191.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64191.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:3040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11757.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1464
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1464 -s 240
        6⤵
        Program crash
        
        PID:1660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39805.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61830.exe
        6⤵
        
        PID:1708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11293.exe
        7⤵
        
        PID:2572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22725.exe
        7⤵
        
        PID:4372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5620.exe
        7⤵
        
        PID:5820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27215.exe
        7⤵
        
        PID:5816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5114.exe
        7⤵
        
        PID:6808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44188.exe
        7⤵
        
        PID:6816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63148.exe
        6⤵
        
        PID:2528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51894.exe
        6⤵
        
        PID:3528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48024.exe
        6⤵
        
        PID:4604
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1904 -s 244
        6⤵
        Program crash
        
        PID:4680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53562.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26579.exe
        6⤵
        
        PID:3700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17302.exe
        6⤵
        
        PID:4044
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2560 -s 244
        6⤵
        Program crash
        
        PID:4392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39770.exe
        5⤵
        
        PID:2052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2031.exe
        5⤵
        
        PID:3600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20685.exe
        5⤵
        
        PID:4640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52940.exe
        5⤵
        
        PID:4688
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3040 -s 248
        5⤵
        Program crash
        
        PID:6020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32924.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32924.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8524.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47850.exe
        6⤵
        
        PID:1724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15185.exe
        7⤵
        
        PID:4208
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1724 -s 228
        7⤵
        Program crash
        
        PID:4960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41492.exe
        6⤵
        
        PID:1472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22093.exe
        6⤵
        
        PID:3980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17058.exe
        6⤵
        
        PID:4124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62249.exe
        6⤵
        
        PID:4304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15366.exe
        6⤵
        
        PID:5528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65483.exe
        6⤵
        
        PID:5384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26049.exe
        6⤵
        
        PID:6212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20901.exe
        6⤵
        
        PID:6604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3864.exe
        5⤵
        
        PID:2844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30990.exe
        6⤵
        
        PID:2388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28127.exe
        6⤵
        
        PID:3716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37966.exe
        6⤵
        
        PID:4196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34288.exe
        6⤵
        
        PID:5136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20547.exe
        6⤵
        
        PID:5500
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2844 -s 228
        6⤵
        Program crash
        
        PID:6616
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 928 -s 240
        5⤵
        Program crash
        
        PID:2408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19306.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19306.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30637.exe
        5⤵
        Executes dropped EXE
        
        PID:3024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33185.exe
        6⤵
        
        PID:3796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54635.exe
        6⤵
        
        PID:1240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10612.exe
        6⤵
        
        PID:4704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4412.exe
        6⤵
        
        PID:5272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60101.exe
        6⤵
        
        PID:5764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23908.exe
        6⤵
        
        PID:7068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41929.exe
        6⤵
        
        PID:4072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64243.exe
        5⤵
        
        PID:1820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21024.exe
        5⤵
        
        PID:3764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1900.exe
        5⤵
        
        PID:3292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54875.exe
        5⤵
        
        PID:4452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18106.exe
        5⤵
        
        PID:5224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60631.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44139.exe
        5⤵
        
        PID:6996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10211.exe
        5⤵
        
        PID:6920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2468.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2468.exe
      4⤵
      PID:1592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64277.exe
        5⤵
        
        PID:4408
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1592 -s 228
        5⤵
        Program crash
        
        PID:5076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64872.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64872.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38829.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38829.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45872.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45872.exe
      4⤵
      PID:1988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59722.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59722.exe
      4⤵
      PID:4488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21902.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21902.exe
      4⤵
      PID:5732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7815.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7815.exe
      4⤵
      PID:5884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62715.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62715.exe
      4⤵
      PID:6240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44702.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44702.exe
      4⤵
      PID:6556
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59100.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59100.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50652.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50652.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5016.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53937.exe
        6⤵
        
        PID:2964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16552.exe
        6⤵
        
        PID:324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40301.exe
        6⤵
        
        PID:3468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58797.exe
        6⤵
        
        PID:4420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3064.exe
        6⤵
        
        PID:1468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4012.exe
        6⤵
        
        PID:5388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1996.exe
        6⤵
        
        PID:6504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54357.exe
        6⤵
        
        PID:3280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3921.exe
        5⤵
        
        PID:2848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30287.exe
        5⤵
        
        PID:1700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46166.exe
        5⤵
        
        PID:3480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50132.exe
        5⤵
        
        PID:4432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9087.exe
        5⤵
        
        PID:1576
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1012 -s 244
        5⤵
        Program crash
        
        PID:5236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5379.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5379.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50533.exe
        5⤵
        
        PID:924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48548.exe
        5⤵
        
        PID:3688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58578.exe
        5⤵
        
        PID:4152
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1176 -s 228
        5⤵
        Program crash
        
        PID:5216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19493.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19493.exe
      4⤵
      PID:3048
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1048 -s 248
      4⤵
      Program crash
      PID:3436
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18455.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18455.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45966.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45966.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63117.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63252.exe
        6⤵
        
        PID:3192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41723.exe
        6⤵
        
        PID:3708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21027.exe
        6⤵
        
        PID:4976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6659.exe
        6⤵
        
        PID:5548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53796.exe
        6⤵
        
        PID:5760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50468.exe
        6⤵
        
        PID:6632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2183.exe
        6⤵
        
        PID:7144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36676.exe
        5⤵
        
        PID:2912
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2060 -s 240
        5⤵
        Program crash
        
        PID:3484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43251.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43251.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37684.exe
        5⤵
        
        PID:2540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63380.exe
        6⤵
        
        PID:6820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34163.exe
        6⤵
        
        PID:6776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63698.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20347.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59648.exe
        5⤵
        
        PID:4348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47278.exe
        5⤵
        
        PID:5988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43565.exe
        5⤵
        
        PID:5836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40974.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20398.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42436.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42436.exe
      4⤵
      PID:2804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17761.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17761.exe
      4⤵
      PID:3392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17547.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17547.exe
      4⤵
      PID:4008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34447.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34447.exe
      4⤵
      PID:4356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47808.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47808.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39100.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39100.exe
      4⤵
      PID:5232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14108.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14108.exe
      4⤵
      PID:7076
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2840 -s 248
      4⤵
      Program crash
      PID:6916
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25281.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25281.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56459.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56459.exe
      4⤵
      PID:2256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28804.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28804.exe
      4⤵
      PID:2488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36601.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36601.exe
      4⤵
      PID:3960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65403.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65403.exe
      4⤵
      PID:4600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40397.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40397.exe
      4⤵
      PID:5276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34738.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34738.exe
      4⤵
      PID:5744
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2956 -s 244
      4⤵
      Program crash
      PID:6520
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29246.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29246.exe
    3⤵
    PID:2644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56504.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56504.exe
      4⤵
      PID:5948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6867.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6867.exe
      4⤵
      PID:6724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43732.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43732.exe
      4⤵
      PID:6264
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47900.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47900.exe
    3⤵
    PID:2500
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44061.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44061.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3628
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28939.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28939.exe
    3⤵
    PID:4500
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64824.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64824.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5188
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63949.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63949.exe
    3⤵
    PID:5412
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2860 -s 244
    3⤵
    - Program crash
    PID:6568
- C:\Users\Admin\AppData\Local\Temp\Unicorn-8393.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-8393.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2668
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2668 -s 240
    3⤵
    - Loads dropped DLL
    - Program crash
    PID:1060
- C:\Users\Admin\AppData\Local\Temp\Unicorn-13163.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-13163.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:2832
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44622.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44622.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23216.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23216.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54373.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17835.exe
        6⤵
        
        PID:3552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6420.exe
        6⤵
        
        PID:4016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53783.exe
        6⤵
        
        PID:4388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55943.exe
        6⤵
        
        PID:6004
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1612 -s 224
        6⤵
        Program crash
        
        PID:6076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55343.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11896.exe
        5⤵
        
        PID:3356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5792.exe
        5⤵
        
        PID:3548
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2864 -s 240
        5⤵
        Program crash
        
        PID:4296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54928.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54928.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-128.exe
        5⤵
        
        PID:3580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31692.exe
        5⤵
        
        PID:2596
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2080 -s 224
        5⤵
        Program crash
        
        PID:4428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62856.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62856.exe
      4⤵
      PID:1908
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2188 -s 236
      4⤵
      Program crash
      PID:3328
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44191.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44191.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63584.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63584.exe
      4⤵
      PID:2040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53416.exe
        5⤵
        
        PID:5036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1641.exe
        5⤵
        
        PID:5780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47058.exe
        5⤵
        
        PID:5396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8268.exe
        5⤵
        
        PID:7008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36546.exe
        5⤵
        
        PID:7016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37683.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37683.exe
      4⤵
      PID:2480
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2752 -s 244
      4⤵
      Program crash
      PID:3492
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12145.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12145.exe
    3⤵
    PID:2360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65097.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65097.exe
      4⤵
      PID:3540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37442.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37442.exe
      4⤵
      PID:4804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36975.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36975.exe
      4⤵
      PID:5360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64599.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64599.exe
      4⤵
      PID:5616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1466.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1466.exe
      4⤵
      PID:6640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24012.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24012.exe
      4⤵
      PID:6888
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61368.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61368.exe
    3⤵
    PID:1628
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2832 -s 240
    3⤵
    - Program crash
    PID:3256
- C:\Users\Admin\AppData\Local\Temp\Unicorn-2827.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-2827.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:748
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35551.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35551.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32365.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32365.exe
      4⤵
      PID:2084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52980.exe
        5⤵
        
        PID:4464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-437.exe
        5⤵
        
        PID:5848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1505.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58896.exe
        5⤵
        
        PID:6868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60724.exe
        5⤵
        
        PID:6716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50704.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50704.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13575.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13575.exe
      4⤵
      PID:3780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19819.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19819.exe
      4⤵
      PID:4756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52410.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52410.exe
      4⤵
      PID:4648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60374.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60374.exe
      4⤵
      PID:5856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64772.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64772.exe
      4⤵
      PID:5340
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29230.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29230.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34388.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34388.exe
      4⤵
      PID:6736
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42239.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42239.exe
    3⤵
    PID:2268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43159.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43159.exe
      4⤵
      PID:2988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40296.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40296.exe
      4⤵
      PID:3364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15516.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15516.exe
      4⤵
      PID:4512
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2268 -s 248
      4⤵
      Program crash
      PID:4800
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53365.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53365.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1740
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 748 -s 236
    3⤵
    - Program crash
    PID:3308
- C:\Users\Admin\AppData\Local\Temp\Unicorn-51466.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-51466.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1920
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40118.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40118.exe
    3⤵
    PID:2868
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53208.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53208.exe
    3⤵
    PID:3892
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14037.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14037.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4264
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1920 -s 228
    3⤵
    - Program crash
    PID:5152
- C:\Users\Admin\AppData\Local\Temp\Unicorn-1271.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-1271.exe
  2⤵
  PID:2600
- C:\Users\Admin\AppData\Local\Temp\Unicorn-53632.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-53632.exe
  2⤵
  PID:3348
- C:\Users\Admin\AppData\Local\Temp\Unicorn-56748.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-56748.exe
  2⤵
  PID:3956
- C:\Users\Admin\AppData\Local\Temp\Unicorn-28847.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-28847.exe
  2⤵
  PID:5024
- C:\Users\Admin\AppData\Local\Temp\Unicorn-62943.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-62943.exe
  2⤵
  PID:5956
- C:\Users\Admin\AppData\Local\Temp\Unicorn-57566.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-57566.exe
  2⤵
  PID:5612
- C:\Users\Admin\AppData\Local\Temp\Unicorn-12468.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-12468.exe
  2⤵
  PID:6976
- C:\Users\Admin\AppData\Local\Temp\Unicorn-8811.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-8811.exe
  2⤵
  PID:6840

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-12145.exe

Filesize
468KB

MD5
1cd33cabca7816e53bf3414dd164b10f

SHA1
57db1f387a2304ed2bf00153a9713827404212e1

SHA256
861b5aeb0aeb4b963791f0ee32e0ca1083b66d265c5da22becaf556118241215

SHA512
e2a43a0c1fc9ef847f6e4d5eaaa56395ff2b45429bffd2aa6265b99d817b478032b9a0dab934085567fb789ecaed4987af9f8131097d3fc939a9ef7e54e26112

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-13163.exe

Filesize
468KB

MD5
cf86a558f9c1377100e26bee1b8fb7ea

SHA1
4686a00d52a2d0b96d133fd96e07b2efd7ad4503

SHA256
7c35b24df9989b3084c4c81c6ffe606e8653e38f8cec3f7d9848323ffa499179

SHA512
6d6584562deb5e3aab58f38ec73d60d6c92676d317e1182529ed7319b2becbe7789de8b1c1696adf0f06dbdc673e06abbc1baf17952f849ef48475b0a7fad590

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-133.exe

Filesize
468KB

MD5
462d6c29cee22d7a4cee7ff028ab3fd9

SHA1
89984d7a910cb92199c87ab010fa70ff99ae07a4

SHA256
bd9fe4a09f8b81be11e953fed96664e467c2227f6a449a7985fdbe890fa67097

SHA512
1c0992f23cbba87f6fb09871aa7c0f6260e96bc6739e4d9d3f5b6f2afb5092e76b0b0ea6f8aafe0a35511db1b6bfc10694c3bea571e81f466dd2e3f634063432

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-17835.exe

Filesize
468KB

MD5
4ce60d14c151f56fb7abba42eeb2d87c

SHA1
7b58c2a57d51ed4ba6f9794f39d6756cd2f731af

SHA256
5f0ac69c8e8f4b18f5cb0baa70128cdfe5b1fb8938ad5d95ee4cfc13116c9912

SHA512
01b262e4d5cd1cb9915feff9f47b85038cba419e42a4ddb18794987c4203301bb7c76f81e43e7fc7d1ede0b2006a05b849f16adb036170f4fe150154393f539c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-31519.exe

Filesize
468KB

MD5
b82d57474b41fc554ca5a8ab8e008910

SHA1
4fb625599077feaa2cf2b8f4726307ff5b69405a

SHA256
361add7292fbd6ca9183fb9963c707062202f0f7786d656465e19e085dc0b3a3

SHA512
5cfa83901b458792b199f1d33370575edf4a69a11d27c5ac0d853ed838e72fbedd5798e44d6c2ba012e6981a138e59d615ef8d42f2b1dd20661e7912e269786d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-37636.exe

Filesize
468KB

MD5
4f1510fe2b3f6778539aca58793eee3f

SHA1
e85cc28af5c5eac3c7423f62d7b993d60c4c4d7d

SHA256
70725c314ca425059f1ae143acc223bb1858195301d8aebed66fa48f1012c4ab

SHA512
de94868adf99fe789bc621a6db2c5c343c29924bfa0a1fd36793779080c17955bcb6365412fad2e00eec1611002da054157c224508a40b57ef3956fc86dcc062

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39639.exe

Filesize
468KB

MD5
49a392c301d04d3a15f9462f46ecc731

SHA1
b4308eefc545727de6c80b78fc190568d2c64e84

SHA256
c8c3121bb07e38662e6f7ac05cfce4445083ad516d196d31158f47f9a4e455d2

SHA512
de769b5d4ba7f1a985c1900e4f9df9636d2d4b9e6d564766b11d1db1863d1a24abb3795b846583658160f39880f91df1a786c950ba98bac864a75951575c345b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39805.exe

Filesize
468KB

MD5
dbc12b545d00be830e447338f0fe1a5e

SHA1
58907c144e8c1b2cadc55c7e3cf2b20448e1328a

SHA256
f09538e3ae5634abb6d6cf2887b73fd7796ae9b011c480e717bbf7a08a591817

SHA512
6e44cf0d13612b709dc47bd472ac4810ed6c3f8c8bc991f62bec2930b6cffbb2a621c5000e410f19ba504b5ea6a8ef52505eddca1cb15bb4318c7e50e90ecdd8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-44622.exe

Filesize
468KB

MD5
ceb28c2832bc2fd50e8a05face988ba2

SHA1
941fc5b5e8fc55e73894780de9110cec53b1f602

SHA256
65148b6f0b6504b1d081917de4c917e860f8fece77914f78cd02cc46d2cf8bb8

SHA512
c899fb12a1f02883f35be16da6d87d3d9d83570da3d6cd3690c2cf81fa218272e52ad9b23aa4e4b1c02a9913b73ed07241bc9c64ec3724bec62a9dfebf8603dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-56957.exe

Filesize
468KB

MD5
fd8a0611a3b0146e37bc041e2293ed8a

SHA1
6cfc7d1d2bc0595520e21a0d0033a28cbe5dc5e2

SHA256
6719db8b820b1bb26f2d6ab417c7f600451d5823608c533a0b8a238e14678d3e

SHA512
6eac60ada1632f442fc210435123af4e12dfab56c168796834ec06f16fe9c9f7b3350d5201d140ac473293e91dbaa2b8842b66631457c2f1b38e56ba40dd86c9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-57502.exe

Filesize
468KB

MD5
cd91006b3c52c05384870d261490990f

SHA1
77153e005ed0db1e36d366e416a315f985f2ca2d

SHA256
5bb396c1bc36c741f6449a37eddfcc944402b834afb4e387071227d568f108ec

SHA512
3cbb1a8481677ffa44d6cfd7b4957cd9da0259918926edb653d70eae4e2b9e5de6f9c08b4ba48de5e6a990b427144495aecbc6000505008242a0d4dc59fab50d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-8393.exe

Filesize
468KB

MD5
f912c69cef447fae5431cd58bd620d9b

SHA1
feb9e94a58a4817d597092331b4ca0e01acaa0a7

SHA256
b3219e13c043e2da382bd235f237ac070e4e7a692422ae1b6840a439aade7f0b

SHA512
9fb56dedb414d090688e2b1df9d1d2c5754814fbe172321aebb2541907e2465153bee574a9ad91f975d831db68f9ba21dbc40d9fa4a983c65784c689dba92cbc

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-11399.exe

Filesize
468KB

MD5
34d122925e51bada88cdcf3b99b7645b

SHA1
441871d94ac4679c4cf9d54f5a8ed807a64a469a

SHA256
45b9c982565c5ae7edf4e1774aa7064438014f73b5139329c71a2b174007b0c8

SHA512
c2497d662a38ece628b84f1cc19c344b4056a90c1f3b9964d63e7bdec862724085980ff3b6bea94c1de0892c056e76bbef731d3597ca5799849f7b83a38efe7c

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-41393.exe

Filesize
468KB

MD5
9a697d52bea2133fa2b6e8b6b4e2d0d9

SHA1
0dff2abf45d827daf3d1f35ae3fde23f3d126f6e

SHA256
ccad2b117422a4103f2d026c4ce06e124a146e6b737b83197cea1f0e2029cd7d

SHA512
16eab393cb55b2073c1467683b866cd03219bdb560dda410bb27d6eec3ee1758a186fd01d1398a26056b2322493c158ce09c16ee26ef3ccf557eed92d23bd2f2

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-46490.exe

Filesize
468KB

MD5
a167a72adf1ed52baca178ab39605431

SHA1
ad1e9425e4511e30b0ffc29668c877bf741747c0

SHA256
42068bb21ea8d948bb2963850b1823cb3f46f3b820ab0f31074e721daa533416

SHA512
cbaac2541cd8c82a4ecfb16c29f6285fdca3a443ccbdea38ffdbe7e61d1528b37bc336f04b67840132da262f0b273c9389394a655c6cc6d9840f59bec39d6e70

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-50377.exe

Filesize
468KB

MD5
e28923b0bacf9d911eb958e8cb895b68

SHA1
9a31026a485350a5cfd3c320a4321cda339ab016

SHA256
63eac8eb82a960d0a208f06099181f27186a94e57dc6a685a18ac70c6037c5f6

SHA512
24c94772ce925c8b27025ab6f0685b7533da56e9bbdf0792c205b79fb79640420499ea0d3a79e5f9a403a9bd11defdc9f4cc7190ccf5a84a3a7c4de6b2163079

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-52899.exe

Filesize
468KB

MD5
640132052942a103e059b63ed2baf611

SHA1
e91a7151ab3bcfb2f06367c2378f65f121df6037

SHA256
31d8d8f340b1084bcc76bf4c08ac7134e2195a505fecf90da52199aaf48f1ada

SHA512
3c7a1538aafa177effd15205df507b5a76dac9d49ec3e3e8b07c8512fab6a51a1707787000984f287ebc3ce2747efa1350a5a2e7d9d9164b62dd65ea6def97f6

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-58061.exe

Filesize
468KB

MD5
e618c6e4452033252f9a87ecb98fd55c

SHA1
488de79442e40b79f0768931ea6489b713d84234

SHA256
145b5578da3843c110843b556435e8e8cb685888e121c60a57f0a965f3255713

SHA512
09cec2eda2f21766f5d29dee1c5ee0603b3f32efaaa13b452e7535928bb990a59db933124bc3b737e16168215a8b2e2243b1a201689d559519dc614ce1c8ea4f

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-58716.exe

Filesize
468KB

MD5
294d0f9a3cb7f365b14851fe4499d243

SHA1
73b00a3ec1243e048a8a71c08ac6601296f91f9f

SHA256
b74470d27b2717a62edffc3fbca18870713b5be110823204ad99cac5834ef720

SHA512
793f4c41c66d1cd8fe64c690ca98219f872bdf8ac1b33251dcb2b05570a8de1ff35eb93cb36a660bb3ed068b8bd60e771a566ad38abb7937e5fd45c60cada172

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-59100.exe

Filesize
468KB

MD5
7ef9cef8ef7670802aa5775b480775d5

SHA1
11916627720156e56f7ac3de0233fdf8ab7757cf

SHA256
4791b6bd7d355a77368806cc8e6955eb2a1d65436bdea09b946c55daafa9fbbd

SHA512
8e95f7f1be03ffd7ce8a548598ac4c412db4d53a9fa0ef53a7b8f21842f65daee079328705820896f1b208c6de13a85a8a0fca03c0968ea9ead1a7edd570b376

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-62909.exe

Filesize
468KB

MD5
ff522896e2b206dc5e89f0fefa7f1dca

SHA1
0cbd11b62754a037501f27b3812d91facb3374fa

SHA256
ca2b865fa842dfeee8048eb34be911dbf951f13a4eda748df0003ab451a927ad

SHA512
59bf97bef842b7a48c35967e0174305f7dc47cd8ea6f102b6d38f462cfe5e464f8337d677d92253e045e3783ca43413bc05d78d593668883c0d6423042e88455

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-64191.exe

Filesize
468KB

MD5
629155046967b96dff66792415c428d1

SHA1
40221d4f41f1f2c95a7fd0015aed2b56f1167da1

SHA256
162bc0a1d9c0eabb1ad63686e0d6a4b5212316b1287ff6800641bdc0766b34e9

SHA512
23014fe144bb0cb7e9d21195a806f38ea37d1b89cf6864246c98e4f76f4c949754fc3a25e81312ff606c09d34feb3bb898a23c60d92a14ea431a919d8f780988

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-65.exe

Filesize
468KB

MD5
1dab8d50c367a0b3e91bcb01ff2eeb51

SHA1
c687f8562a290088738eb69f25d13775686570c5

SHA256
6de73ace67a09f3f792d9a0135a42791921732fb891ac8bf8a7016bfb3a97039

SHA512
ec281df88556ec97f676969aebff92ca4cf057ce2bd1b2a0069fb02c0ffb3066a3c71c061f6c8c6338bee2f390cede782b3f71b31530c373fa7a6a45ea6caf66

Download Submit