d7b8a44963c3a420d6a334577951f63863e50866a6468b950598242eb69b157f

Analysis

max time kernel
141s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19/09/2024, 02:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

d7b8a44963c3a420d6a334577951f63863e50866a6468b950598242eb69b157f.exe
Size

468KB
MD5

542d173857a3de30831ef5d34729166e
SHA1

54f9f8fb34d54ef1d6466f1bd0550f31b7cd0bac
SHA256

d7b8a44963c3a420d6a334577951f63863e50866a6468b950598242eb69b157f
SHA512

3835603a0abdcab31ad2c163fec2842313d16735e55dc43dfc6049ff7e2aca929d6847ac7e2f812d55c2cbaed57c66a096a1390d3f562e9da309d7ae6d7d6188
SSDEEP

3072:S8X+o15+PC8e2aY2Pziirf8/vCmDZ4pahdHeZVrPnrgbSN6ImcjsY0:S8OoC7e2OPeirf4EnvrgbeLmcj

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
3068	Unicorn-36106.exe
1480	Unicorn-65343.exe
2360	Unicorn-61814.exe
2912	Unicorn-58296.exe
2892	Unicorn-38753.exe
2624	Unicorn-54767.exe
2756	Unicorn-35638.exe
2432	Unicorn-19021.exe
1120	Unicorn-51693.exe
2516	Unicorn-51729.exe
2000	Unicorn-6057.exe
1980	Unicorn-51729.exe
1816	Unicorn-5792.exe
2020	Unicorn-65464.exe
2228	Unicorn-58413.exe
2256	Unicorn-19286.exe
3024	Unicorn-31490.exe
1620	Unicorn-49903.exe
1336	Unicorn-30914.exe
1692	Unicorn-50780.exe
1544	Unicorn-28121.exe
344	Unicorn-4267.exe
2464	Unicorn-4267.exe
2300	Unicorn-49228.exe
596	Unicorn-29627.exe
3040	Unicorn-40563.exe
1508	Unicorn-43363.exe
2564	Unicorn-49493.exe
2260	Unicorn-49493.exe
2748	Unicorn-59384.exe
2876	Unicorn-35657.exe
2736	Unicorn-41403.exe
2236	Unicorn-5886.exe
3000	Unicorn-53830.exe
2696	Unicorn-56945.exe
1408	Unicorn-63909.exe
1800	Unicorn-63909.exe
1964	Unicorn-63909.exe
2812	Unicorn-18238.exe
1160	Unicorn-9307.exe
1300	Unicorn-18238.exe
1532	Unicorn-18238.exe
1752	Unicorn-18238.exe
2156	Unicorn-18238.exe
2960	Unicorn-64039.exe
1864	Unicorn-14838.exe
2136	Unicorn-47547.exe
2204	Unicorn-1107.exe
2232	Unicorn-46779.exe
236	Unicorn-842.exe
1624	Unicorn-17252.exe
1236	Unicorn-60130.exe
948	Unicorn-33204.exe
1564	Unicorn-53380.exe
1756	Unicorn-63675.exe
3008	Unicorn-3868.exe
1716	Unicorn-32627.exe
2060	Unicorn-3100.exe
2084	Unicorn-2067.exe
2724	Unicorn-55674.exe
2648	Unicorn-53956.exe
2656	Unicorn-54221.exe
1432	Unicorn-65112.exe
2544	Unicorn-28102.exe

Loads dropped DLL 64 IoCs

pid	Process
2392	d7b8a44963c3a420d6a334577951f63863e50866a6468b950598242eb69b157f.exe
2392	d7b8a44963c3a420d6a334577951f63863e50866a6468b950598242eb69b157f.exe
3068	Unicorn-36106.exe
2392	d7b8a44963c3a420d6a334577951f63863e50866a6468b950598242eb69b157f.exe
3068	Unicorn-36106.exe
2392	d7b8a44963c3a420d6a334577951f63863e50866a6468b950598242eb69b157f.exe
1480	Unicorn-65343.exe
1480	Unicorn-65343.exe
2360	Unicorn-61814.exe
2360	Unicorn-61814.exe
2392	d7b8a44963c3a420d6a334577951f63863e50866a6468b950598242eb69b157f.exe
2392	d7b8a44963c3a420d6a334577951f63863e50866a6468b950598242eb69b157f.exe
3068	Unicorn-36106.exe
3068	Unicorn-36106.exe
2892	Unicorn-38753.exe
2912	Unicorn-58296.exe
2892	Unicorn-38753.exe
2912	Unicorn-58296.exe
2360	Unicorn-61814.exe
1480	Unicorn-65343.exe
2360	Unicorn-61814.exe
2392	d7b8a44963c3a420d6a334577951f63863e50866a6468b950598242eb69b157f.exe
2756	Unicorn-35638.exe
2392	d7b8a44963c3a420d6a334577951f63863e50866a6468b950598242eb69b157f.exe
2756	Unicorn-35638.exe
1480	Unicorn-65343.exe
3068	Unicorn-36106.exe
3068	Unicorn-36106.exe
2624	Unicorn-54767.exe
2624	Unicorn-54767.exe
1120	Unicorn-51693.exe
1120	Unicorn-51693.exe
2912	Unicorn-58296.exe
2912	Unicorn-58296.exe
2000	Unicorn-6057.exe
2000	Unicorn-6057.exe
2756	Unicorn-35638.exe
2516	Unicorn-51729.exe
2756	Unicorn-35638.exe
2516	Unicorn-51729.exe
2360	Unicorn-61814.exe
2360	Unicorn-61814.exe
2432	Unicorn-19021.exe
2020	Unicorn-65464.exe
2020	Unicorn-65464.exe
2432	Unicorn-19021.exe
2892	Unicorn-38753.exe
3068	Unicorn-36106.exe
2892	Unicorn-38753.exe
3068	Unicorn-36106.exe
1816	Unicorn-5792.exe
1980	Unicorn-51729.exe
2392	d7b8a44963c3a420d6a334577951f63863e50866a6468b950598242eb69b157f.exe
1480	Unicorn-65343.exe
2392	d7b8a44963c3a420d6a334577951f63863e50866a6468b950598242eb69b157f.exe
1480	Unicorn-65343.exe
1980	Unicorn-51729.exe
1816	Unicorn-5792.exe
2228	Unicorn-58413.exe
2228	Unicorn-58413.exe
2884	WerFault.exe
2884	WerFault.exe
2884	WerFault.exe
2884	WerFault.exe

Program crash 15 IoCs

pid	pid_target	Process	procid_target
2884	2756	WerFault.exe	36
2676	1620	WerFault.exe	48
2436	2000	WerFault.exe	43
1576	2156	WerFault.exe	72
2764	1752	WerFault.exe	75
1672	1336	WerFault.exe	49
2072	2812	WerFault.exe	73
2952	1300	WerFault.exe	71
3552	1532	WerFault.exe	70
3424	1484	WerFault.exe	106
3872	2576	WerFault.exe	126
3504	1712	WerFault.exe	108
3536	2352	WerFault.exe	132
2380	2900	WerFault.exe	134
2456	2992	WerFault.exe	133

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35638.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19021.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53700.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4977.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24957.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18238.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47547.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46270.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31894.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24078.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7119.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56648.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31894.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8244.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8244.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53593.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5806.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51948.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49493.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18581.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58659.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62642.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48871.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54767.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9307.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59139.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44635.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3140.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59806.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17205.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15359.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42023.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39011.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63323.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31714.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4267.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46779.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32223.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65399.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48668.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41629.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35657.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41403.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5024.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48871.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2177.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18238.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47038.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48871.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59342.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41629.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47558.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15743.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29882.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10828.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40563.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24890.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13597.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62606.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59851.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30812.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5024.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51179.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50780.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2392	d7b8a44963c3a420d6a334577951f63863e50866a6468b950598242eb69b157f.exe
3068	Unicorn-36106.exe
1480	Unicorn-65343.exe
2360	Unicorn-61814.exe
2912	Unicorn-58296.exe
2892	Unicorn-38753.exe
2624	Unicorn-54767.exe
2756	Unicorn-35638.exe
1120	Unicorn-51693.exe
2000	Unicorn-6057.exe
1980	Unicorn-51729.exe
2516	Unicorn-51729.exe
1816	Unicorn-5792.exe
2432	Unicorn-19021.exe
2020	Unicorn-65464.exe
2228	Unicorn-58413.exe
2256	Unicorn-19286.exe
3024	Unicorn-31490.exe
1620	Unicorn-49903.exe
1336	Unicorn-30914.exe
1692	Unicorn-50780.exe
344	Unicorn-4267.exe
2300	Unicorn-49228.exe
1544	Unicorn-28121.exe
2464	Unicorn-4267.exe
596	Unicorn-29627.exe
3040	Unicorn-40563.exe
1508	Unicorn-43363.exe
2260	Unicorn-49493.exe
2564	Unicorn-49493.exe
2748	Unicorn-59384.exe
2876	Unicorn-35657.exe
2736	Unicorn-41403.exe
2236	Unicorn-5886.exe
3000	Unicorn-53830.exe
2696	Unicorn-56945.exe
1800	Unicorn-63909.exe
1408	Unicorn-63909.exe
1300	Unicorn-18238.exe
1864	Unicorn-14838.exe
2812	Unicorn-18238.exe
1160	Unicorn-9307.exe
1964	Unicorn-63909.exe
2156	Unicorn-18238.exe
2960	Unicorn-64039.exe
1752	Unicorn-18238.exe
2204	Unicorn-1107.exe
1532	Unicorn-18238.exe
2136	Unicorn-47547.exe
236	Unicorn-842.exe
2232	Unicorn-46779.exe
1624	Unicorn-17252.exe
1236	Unicorn-60130.exe
948	Unicorn-33204.exe
1564	Unicorn-53380.exe
1756	Unicorn-63675.exe
3008	Unicorn-3868.exe
1716	Unicorn-32627.exe
2060	Unicorn-3100.exe
2724	Unicorn-55674.exe
2084	Unicorn-2067.exe
2656	Unicorn-54221.exe
2648	Unicorn-53956.exe
1432	Unicorn-65112.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2392 wrote to memory of 3068	2392	d7b8a44963c3a420d6a334577951f63863e50866a6468b950598242eb69b157f.exe	30
PID 2392 wrote to memory of 3068	2392	d7b8a44963c3a420d6a334577951f63863e50866a6468b950598242eb69b157f.exe	30
PID 2392 wrote to memory of 3068	2392	d7b8a44963c3a420d6a334577951f63863e50866a6468b950598242eb69b157f.exe	30
PID 2392 wrote to memory of 3068	2392	d7b8a44963c3a420d6a334577951f63863e50866a6468b950598242eb69b157f.exe	30
PID 3068 wrote to memory of 1480	3068	Unicorn-36106.exe	32
PID 3068 wrote to memory of 1480	3068	Unicorn-36106.exe	32
PID 3068 wrote to memory of 1480	3068	Unicorn-36106.exe	32
PID 3068 wrote to memory of 1480	3068	Unicorn-36106.exe	32
PID 2392 wrote to memory of 2360	2392	d7b8a44963c3a420d6a334577951f63863e50866a6468b950598242eb69b157f.exe	33
PID 2392 wrote to memory of 2360	2392	d7b8a44963c3a420d6a334577951f63863e50866a6468b950598242eb69b157f.exe	33
PID 2392 wrote to memory of 2360	2392	d7b8a44963c3a420d6a334577951f63863e50866a6468b950598242eb69b157f.exe	33
PID 2392 wrote to memory of 2360	2392	d7b8a44963c3a420d6a334577951f63863e50866a6468b950598242eb69b157f.exe	33
PID 1480 wrote to memory of 2912	1480	Unicorn-65343.exe	34
PID 1480 wrote to memory of 2912	1480	Unicorn-65343.exe	34
PID 1480 wrote to memory of 2912	1480	Unicorn-65343.exe	34
PID 1480 wrote to memory of 2912	1480	Unicorn-65343.exe	34
PID 2360 wrote to memory of 2892	2360	Unicorn-61814.exe	35
PID 2360 wrote to memory of 2892	2360	Unicorn-61814.exe	35
PID 2360 wrote to memory of 2892	2360	Unicorn-61814.exe	35
PID 2360 wrote to memory of 2892	2360	Unicorn-61814.exe	35
PID 2392 wrote to memory of 2756	2392	d7b8a44963c3a420d6a334577951f63863e50866a6468b950598242eb69b157f.exe	36
PID 2392 wrote to memory of 2756	2392	d7b8a44963c3a420d6a334577951f63863e50866a6468b950598242eb69b157f.exe	36
PID 2392 wrote to memory of 2756	2392	d7b8a44963c3a420d6a334577951f63863e50866a6468b950598242eb69b157f.exe	36
PID 2392 wrote to memory of 2756	2392	d7b8a44963c3a420d6a334577951f63863e50866a6468b950598242eb69b157f.exe	36
PID 3068 wrote to memory of 2624	3068	Unicorn-36106.exe	37
PID 3068 wrote to memory of 2624	3068	Unicorn-36106.exe	37
PID 3068 wrote to memory of 2624	3068	Unicorn-36106.exe	37
PID 3068 wrote to memory of 2624	3068	Unicorn-36106.exe	37
PID 2892 wrote to memory of 2432	2892	Unicorn-38753.exe	38
PID 2892 wrote to memory of 2432	2892	Unicorn-38753.exe	38
PID 2892 wrote to memory of 2432	2892	Unicorn-38753.exe	38
PID 2892 wrote to memory of 2432	2892	Unicorn-38753.exe	38
PID 2912 wrote to memory of 1120	2912	Unicorn-58296.exe	39
PID 2912 wrote to memory of 1120	2912	Unicorn-58296.exe	39
PID 2912 wrote to memory of 1120	2912	Unicorn-58296.exe	39
PID 2912 wrote to memory of 1120	2912	Unicorn-58296.exe	39
PID 2360 wrote to memory of 2516	2360	Unicorn-61814.exe	40
PID 2360 wrote to memory of 2516	2360	Unicorn-61814.exe	40
PID 2360 wrote to memory of 2516	2360	Unicorn-61814.exe	40
PID 2360 wrote to memory of 2516	2360	Unicorn-61814.exe	40
PID 2756 wrote to memory of 2000	2756	Unicorn-35638.exe	43
PID 2756 wrote to memory of 2000	2756	Unicorn-35638.exe	43
PID 2756 wrote to memory of 2000	2756	Unicorn-35638.exe	43
PID 2756 wrote to memory of 2000	2756	Unicorn-35638.exe	43
PID 2392 wrote to memory of 1816	2392	d7b8a44963c3a420d6a334577951f63863e50866a6468b950598242eb69b157f.exe	42
PID 2392 wrote to memory of 1816	2392	d7b8a44963c3a420d6a334577951f63863e50866a6468b950598242eb69b157f.exe	42
PID 2392 wrote to memory of 1816	2392	d7b8a44963c3a420d6a334577951f63863e50866a6468b950598242eb69b157f.exe	42
PID 2392 wrote to memory of 1816	2392	d7b8a44963c3a420d6a334577951f63863e50866a6468b950598242eb69b157f.exe	42
PID 1480 wrote to memory of 1980	1480	Unicorn-65343.exe	41
PID 1480 wrote to memory of 1980	1480	Unicorn-65343.exe	41
PID 1480 wrote to memory of 1980	1480	Unicorn-65343.exe	41
PID 1480 wrote to memory of 1980	1480	Unicorn-65343.exe	41
PID 3068 wrote to memory of 2020	3068	Unicorn-36106.exe	44
PID 3068 wrote to memory of 2020	3068	Unicorn-36106.exe	44
PID 3068 wrote to memory of 2020	3068	Unicorn-36106.exe	44
PID 3068 wrote to memory of 2020	3068	Unicorn-36106.exe	44
PID 2624 wrote to memory of 2228	2624	Unicorn-54767.exe	45
PID 2624 wrote to memory of 2228	2624	Unicorn-54767.exe	45
PID 2624 wrote to memory of 2228	2624	Unicorn-54767.exe	45
PID 2624 wrote to memory of 2228	2624	Unicorn-54767.exe	45
PID 1120 wrote to memory of 2256	1120	Unicorn-51693.exe	46
PID 1120 wrote to memory of 2256	1120	Unicorn-51693.exe	46
PID 1120 wrote to memory of 2256	1120	Unicorn-51693.exe	46
PID 1120 wrote to memory of 2256	1120	Unicorn-51693.exe	46

C:\Users\Admin\AppData\Local\Temp\d7b8a44963c3a420d6a334577951f63863e50866a6468b950598242eb69b157f.exe
"C:\Users\Admin\AppData\Local\Temp\d7b8a44963c3a420d6a334577951f63863e50866a6468b950598242eb69b157f.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2392
- C:\Users\Admin\AppData\Local\Temp\Unicorn-36106.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-36106.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3068
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-65343.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-65343.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1480
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58296.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58296.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51693.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19286.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41403.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3100.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2052.exe
        9⤵
        
        PID:2032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54754.exe
        10⤵
        
        PID:2804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33302.exe
        10⤵
        
        PID:3096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4977.exe
        10⤵
        
        PID:5528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8244.exe
        10⤵
        
        PID:6428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53337.exe
        9⤵
        
        PID:3016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46270.exe
        9⤵
        
        PID:4220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10842.exe
        9⤵
        
        PID:5304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24957.exe
        9⤵
        
        PID:7128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47724.exe
        8⤵
        
        PID:2828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10976.exe
        9⤵
        
        PID:2592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32534.exe
        9⤵
        
        PID:4236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4977.exe
        9⤵
        
        PID:5216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40560.exe
        9⤵
        
        PID:6548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53279.exe
        8⤵
        
        PID:2448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52135.exe
        8⤵
        
        PID:4284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2177.exe
        8⤵
        
        PID:5320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-92.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-92.exe
        8⤵
        
        PID:6096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2067.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51957.exe
        8⤵
        
        PID:2296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33302.exe
        8⤵
        
        PID:4064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59139.exe
        8⤵
        
        PID:5748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41629.exe
        8⤵
        
        PID:6496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13922.exe
        7⤵
        
        PID:1708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26730.exe
        7⤵
        
        PID:3512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21240.exe
        7⤵
        
        PID:2524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17157.exe
        7⤵
        
        PID:6064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5886.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54221.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44219.exe
        8⤵
        
        PID:1736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24890.exe
        9⤵
        
        PID:3996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48871.exe
        9⤵
        
        PID:4668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59139.exe
        9⤵
        
        PID:5740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41629.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:6464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5024.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17205.exe
        8⤵
        
        PID:4812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2177.exe
        8⤵
        
        PID:5452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8774.exe
        8⤵
        
        PID:6252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24078.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27569.exe
        8⤵
        
        PID:5896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11180.exe
        8⤵
        
        PID:7152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17257.exe
        7⤵
        
        PID:3560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17205.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51186.exe
        7⤵
        
        PID:5828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27223.exe
        7⤵
        
        PID:6616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65112.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2052.exe
        7⤵
        
        PID:2484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24890.exe
        8⤵
        
        PID:4004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48871.exe
        8⤵
        
        PID:4660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59139.exe
        8⤵
        
        PID:5700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40560.exe
        8⤵
        
        PID:6572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5024.exe
        7⤵
        
        PID:3632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13597.exe
        7⤵
        
        PID:3548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30412.exe
        7⤵
        
        PID:928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32963.exe
        7⤵
        
        PID:6488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21003.exe
        6⤵
        
        PID:2948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46179.exe
        7⤵
        
        PID:3524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11340.exe
        7⤵
        
        PID:4840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65004.exe
        7⤵
        
        PID:5872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31894.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7029.exe
        6⤵
        
        PID:3460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9070.exe
        6⤵
        
        PID:4740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-746.exe
        6⤵
        
        PID:4960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19357.exe
        6⤵
        
        PID:7120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31490.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56945.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46489.exe
        7⤵
        
        PID:2220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23467.exe
        8⤵
        
        PID:2352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41226.exe
        9⤵
        
        PID:3928
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2352 -s 236
        9⤵
        Program crash
        
        PID:3536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5024.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62606.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10842.exe
        8⤵
        
        PID:5536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57246.exe
        8⤵
        
        PID:3804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24353.exe
        7⤵
        
        PID:2644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48799.exe
        8⤵
        
        PID:4304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63323.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16909.exe
        8⤵
        
        PID:6580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53544.exe
        7⤵
        
        PID:3088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19462.exe
        7⤵
        
        PID:4144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2177.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42023.exe
        7⤵
        
        PID:7076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10204.exe
        6⤵
        
        PID:1920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60369.exe
        7⤵
        
        PID:2168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65399.exe
        7⤵
        
        PID:3440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4977.exe
        7⤵
        
        PID:5568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8244.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8437.exe
        6⤵
        
        PID:3020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19462.exe
        6⤵
        
        PID:3920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57491.exe
        6⤵
        
        PID:5132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42023.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53830.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18581.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54005.exe
        7⤵
        
        PID:3520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63142.exe
        7⤵
        
        PID:4764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59139.exe
        7⤵
        
        PID:5668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40560.exe
        7⤵
        
        PID:6868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5024.exe
        6⤵
        
        PID:3672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46270.exe
        6⤵
        
        PID:4276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59851.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31894.exe
        6⤵
        
        PID:6732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1787.exe
        5⤵
        
        PID:2852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24890.exe
        6⤵
        
        PID:3948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32534.exe
        6⤵
        
        PID:4268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4977.exe
        6⤵
        
        PID:5520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4792.exe
        6⤵
        
        PID:6272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15959.exe
        5⤵
        
        PID:3640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43270.exe
        5⤵
        
        PID:4752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51716.exe
        5⤵
        
        PID:5944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11963.exe
        5⤵
        
        PID:6588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51729.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51729.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:1980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49493.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18238.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23467.exe
        7⤵
        
        PID:2992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56168.exe
        8⤵
        
        PID:4964
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2992 -s 236
        8⤵
        Program crash
        
        PID:2456
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1300 -s 216
        7⤵
        Program crash
        
        PID:2952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24353.exe
        6⤵
        
        PID:2052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40054.exe
        7⤵
        
        PID:4916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44429.exe
        7⤵
        
        PID:7096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53544.exe
        6⤵
        
        PID:3080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52135.exe
        6⤵
        
        PID:4260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40003.exe
        6⤵
        
        PID:5800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49100.exe
        6⤵
        
        PID:6908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63909.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45695.exe
        6⤵
        
        PID:1764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59409.exe
        7⤵
        
        PID:1820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48871.exe
        7⤵
        
        PID:4592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59139.exe
        7⤵
        
        PID:5688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40560.exe
        7⤵
        
        PID:6780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56648.exe
        6⤵
        
        PID:2924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13597.exe
        6⤵
        
        PID:3896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-619.exe
        6⤵
        
        PID:5176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41702.exe
        6⤵
        
        PID:7004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39181.exe
        5⤵
        
        PID:1448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24890.exe
        6⤵
        
        PID:3956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48871.exe
        6⤵
        
        PID:4572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4977.exe
        6⤵
        
        PID:5424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8244.exe
        6⤵
        
        PID:6276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59144.exe
        5⤵
        
        PID:2664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59806.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51179.exe
        5⤵
        
        PID:5552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-629.exe
        5⤵
        
        PID:6900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43363.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43363.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1107.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44219.exe
        6⤵
        
        PID:2268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19742.exe
        7⤵
        
        PID:3472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48871.exe
        7⤵
        
        PID:4516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4977.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8244.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5024.exe
        6⤵
        
        PID:3680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62606.exe
        6⤵
        
        PID:4628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65004.exe
        6⤵
        
        PID:5864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31894.exe
        6⤵
        
        PID:6764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11629.exe
        5⤵
        
        PID:2816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24890.exe
        6⤵
        
        PID:4036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48871.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59139.exe
        6⤵
        
        PID:5708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40560.exe
        6⤵
        
        PID:6772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18759.exe
        5⤵
        
        PID:3732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25068.exe
        5⤵
        
        PID:4444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51179.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17157.exe
        5⤵
        
        PID:6164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-842.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-842.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2052.exe
        5⤵
        
        PID:3044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24890.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48871.exe
        6⤵
        
        PID:4636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59139.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40560.exe
        6⤵
        
        PID:6724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5024.exe
        5⤵
        
        PID:3664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13597.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-619.exe
        5⤵
        
        PID:5184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24957.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58659.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58659.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24890.exe
        5⤵
        
        PID:3972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48871.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4977.exe
        5⤵
        
        PID:5628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8244.exe
        5⤵
        
        PID:6420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64961.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64961.exe
      4⤵
      PID:3648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27664.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27664.exe
      4⤵
      PID:4100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-746.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-746.exe
      4⤵
      PID:2408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6628.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6628.exe
      4⤵
      PID:6240
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54767.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54767.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58413.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58413.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59384.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3868.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1886.exe
        7⤵
        
        PID:2880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24890.exe
        8⤵
        
        PID:3940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48871.exe
        8⤵
        
        PID:4492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42803.exe
        8⤵
        
        PID:5792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8244.exe
        8⤵
        
        PID:6412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59061.exe
        7⤵
        
        PID:3260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46270.exe
        7⤵
        
        PID:4228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10842.exe
        7⤵
        
        PID:5296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24957.exe
        7⤵
        
        PID:7136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1154.exe
        6⤵
        
        PID:2692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45953.exe
        7⤵
        
        PID:3104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48871.exe
        7⤵
        
        PID:4532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4977.exe
        7⤵
        
        PID:5344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24636.exe
        7⤵
        
        PID:7016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5806.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51948.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10870.exe
        6⤵
        
        PID:4372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61163.exe
        6⤵
        
        PID:6148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32627.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2052.exe
        6⤵
        
        PID:1688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14567.exe
        7⤵
        
        PID:2112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65399.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8585.exe
        7⤵
        
        PID:5276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48039.exe
        7⤵
        
        PID:6980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56648.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29933.exe
        6⤵
        
        PID:3876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48668.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31894.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61459.exe
        5⤵
        
        PID:2176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45761.exe
        6⤵
        
        PID:3172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48871.exe
        6⤵
        
        PID:4676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59139.exe
        6⤵
        
        PID:5676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41629.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3140.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10797.exe
        5⤵
        
        PID:3620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40955.exe
        5⤵
        
        PID:5148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17157.exe
        5⤵
        
        PID:5488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35657.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35657.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55674.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48573.exe
        6⤵
        
        PID:2468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23688.exe
        7⤵
        
        PID:5080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12093.exe
        7⤵
        
        PID:6088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34694.exe
        7⤵
        
        PID:6992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54451.exe
        6⤵
        
        PID:3880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11340.exe
        6⤵
        
        PID:4856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16701.exe
        6⤵
        
        PID:6104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57246.exe
        6⤵
        
        PID:6060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28707.exe
        5⤵
        
        PID:2180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62642.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16198.exe
        6⤵
        
        PID:4128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60291.exe
        6⤵
        
        PID:4896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41629.exe
        6⤵
        
        PID:6280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5832.exe
        5⤵
        
        PID:1952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2934.exe
        5⤵
        
        PID:4724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46163.exe
        5⤵
        
        PID:5976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15359.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53956.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53956.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47551.exe
        5⤵
        
        PID:1560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15743.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12093.exe
        6⤵
        
        PID:6080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35764.exe
        6⤵
        
        PID:6524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41446.exe
        5⤵
        
        PID:3416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5746.exe
        5⤵
        
        PID:4924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19005.exe
        5⤵
        
        PID:5584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32963.exe
        5⤵
        
        PID:6480
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61610.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61610.exe
      4⤵
      PID:1628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34777.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34777.exe
      4⤵
      PID:4084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3476.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3476.exe
      4⤵
      PID:4984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54876.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54876.exe
      4⤵
      PID:5208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5559.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5559.exe
      4⤵
      PID:6532
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-65464.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-65464.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4267.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4267.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64039.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43944.exe
        6⤵
        
        PID:1580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54063.exe
        7⤵
        
        PID:5328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1659.exe
        6⤵
        
        PID:3100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11340.exe
        6⤵
        
        PID:4864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65004.exe
        6⤵
        
        PID:5816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31894.exe
        6⤵
        
        PID:6396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11629.exe
        5⤵
        
        PID:1648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26449.exe
        6⤵
        
        PID:1528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64942.exe
        6⤵
        
        PID:5264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2899.exe
        6⤵
        
        PID:6924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32223.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49724.exe
        5⤵
        
        PID:3052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59342.exe
        5⤵
        
        PID:5200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52780.exe
        5⤵
        
        PID:5684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5190.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5190.exe
      4⤵
      PID:2856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11936.exe
        5⤵
        
        PID:3376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48871.exe
        5⤵
        
        PID:4608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53986.exe
        5⤵
        
        PID:5768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40560.exe
        5⤵
        
        PID:6804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9009.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9009.exe
      4⤵
      PID:3028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59806.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59806.exe
      4⤵
      PID:4684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37866.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37866.exe
      4⤵
      PID:5604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34171.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34171.exe
      4⤵
      PID:5836
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49228.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49228.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18238.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18238.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42875.exe
        5⤵
        
        PID:2900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26111.exe
        6⤵
        
        PID:4176
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2900 -s 236
        6⤵
        Program crash
        
        PID:2380
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2812 -s 236
        5⤵
        Program crash
        
        PID:2072
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24353.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24353.exe
      4⤵
      PID:2868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24528.exe
        5⤵
        
        PID:6140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55394.exe
        5⤵
        
        PID:6116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53544.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53544.exe
      4⤵
      PID:4092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25068.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25068.exe
      4⤵
      PID:4448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51179.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51179.exe
      4⤵
      PID:5560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32425.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32425.exe
      4⤵
      PID:6688
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9307.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9307.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38482.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38482.exe
      4⤵
      PID:2368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24890.exe
        5⤵
        
        PID:4012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48871.exe
        5⤵
        
        PID:4484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4977.exe
        5⤵
        
        PID:5352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30812.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5024.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5024.exe
      4⤵
      PID:3716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17205.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17205.exe
      4⤵
      PID:4788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2177.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2177.exe
      4⤵
      PID:5384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8774.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8774.exe
      4⤵
      PID:6248
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64498.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64498.exe
    3⤵
    PID:1588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26545.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26545.exe
      4⤵
      PID:2660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48871.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48871.exe
      4⤵
      PID:4708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59139.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59139.exe
      4⤵
      PID:5724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40560.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40560.exe
      4⤵
      PID:6884
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3920.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3920.exe
    3⤵
    PID:3296
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6133.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6133.exe
    3⤵
    PID:3496
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60948.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60948.exe
    3⤵
    PID:4956
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10828.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10828.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6232
- C:\Users\Admin\AppData\Local\Temp\Unicorn-61814.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-61814.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2360
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38753.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38753.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19021.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19021.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4267.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28102.exe
        6⤵
        Executes dropped EXE
        
        PID:2544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14567.exe
        7⤵
        
        PID:1684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48871.exe
        7⤵
        
        PID:4564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4977.exe
        7⤵
        
        PID:5576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8244.exe
        7⤵
        
        PID:6316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7119.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2934.exe
        6⤵
        
        PID:4616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40003.exe
        6⤵
        
        PID:5808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15359.exe
        6⤵
        
        PID:7080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47547.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24427.exe
        6⤵
        
        PID:848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44552.exe
        7⤵
        
        PID:2164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48871.exe
        7⤵
        
        PID:4580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4977.exe
        7⤵
        
        PID:5392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8764.exe
        7⤵
        
        PID:6796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60239.exe
        6⤵
        
        PID:3032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1061.exe
        6⤵
        
        PID:4408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21746.exe
        6⤵
        
        PID:4928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16428.exe
        6⤵
        
        PID:6300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1000.exe
        5⤵
        
        PID:1596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42369.exe
        6⤵
        
        PID:3816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29882.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2899.exe
        6⤵
        
        PID:6892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24625.exe
        5⤵
        
        PID:3792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10797.exe
        5⤵
        
        PID:3628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51179.exe
        5⤵
        
        PID:5280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17157.exe
        5⤵
        
        PID:6172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29627.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29627.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56992.exe
        5⤵
        
        PID:1072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26545.exe
        6⤵
        
        PID:1876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48871.exe
        6⤵
        
        PID:4524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4977.exe
        6⤵
        
        PID:5432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40560.exe
        6⤵
        
        PID:6564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3144.exe
        5⤵
        
        PID:2100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19462.exe
        5⤵
        
        PID:4152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21746.exe
        5⤵
        
        PID:4480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16620.exe
        5⤵
        
        PID:4904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60130.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60130.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4740.exe
        5⤵
        
        PID:2128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24890.exe
        6⤵
        
        PID:4068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48871.exe
        6⤵
        
        PID:4732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59139.exe
        6⤵
        
        PID:5640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40560.exe
        6⤵
        
        PID:6740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5024.exe
        5⤵
        
        PID:3740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17205.exe
        5⤵
        
        PID:4824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2177.exe
        5⤵
        
        PID:5648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8774.exe
        5⤵
        
        PID:6516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53593.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53593.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24890.exe
        5⤵
        
        PID:3988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48871.exe
        5⤵
        
        PID:4500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4977.exe
        5⤵
        
        PID:5544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8764.exe
        5⤵
        
        PID:6788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15959.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15959.exe
      4⤵
      PID:3708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43270.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43270.exe
      4⤵
      PID:4456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2707.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2707.exe
      4⤵
      PID:5364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44635.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44635.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6820
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51729.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51729.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50780.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50780.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18238.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5233.exe
        6⤵
        
        PID:2576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54754.exe
        7⤵
        
        PID:1924
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2576 -s 236
        7⤵
        Program crash
        
        PID:3872
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1752 -s 236
        6⤵
        Program crash
        
        PID:2764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53570.exe
        5⤵
        
        PID:592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24890.exe
        6⤵
        
        PID:4020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48871.exe
        6⤵
        
        PID:4644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59139.exe
        6⤵
        
        PID:5732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40560.exe
        6⤵
        
        PID:6708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18759.exe
        5⤵
        
        PID:3724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19462.exe
        5⤵
        
        PID:4168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57491.exe
        5⤵
        
        PID:5124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16428.exe
        5⤵
        
        PID:6288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63909.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63909.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64304.exe
        5⤵
        
        PID:1612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12704.exe
        6⤵
        
        PID:3200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48871.exe
        6⤵
        
        PID:4692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53986.exe
        6⤵
        
        PID:5772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41629.exe
        6⤵
        
        PID:6448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58921.exe
        5⤵
        
        PID:2672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46270.exe
        5⤵
        
        PID:4204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10842.exe
        5⤵
        
        PID:5228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16627.exe
        5⤵
        
        PID:6208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24707.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24707.exe
      4⤵
      PID:2184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24890.exe
        5⤵
        
        PID:4028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48871.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59139.exe
        5⤵
        
        PID:5596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40560.exe
        5⤵
        
        PID:6696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60322.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60322.exe
      4⤵
      PID:1592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27133.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27133.exe
      4⤵
      PID:3488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40955.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40955.exe
      4⤵
      PID:5140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17157.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17157.exe
      4⤵
      PID:6180
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28121.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28121.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17252.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17252.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34751.exe
        5⤵
        
        PID:1928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21397.exe
        6⤵
        
        PID:768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25948.exe
        6⤵
        
        PID:4376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10842.exe
        6⤵
        
        PID:5608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-99.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-99.exe
        6⤵
        
        PID:6836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34011.exe
        5⤵
        
        PID:2732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47038.exe
        5⤵
        
        PID:3112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65004.exe
        5⤵
        
        PID:5856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31894.exe
        5⤵
        
        PID:6860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31714.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31714.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4484.exe
        5⤵
        
        PID:2016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25948.exe
        5⤵
        
        PID:4340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30412.exe
        5⤵
        
        PID:1488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33155.exe
        5⤵
        
        PID:5468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34207.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34207.exe
      4⤵
      PID:1940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19462.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19462.exe
      4⤵
      PID:4160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2177.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2177.exe
      4⤵
      PID:5244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42023.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42023.exe
      4⤵
      PID:7104
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53380.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53380.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2052.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2052.exe
      4⤵
      PID:2024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12629.exe
        5⤵
        
        PID:3480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11340.exe
        5⤵
        
        PID:4884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48668.exe
        5⤵
        
        PID:5716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32963.exe
        5⤵
        
        PID:6456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5024.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5024.exe
      4⤵
      PID:3748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17205.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17205.exe
      4⤵
      PID:4796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2177.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2177.exe
      4⤵
      PID:5512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8774.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8774.exe
      4⤵
      PID:6540
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12338.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12338.exe
    3⤵
    PID:2984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44993.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44993.exe
      4⤵
      PID:3332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48871.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48871.exe
      4⤵
      PID:4556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4977.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4977.exe
      4⤵
      PID:5400
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8764.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8764.exe
      4⤵
      PID:6844
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64961.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64961.exe
    3⤵
    PID:3756
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44000.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44000.exe
    3⤵
    PID:4248
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46713.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46713.exe
    3⤵
    PID:5256
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55828.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55828.exe
    3⤵
    PID:6188
- C:\Users\Admin\AppData\Local\Temp\Unicorn-35638.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-35638.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2756
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6057.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6057.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49903.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49903.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18238.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28479.exe
        6⤵
        
        PID:2684
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1532 -s 236
        6⤵
        Program crash
        
        PID:3552
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1620 -s 236
        5⤵
        Program crash
        
        PID:2676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63909.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63909.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48573.exe
        5⤵
        
        PID:900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38633.exe
        6⤵
        
        PID:5004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2612.exe
        6⤵
        
        PID:6132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2899.exe
        6⤵
        
        PID:6916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54451.exe
        5⤵
        
        PID:3904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11340.exe
        5⤵
        
        PID:4872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65004.exe
        5⤵
        
        PID:5888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32963.exe
        5⤵
        
        PID:6432
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2000 -s 240
      4⤵
      Program crash
      PID:2436
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30914.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30914.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18238.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18238.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28207.exe
        5⤵
        
        PID:1484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39020.exe
        6⤵
        
        PID:808
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1484 -s 236
        6⤵
        Program crash
        
        PID:3424
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2156 -s 236
        5⤵
        Program crash
        
        PID:1576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47558.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47558.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24890.exe
        5⤵
        
        PID:4044
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1712 -s 216
        5⤵
        Program crash
        
        PID:3504
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1336 -s 240
      4⤵
      Program crash
      PID:1672
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2756 -s 240
    3⤵
    - Loads dropped DLL
    - Program crash
    PID:2884
- C:\Users\Admin\AppData\Local\Temp\Unicorn-5792.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-5792.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:1816
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49493.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49493.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14838.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14838.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39165.exe
        5⤵
        
        PID:2356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42782.exe
        6⤵
        
        PID:4900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-568.exe
        6⤵
        
        PID:6948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2235.exe
        5⤵
        
        PID:3812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11340.exe
        5⤵
        
        PID:3800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10842.exe
        5⤵
        
        PID:5408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-99.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-99.exe
        5⤵
        
        PID:6828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53700.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53700.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49119.exe
        5⤵
        
        PID:6596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52903.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52903.exe
      4⤵
      PID:4080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51186.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51186.exe
      4⤵
      PID:5844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16428.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16428.exe
      4⤵
      PID:6472
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46779.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46779.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47942.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47942.exe
      4⤵
      PID:1644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55182.exe
        5⤵
        
        PID:4056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11611.exe
        5⤵
        
        PID:4440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10340.exe
        5⤵
        
        PID:5460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41748.exe
        5⤵
        
        PID:6360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26087.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26087.exe
      4⤵
      PID:1556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46270.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46270.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10842.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10842.exe
      4⤵
      PID:5288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24957.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24957.exe
      4⤵
      PID:7112
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57956.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57956.exe
    3⤵
    PID:1124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3405.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3405.exe
      4⤵
      PID:3444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29488.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29488.exe
      4⤵
      PID:4844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4977.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4977.exe
      4⤵
      PID:5376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8244.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8244.exe
      4⤵
      PID:6268
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62024.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62024.exe
    3⤵
    PID:3116
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59806.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59806.exe
    3⤵
    PID:4700
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34650.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34650.exe
    3⤵
    PID:5932
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33494.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33494.exe
    3⤵
    PID:6556
- C:\Users\Admin\AppData\Local\Temp\Unicorn-40563.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-40563.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3040
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33204.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33204.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48573.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48573.exe
      4⤵
      PID:1760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24890.exe
        5⤵
        
        PID:3964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48871.exe
        5⤵
        
        PID:4540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4977.exe
        5⤵
        
        PID:5588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8764.exe
        5⤵
        
        PID:6852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56721.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56721.exe
      4⤵
      PID:3836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62606.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62606.exe
      4⤵
      PID:4600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65004.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65004.exe
      4⤵
      PID:5880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32963.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32963.exe
      4⤵
      PID:6440
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42215.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42215.exe
    3⤵
    PID:2932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35623.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35623.exe
      4⤵
      PID:6644
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61047.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61047.exe
    3⤵
    PID:3924
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2946.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2946.exe
    3⤵
    PID:4940
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59342.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59342.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5440
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32425.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32425.exe
    3⤵
    PID:6876
- C:\Users\Admin\AppData\Local\Temp\Unicorn-63675.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-63675.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1756
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41744.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41744.exe
    3⤵
    PID:2540
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47038.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47038.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3912
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-619.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-619.exe
    3⤵
    PID:5168
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32963.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32963.exe
    3⤵
    PID:6260
- C:\Users\Admin\AppData\Local\Temp\Unicorn-6997.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-6997.exe
  2⤵
  PID:2144
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45761.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45761.exe
    3⤵
    PID:3164
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48871.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48871.exe
    3⤵
    PID:4508
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4977.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4977.exe
    3⤵
    PID:5416
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8764.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8764.exe
    3⤵
    PID:6812
- C:\Users\Admin\AppData\Local\Temp\Unicorn-39011.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-39011.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3452
- C:\Users\Admin\AppData\Local\Temp\Unicorn-49998.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-49998.exe
  2⤵
  PID:3588
- C:\Users\Admin\AppData\Local\Temp\Unicorn-45578.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-45578.exe
  2⤵
  PID:5332
- C:\Users\Admin\AppData\Local\Temp\Unicorn-32293.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-32293.exe
  2⤵
  PID:6156

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-35638.exe

Filesize
468KB

MD5
7ddf7013fb705dfce20538166a090a4f

SHA1
f08f2006d980828d77abbac8e779cb8f80a033a5

SHA256
9aa78534fe1ee6f2bd18b7024b941c51f8d6910c73deece5013bb4bf8cf45128

SHA512
7b47ff53513cfb30cf7bfe685ef4474d6e03f5a5a35dcc483134eae2ed59bdcb8b0b3250073e620b6514a2a12e945b22f255232662e73c2fe4d7d119072df364

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-38753.exe

Filesize
468KB

MD5
e0344caf24ceaa003b578cee510a55fe

SHA1
aa56fbab8585cb7f277cc303e03f8618bc191849

SHA256
2acf2ac4ee5e60d785139f4a7575a2a27f81cd0bd51ad7bb7c90fe77c4391f71

SHA512
5ecc1ac4874bdf9e4b2c8852c381be1402e529ae9986839415f9f424a75b4c40462ce6d116573934f14d6dd1c1685e6e8cb19bf40c0d6b4fa375dbcc0475acde

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-3920.exe

Filesize
468KB

MD5
221a9aad6af49bb763d4393193ac7aa9

SHA1
1eb7d2cffcd9567bd4bb574a03ead2fcfedf5009

SHA256
f556df05f4c33a2076761064e18d043778c9671ce3d127ad7e1f39869bbc8269

SHA512
a94d44648583f8fcd050969272aa6688c9ec0aad8dbc32f8bf9576552ce321b98493f6ec5573cbc4acd0779e7f0749b5f31bf6dc05f2c616766c78f756ae9d57

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-51693.exe

Filesize
468KB

MD5
73313c275417e94df51f3abfd65c8b91

SHA1
a7e81c8debaf082d4c43f2c431410cbccc64bd35

SHA256
fa570f3b16e0b2e89725eab3e38b53f9bbcba9f3066fede5d67df1c9e15596c2

SHA512
8c82ccacd9ec60e6ac80544c61e4f5bd36d09a4bf851a6d1cc68aa929c86cabe9658ea09b150a3cecba436e8dfc14483317842b4e56f270b31d9b599e393422e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-54767.exe

Filesize
468KB

MD5
e7da13e732578f7512e1e30a8f164607

SHA1
8dbbab556d2b0074b0f56e4ee7dd42a7b11de594

SHA256
61f46ecbda991faaae3ddcc4c362321c2391582d6b369d3b1b28a0c17ba28228

SHA512
a5b4140e81e45fe13ef86df5315e7ebc5620a8fe284bb1408a74b33b71f5b8271c5528b246dcda2ca22eab919a582897780816dbdbc0d58d43cdd3e30af0ff3e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5792.exe

Filesize
468KB

MD5
6cb1ec0dc4ea45091e6ff7c8274bd714

SHA1
7e60ccc0660ec828bd16abd1826bec8e90a08128

SHA256
db5a6fac3bbde5e119a7bc382b46197fd1c9b6c8c2f5fee4e9b9cf63ca03d464

SHA512
f7b85d48bdd5f3b8b1296ff9d479fc264347dfc4940db742b0094ef1b43aade66378dc7e39c2096da1f6d9431e7d414848fe88fe3c1d4812370e713e42348e74

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-6057.exe

Filesize
468KB

MD5
81b1722ffb778b07588bf4afeb236c53

SHA1
38fad73848d5f350e06b7ae62ef87d3d7e998400

SHA256
2a98ad53e45b7d22b8c4605bdae40a19d78547d8f28504fcebd5f01051056a05

SHA512
e7ae27dd20f3a4977719e419cafab47e2ae6db0fc48d45b8c9dd84df3598746ed7095b12cf5ec7e81256efcbd52e94cd1814706c0f89cc751d3bb1aa5eae8b63

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-19021.exe

Filesize
468KB

MD5
08ec951ced9557e2c7f69b21ea0b652e

SHA1
9da29d78ff5c486cb20f4a36fd5b1f4d8b4375cb

SHA256
851481a4a66944a244c73a73dff3e2d1f0f8538b301f07ee881f0b8ab67b365e

SHA512
64b08fe35c07ed477c2f22971df074c8b8e5848485eb7e479c5868b8be222e69e2c188044f2c0f304fbf70cab52e0336a15ffa51af1f50cbe5e43c155dcad132

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-19286.exe

Filesize
468KB

MD5
da1e1ac1a4b289b12e9e33d497b3d253

SHA1
d9ec901c1ee451d5f2d7cb03fc20432684481dcc

SHA256
f1076356681cb4f6e6c1c8114092b03f15470194791fab882bbbd393b2d064f8

SHA512
33b38a3094f802e41067f18b71b8e4c02aa9e32c6973a93113e9cfda1b641c7136078d5bfb8e9214c86b933e425c0bd704efd5a76f5b637ce7c8f234a0498e50

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-31490.exe

Filesize
468KB

MD5
b4a220234adacef5140a335aa9656772

SHA1
a39673df55a8bd68f89fa7910496190a03b114db

SHA256
bdb87a411753dba3ecb6c79c792d66d961e7c07dc78e8f3f0916ba3c90fbdfc9

SHA512
2f540eab1598e5c81115fdfa78228fd83f6e33d0ec8a5e36f3f5e9e15b768fe28fd5c9f53b205c77f1ddbac5c245fbf0dcc70bf41b70fba0148a4a1dd3b94e3d

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-36106.exe

Filesize
468KB

MD5
9a9a50d539908ba0554b85aeb12087f0

SHA1
f96b6b6e9b93d9252edb58955b1ae18acb749e97

SHA256
4d1af56f9fcda0d3f276f0a6aa0dd0dab52b21c6b13f5b4a5bf9266263af9ddc

SHA512
3fc7202095701e25ad65f5cb0bd4ccab0130fcf0290ea9cd71f33182700a47b7cca960846267c7a98ae71aa63a887424ea39bd3b8326ca17ff3ae9aea51ecfbe

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-49903.exe

Filesize
468KB

MD5
7e2000c3efc153a03297a9a8aa217ada

SHA1
c57dfd0cd01589b1d755838d19b15b3cdb03c932

SHA256
e7df01a439bf40841cf7c8433e17c4a2172ca23c20d79d06726aec291696ebf0

SHA512
3518ee41ea0d278eb041cadec4af583bcb3c6f467c1d6149f86facf3eca6019cc9bebd72657ec37963e70680afec676d78c85ffcf5512c669744c022637633ac

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-51729.exe

Filesize
468KB

MD5
be8858f51a7c1fae2dce0d516f2c0f46

SHA1
63e12f1137c849139ea41cf0a9fd84e97de16595

SHA256
4f045d763fd319a5ecfd814376d44cb3e125fc7b420c3d55dd77cf09c1c86010

SHA512
3c941b296d50c4a68a840a16b95f9c495e390b80d32d26e4cf83db030194a26d149f9ecc22e8c6114afcc3bbfbe18a26e5ebe0559eed61deb3926fdebda9d34b

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-58296.exe

Filesize
468KB

MD5
6111ef06e9dc83e0ec38952169f50255

SHA1
c9d8e6d11a20dcb8333109d9d5a1191680b5ddcb

SHA256
51f11e10cc0257b3d18caa446637f5771be54c1feb65ab9a81fa331148dcca82

SHA512
3da0d1a3e982880076641ae95aefd2aa5efa3c918753dc45774f54fcd8828b28494b712b3151e1f15fcafa2075b369d24c160374344107cdc36893bb066ded87

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-58413.exe

Filesize
468KB

MD5
78bb40d68c97f84feb103a0bc900d3bf

SHA1
323ca931a178e82353f3923778f201db83beec0e

SHA256
fa3c1085fb25f2f917d87ec70960a69ca1f68887e4e3a1daaeef23122cc6bd62

SHA512
de666e8bac03fe1e4be2289241ae83007e47e2d18aacbccfea4f2a4425b725f25773d97dfacc9f9432a73b7f4f7a3f48aa68fa80f91233093d993d35178780a7

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-61814.exe

Filesize
468KB

MD5
606b1262d1fc415c1b1efbe8147ac9f7

SHA1
c4c0b995370060cb7fa1b8a12f1c81555b5826ba

SHA256
a421cefa6ca4dfecee20d854211314f8bc7521cbfd9637c0c354e9d86364b233

SHA512
db15f47d403d2ffc3716586c7f54abaa257774f1d4ad3dc897960a733a5edbb995003b700648dba7ab3d3ad6c9e6efab81fab3f4cd0043bf02e22ea6a5358a1f

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-65343.exe

Filesize
468KB

MD5
aeb3cb5a1f94c43e74289787bae25ca4

SHA1
d1012205c07af4666cd752a031b183313c84d8b2

SHA256
715e107bbd7944df2381b435751c90820df4199b96d75ffdecaa27baeee953c3

SHA512
524afbff0ccd00c6c9fd5f0d9dcdded30c7dac9a86cc4ec1dc619f854ed498a85741e35764b879fa6fac3966ea81acdf6e1d2de2f7cc7f56f9b4b7aa2911bd85

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-65464.exe

Filesize
468KB

MD5
d84fddbb853e1aa1b635ee88b6598e99

SHA1
a032e902f27529509d101d02503cd9a8464bc74c

SHA256
aa9a194458c53810ec70a5ecda5c8c09162b69e4a9f98770694f10e11dee826f

SHA512
266005136d62d470d90f5e59b0174d8c006333e8043bcb9b529847c91bf0c4dfbfa0ec97f65201c813a737d502c3e0e826e573e3043d37d5529b8d52ea213064

Download Submit
memory/344-250-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/596-280-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1120-110-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1120-348-0x0000000001E10000-0x0000000001E85000-memory.dmp

Filesize
468KB

Download
memory/1120-185-0x0000000001E10000-0x0000000001E85000-memory.dmp

Filesize
468KB

Download
memory/1120-190-0x0000000001E10000-0x0000000001E85000-memory.dmp

Filesize
468KB

Download
memory/1120-347-0x0000000001E10000-0x0000000001E85000-memory.dmp

Filesize
468KB

Download
memory/1336-240-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1408-380-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1480-279-0x0000000000350000-0x00000000003C5000-memory.dmp

Filesize
468KB

Download
memory/1480-147-0x0000000000350000-0x00000000003C5000-memory.dmp

Filesize
468KB

Download
memory/1480-32-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1480-305-0x0000000000350000-0x00000000003C5000-memory.dmp

Filesize
468KB

Download
memory/1480-47-0x0000000000350000-0x00000000003C5000-memory.dmp

Filesize
468KB

Download
memory/1508-306-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1544-245-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1620-219-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1620-394-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/1620-383-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/1692-242-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1816-302-0x0000000002630000-0x00000000026A5000-memory.dmp

Filesize
468KB

Download
memory/1816-150-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1816-277-0x0000000002630000-0x00000000026A5000-memory.dmp

Filesize
468KB

Download
memory/1980-375-0x0000000002490000-0x0000000002505000-memory.dmp

Filesize
468KB

Download
memory/1980-379-0x0000000002490000-0x0000000002505000-memory.dmp

Filesize
468KB

Download
memory/1980-301-0x0000000002490000-0x0000000002505000-memory.dmp

Filesize
468KB

Download
memory/1980-148-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2000-377-0x0000000002910000-0x0000000002985000-memory.dmp

Filesize
468KB

Download
memory/2000-374-0x0000000002910000-0x0000000002985000-memory.dmp

Filesize
468KB

Download
memory/2000-146-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2000-218-0x0000000002910000-0x0000000002985000-memory.dmp

Filesize
468KB

Download
memory/2020-249-0x0000000001EA0000-0x0000000001F15000-memory.dmp

Filesize
468KB

Download
memory/2020-164-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2020-248-0x0000000001EA0000-0x0000000001F15000-memory.dmp

Filesize
468KB

Download
memory/2228-317-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2228-319-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2236-349-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2256-340-0x0000000001CC0000-0x0000000001D35000-memory.dmp

Filesize
468KB

Download
memory/2256-192-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2256-332-0x0000000001CC0000-0x0000000001D35000-memory.dmp

Filesize
468KB

Download
memory/2300-278-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2360-72-0x00000000020B0000-0x0000000002125000-memory.dmp

Filesize
468KB

Download
memory/2360-243-0x0000000001EB0000-0x0000000001F25000-memory.dmp

Filesize
468KB

Download
memory/2360-244-0x0000000001EB0000-0x0000000001F25000-memory.dmp

Filesize
468KB

Download
memory/2360-126-0x0000000001EB0000-0x0000000001F25000-memory.dmp

Filesize
468KB

Download
memory/2360-34-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2392-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2392-138-0x0000000002860000-0x00000000028D5000-memory.dmp

Filesize
468KB

Download
memory/2392-299-0x0000000002860000-0x00000000028D5000-memory.dmp

Filesize
468KB

Download
memory/2392-304-0x0000000002860000-0x00000000028D5000-memory.dmp

Filesize
468KB

Download
memory/2392-10-0x0000000003390000-0x0000000003405000-memory.dmp

Filesize
468KB

Download
memory/2392-127-0x0000000002860000-0x00000000028D5000-memory.dmp

Filesize
468KB

Download
memory/2432-267-0x0000000001CD0000-0x0000000001D45000-memory.dmp

Filesize
468KB

Download
memory/2432-247-0x0000000001CD0000-0x0000000001D45000-memory.dmp

Filesize
468KB

Download
memory/2432-109-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2516-373-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2516-137-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2516-241-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2516-233-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2516-376-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2564-303-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2564-381-0x00000000026D0000-0x0000000002745000-memory.dmp

Filesize
468KB

Download
memory/2624-75-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2624-172-0x0000000002310000-0x0000000002385000-memory.dmp

Filesize
468KB

Download
memory/2624-328-0x0000000002310000-0x0000000002385000-memory.dmp

Filesize
468KB

Download
memory/2624-327-0x0000000002310000-0x0000000002385000-memory.dmp

Filesize
468KB

Download
memory/2624-177-0x0000000002310000-0x0000000002385000-memory.dmp

Filesize
468KB

Download
memory/2696-369-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2736-342-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2748-321-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2756-222-0x0000000001E20000-0x0000000001E95000-memory.dmp

Filesize
468KB

Download
memory/2756-84-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2756-237-0x0000000001E20000-0x0000000001E95000-memory.dmp

Filesize
468KB

Download
memory/2756-128-0x0000000001E20000-0x0000000001E95000-memory.dmp

Filesize
468KB

Download
memory/2756-139-0x0000000001E20000-0x0000000001E95000-memory.dmp

Filesize
468KB

Download
memory/2812-393-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2876-329-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2892-74-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2892-96-0x0000000002620000-0x0000000002695000-memory.dmp

Filesize
468KB

Download
memory/2892-298-0x0000000002620000-0x0000000002695000-memory.dmp

Filesize
468KB

Download
memory/2892-271-0x0000000002620000-0x0000000002695000-memory.dmp

Filesize
468KB

Download
memory/2912-202-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2912-363-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2912-203-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2912-367-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/3000-368-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3024-362-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/3024-365-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/3024-205-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3040-300-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3068-272-0x0000000001C40000-0x0000000001CB5000-memory.dmp

Filesize
468KB

Download
memory/3068-395-0x0000000001C40000-0x0000000001CB5000-memory.dmp

Filesize
468KB

Download
memory/3068-149-0x0000000001C40000-0x0000000001CB5000-memory.dmp

Filesize
468KB

Download
memory/3068-382-0x0000000001C40000-0x0000000001CB5000-memory.dmp

Filesize
468KB

Download
memory/3068-270-0x0000000001C40000-0x0000000001CB5000-memory.dmp

Filesize
468KB

Download
memory/3068-12-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download