1a129a864a7debe1e0f0c2c9ffaf010f2909e0976e102c55dec0c5991f0092af

Analysis

max time kernel
150s
max time network
123s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
02/09/2024, 19:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1a129a864a7debe1e0f0c2c9ffaf010f2909e0976e102c55dec0c5991f0092af.exe
Size

468KB
MD5

2997f7179ef1e04eac58a59b719f4eb8
SHA1

efb06c74981cae257fb507e30b26cdf91d3a6b3a
SHA256

1a129a864a7debe1e0f0c2c9ffaf010f2909e0976e102c55dec0c5991f0092af
SHA512

8715d17220a73ce0201a6cfdc1d73dbaab4e494d68f4cf1c6bd61798766acf810b07690474198466a4b3b9e929306db7b340f8ea6cf1871db15c75fba1b95d61
SSDEEP

3072:WMvCo7L+jy8UEbY2PzGjYf6iCh2WIpPZmHevVW2/CSFx+fNYBlW:WM6oiLUENPSjYf40br/CO8fNY

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
1696	Unicorn-14930.exe
2152	Unicorn-7400.exe
2468	Unicorn-45740.exe
3004	Unicorn-43685.exe
1748	Unicorn-4790.exe
2668	Unicorn-11680.exe
2648	Unicorn-63482.exe
1960	Unicorn-61941.exe
2592	Unicorn-43467.exe
3016	Unicorn-23601.exe
2504	Unicorn-6253.exe
1336	Unicorn-296.exe
1680	Unicorn-35661.exe
1092	Unicorn-49397.exe
2852	Unicorn-49736.exe
2360	Unicorn-54375.exe
1040	Unicorn-49544.exe
2788	Unicorn-7696.exe
1616	Unicorn-9087.exe
1768	Unicorn-45936.exe
1532	Unicorn-47982.exe
1752	Unicorn-17155.exe
2484	Unicorn-23286.exe
2612	Unicorn-23286.exe
2956	Unicorn-14355.exe
1420	Unicorn-23021.exe
1508	Unicorn-62180.exe
1428	Unicorn-46975.exe
2332	Unicorn-31345.exe
1660	Unicorn-5257.exe
1208	Unicorn-55849.exe
2656	Unicorn-47581.exe
2708	Unicorn-426.exe
2552	Unicorn-59118.exe
2556	Unicorn-62455.exe
1484	Unicorn-38889.exe
2688	Unicorn-38143.exe
1968	Unicorn-25075.exe
1628	Unicorn-44941.exe
2064	Unicorn-12168.exe
808	Unicorn-49025.exe
1160	Unicorn-26467.exe
1788	Unicorn-53664.exe
2848	Unicorn-1770.exe
2984	Unicorn-61177.exe
1280	Unicorn-54094.exe
776	Unicorn-26275.exe
288	Unicorn-26275.exe
2116	Unicorn-24448.exe
268	Unicorn-47826.exe
540	Unicorn-2154.exe
1540	Unicorn-23129.exe
2432	Unicorn-33758.exe
2456	Unicorn-23955.exe
1604	Unicorn-24220.exe
2448	Unicorn-28203.exe
1076	Unicorn-41740.exe
2836	Unicorn-50670.exe
2720	Unicorn-56700.exe
2544	Unicorn-50570.exe
2420	Unicorn-43632.exe
1112	Unicorn-63498.exe
2240	Unicorn-63882.exe
1476	Unicorn-63617.exe

Loads dropped DLL 64 IoCs

pid	Process
2224	1a129a864a7debe1e0f0c2c9ffaf010f2909e0976e102c55dec0c5991f0092af.exe
2224	1a129a864a7debe1e0f0c2c9ffaf010f2909e0976e102c55dec0c5991f0092af.exe
2224	1a129a864a7debe1e0f0c2c9ffaf010f2909e0976e102c55dec0c5991f0092af.exe
1696	Unicorn-14930.exe
2224	1a129a864a7debe1e0f0c2c9ffaf010f2909e0976e102c55dec0c5991f0092af.exe
1696	Unicorn-14930.exe
2152	Unicorn-7400.exe
2468	Unicorn-45740.exe
2152	Unicorn-7400.exe
2468	Unicorn-45740.exe
2224	1a129a864a7debe1e0f0c2c9ffaf010f2909e0976e102c55dec0c5991f0092af.exe
1696	Unicorn-14930.exe
2224	1a129a864a7debe1e0f0c2c9ffaf010f2909e0976e102c55dec0c5991f0092af.exe
1696	Unicorn-14930.exe
3004	Unicorn-43685.exe
3004	Unicorn-43685.exe
2668	Unicorn-11680.exe
2152	Unicorn-7400.exe
2668	Unicorn-11680.exe
2152	Unicorn-7400.exe
2224	1a129a864a7debe1e0f0c2c9ffaf010f2909e0976e102c55dec0c5991f0092af.exe
2224	1a129a864a7debe1e0f0c2c9ffaf010f2909e0976e102c55dec0c5991f0092af.exe
1748	Unicorn-4790.exe
1748	Unicorn-4790.exe
2468	Unicorn-45740.exe
2468	Unicorn-45740.exe
1696	Unicorn-14930.exe
1696	Unicorn-14930.exe
1960	Unicorn-61941.exe
1960	Unicorn-61941.exe
3004	Unicorn-43685.exe
3004	Unicorn-43685.exe
2592	Unicorn-43467.exe
2592	Unicorn-43467.exe
2668	Unicorn-11680.exe
2668	Unicorn-11680.exe
3016	Unicorn-23601.exe
3016	Unicorn-23601.exe
2152	Unicorn-7400.exe
2152	Unicorn-7400.exe
1092	Unicorn-49397.exe
1092	Unicorn-49397.exe
2468	Unicorn-45740.exe
1680	Unicorn-35661.exe
2504	Unicorn-6253.exe
1696	Unicorn-14930.exe
2224	1a129a864a7debe1e0f0c2c9ffaf010f2909e0976e102c55dec0c5991f0092af.exe
2468	Unicorn-45740.exe
1680	Unicorn-35661.exe
2504	Unicorn-6253.exe
1696	Unicorn-14930.exe
2224	1a129a864a7debe1e0f0c2c9ffaf010f2909e0976e102c55dec0c5991f0092af.exe
1336	Unicorn-296.exe
1336	Unicorn-296.exe
1748	Unicorn-4790.exe
1748	Unicorn-4790.exe
2852	Unicorn-49736.exe
2852	Unicorn-49736.exe
1960	Unicorn-61941.exe
1960	Unicorn-61941.exe
2360	Unicorn-54375.exe
2360	Unicorn-54375.exe
3004	Unicorn-43685.exe
3004	Unicorn-43685.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
940	2692	WerFault.exe	148
1380	2068	WerFault.exe	149

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55189.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40799.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3130.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38495.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49397.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1691.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46596.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50570.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62678.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11247.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17226.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12011.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1904.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21202.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63498.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27291.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17888.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2704.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49025.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28203.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21354.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41329.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53493.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51724.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30951.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56173.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12299.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24220.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39278.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58225.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38495.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27344.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40679.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58407.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32544.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17888.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32630.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31959.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-296.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23037.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11151.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38889.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17888.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39515.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4936.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23019.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47581.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1691.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19111.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14355.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9963.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23641.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25438.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26069.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63081.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25075.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44941.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34246.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13186.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15088.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50970.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14930.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24448.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18847.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2224	1a129a864a7debe1e0f0c2c9ffaf010f2909e0976e102c55dec0c5991f0092af.exe
1696	Unicorn-14930.exe
2152	Unicorn-7400.exe
2468	Unicorn-45740.exe
3004	Unicorn-43685.exe
2668	Unicorn-11680.exe
2648	Unicorn-63482.exe
1748	Unicorn-4790.exe
1960	Unicorn-61941.exe
2592	Unicorn-43467.exe
3016	Unicorn-23601.exe
2504	Unicorn-6253.exe
1680	Unicorn-35661.exe
1336	Unicorn-296.exe
1092	Unicorn-49397.exe
2852	Unicorn-49736.exe
2360	Unicorn-54375.exe
1040	Unicorn-49544.exe
2788	Unicorn-7696.exe
1616	Unicorn-9087.exe
1768	Unicorn-45936.exe
2484	Unicorn-23286.exe
1752	Unicorn-17155.exe
2612	Unicorn-23286.exe
1532	Unicorn-47982.exe
2956	Unicorn-14355.exe
1508	Unicorn-62180.exe
1420	Unicorn-23021.exe
1428	Unicorn-46975.exe
2332	Unicorn-31345.exe
1660	Unicorn-5257.exe
2656	Unicorn-47581.exe
2552	Unicorn-59118.exe
1208	Unicorn-55849.exe
2708	Unicorn-426.exe
2556	Unicorn-62455.exe
1484	Unicorn-38889.exe
2688	Unicorn-38143.exe
1968	Unicorn-25075.exe
1628	Unicorn-44941.exe
2064	Unicorn-12168.exe
1160	Unicorn-26467.exe
1788	Unicorn-53664.exe
2848	Unicorn-1770.exe
776	Unicorn-26275.exe
2984	Unicorn-61177.exe
808	Unicorn-49025.exe
1280	Unicorn-54094.exe
288	Unicorn-26275.exe
2116	Unicorn-24448.exe
268	Unicorn-47826.exe
540	Unicorn-2154.exe
1540	Unicorn-23129.exe
2432	Unicorn-33758.exe
2456	Unicorn-23955.exe
1604	Unicorn-24220.exe
2420	Unicorn-43632.exe
2544	Unicorn-50570.exe
2448	Unicorn-28203.exe
2836	Unicorn-50670.exe
2720	Unicorn-56700.exe
1076	Unicorn-41740.exe
1112	Unicorn-63498.exe
2240	Unicorn-63882.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2224 wrote to memory of 1696	2224	1a129a864a7debe1e0f0c2c9ffaf010f2909e0976e102c55dec0c5991f0092af.exe	30
PID 2224 wrote to memory of 1696	2224	1a129a864a7debe1e0f0c2c9ffaf010f2909e0976e102c55dec0c5991f0092af.exe	30
PID 2224 wrote to memory of 1696	2224	1a129a864a7debe1e0f0c2c9ffaf010f2909e0976e102c55dec0c5991f0092af.exe	30
PID 2224 wrote to memory of 1696	2224	1a129a864a7debe1e0f0c2c9ffaf010f2909e0976e102c55dec0c5991f0092af.exe	30
PID 2224 wrote to memory of 2152	2224	1a129a864a7debe1e0f0c2c9ffaf010f2909e0976e102c55dec0c5991f0092af.exe	32
PID 2224 wrote to memory of 2152	2224	1a129a864a7debe1e0f0c2c9ffaf010f2909e0976e102c55dec0c5991f0092af.exe	32
PID 2224 wrote to memory of 2152	2224	1a129a864a7debe1e0f0c2c9ffaf010f2909e0976e102c55dec0c5991f0092af.exe	32
PID 2224 wrote to memory of 2152	2224	1a129a864a7debe1e0f0c2c9ffaf010f2909e0976e102c55dec0c5991f0092af.exe	32
PID 1696 wrote to memory of 2468	1696	Unicorn-14930.exe	31
PID 1696 wrote to memory of 2468	1696	Unicorn-14930.exe	31
PID 1696 wrote to memory of 2468	1696	Unicorn-14930.exe	31
PID 1696 wrote to memory of 2468	1696	Unicorn-14930.exe	31
PID 2152 wrote to memory of 3004	2152	Unicorn-7400.exe	33
PID 2152 wrote to memory of 3004	2152	Unicorn-7400.exe	33
PID 2152 wrote to memory of 3004	2152	Unicorn-7400.exe	33
PID 2152 wrote to memory of 3004	2152	Unicorn-7400.exe	33
PID 2468 wrote to memory of 1748	2468	Unicorn-45740.exe	34
PID 2468 wrote to memory of 1748	2468	Unicorn-45740.exe	34
PID 2468 wrote to memory of 1748	2468	Unicorn-45740.exe	34
PID 2468 wrote to memory of 1748	2468	Unicorn-45740.exe	34
PID 2224 wrote to memory of 2668	2224	1a129a864a7debe1e0f0c2c9ffaf010f2909e0976e102c55dec0c5991f0092af.exe	35
PID 2224 wrote to memory of 2668	2224	1a129a864a7debe1e0f0c2c9ffaf010f2909e0976e102c55dec0c5991f0092af.exe	35
PID 2224 wrote to memory of 2668	2224	1a129a864a7debe1e0f0c2c9ffaf010f2909e0976e102c55dec0c5991f0092af.exe	35
PID 2224 wrote to memory of 2668	2224	1a129a864a7debe1e0f0c2c9ffaf010f2909e0976e102c55dec0c5991f0092af.exe	35
PID 1696 wrote to memory of 2648	1696	Unicorn-14930.exe	36
PID 1696 wrote to memory of 2648	1696	Unicorn-14930.exe	36
PID 1696 wrote to memory of 2648	1696	Unicorn-14930.exe	36
PID 1696 wrote to memory of 2648	1696	Unicorn-14930.exe	36
PID 3004 wrote to memory of 1960	3004	Unicorn-43685.exe	37
PID 3004 wrote to memory of 1960	3004	Unicorn-43685.exe	37
PID 3004 wrote to memory of 1960	3004	Unicorn-43685.exe	37
PID 3004 wrote to memory of 1960	3004	Unicorn-43685.exe	37
PID 2668 wrote to memory of 2592	2668	Unicorn-11680.exe	38
PID 2668 wrote to memory of 2592	2668	Unicorn-11680.exe	38
PID 2668 wrote to memory of 2592	2668	Unicorn-11680.exe	38
PID 2668 wrote to memory of 2592	2668	Unicorn-11680.exe	38
PID 2152 wrote to memory of 3016	2152	Unicorn-7400.exe	39
PID 2152 wrote to memory of 3016	2152	Unicorn-7400.exe	39
PID 2152 wrote to memory of 3016	2152	Unicorn-7400.exe	39
PID 2152 wrote to memory of 3016	2152	Unicorn-7400.exe	39
PID 2224 wrote to memory of 2504	2224	1a129a864a7debe1e0f0c2c9ffaf010f2909e0976e102c55dec0c5991f0092af.exe	40
PID 2224 wrote to memory of 2504	2224	1a129a864a7debe1e0f0c2c9ffaf010f2909e0976e102c55dec0c5991f0092af.exe	40
PID 2224 wrote to memory of 2504	2224	1a129a864a7debe1e0f0c2c9ffaf010f2909e0976e102c55dec0c5991f0092af.exe	40
PID 2224 wrote to memory of 2504	2224	1a129a864a7debe1e0f0c2c9ffaf010f2909e0976e102c55dec0c5991f0092af.exe	40
PID 1748 wrote to memory of 1336	1748	Unicorn-4790.exe	41
PID 1748 wrote to memory of 1336	1748	Unicorn-4790.exe	41
PID 1748 wrote to memory of 1336	1748	Unicorn-4790.exe	41
PID 1748 wrote to memory of 1336	1748	Unicorn-4790.exe	41
PID 2468 wrote to memory of 1680	2468	Unicorn-45740.exe	42
PID 2468 wrote to memory of 1680	2468	Unicorn-45740.exe	42
PID 2468 wrote to memory of 1680	2468	Unicorn-45740.exe	42
PID 2468 wrote to memory of 1680	2468	Unicorn-45740.exe	42
PID 1696 wrote to memory of 1092	1696	Unicorn-14930.exe	43
PID 1696 wrote to memory of 1092	1696	Unicorn-14930.exe	43
PID 1696 wrote to memory of 1092	1696	Unicorn-14930.exe	43
PID 1696 wrote to memory of 1092	1696	Unicorn-14930.exe	43
PID 1960 wrote to memory of 2852	1960	Unicorn-61941.exe	44
PID 1960 wrote to memory of 2852	1960	Unicorn-61941.exe	44
PID 1960 wrote to memory of 2852	1960	Unicorn-61941.exe	44
PID 1960 wrote to memory of 2852	1960	Unicorn-61941.exe	44
PID 3004 wrote to memory of 2360	3004	Unicorn-43685.exe	45
PID 3004 wrote to memory of 2360	3004	Unicorn-43685.exe	45
PID 3004 wrote to memory of 2360	3004	Unicorn-43685.exe	45
PID 3004 wrote to memory of 2360	3004	Unicorn-43685.exe	45

C:\Users\Admin\AppData\Local\Temp\1a129a864a7debe1e0f0c2c9ffaf010f2909e0976e102c55dec0c5991f0092af.exe
"C:\Users\Admin\AppData\Local\Temp\1a129a864a7debe1e0f0c2c9ffaf010f2909e0976e102c55dec0c5991f0092af.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2224
- C:\Users\Admin\AppData\Local\Temp\Unicorn-14930.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-14930.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1696
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45740.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45740.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4790.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4790.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-296.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62180.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49025.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54806.exe
        8⤵
        
        PID:2584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34380.exe
        8⤵
        
        PID:3708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33372.exe
        8⤵
        
        PID:4564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64784.exe
        8⤵
        
        PID:5328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62499.exe
        8⤵
        
        PID:5476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32544.exe
        8⤵
        
        PID:6160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2704.exe
        7⤵
        
        PID:820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3196.exe
        7⤵
        
        PID:1652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2917.exe
        7⤵
        
        PID:3136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7171.exe
        7⤵
        
        PID:4892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24263.exe
        7⤵
        
        PID:5052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13067.exe
        7⤵
        
        PID:5620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51889.exe
        7⤵
        
        PID:6804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53664.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30826.exe
        7⤵
        
        PID:1888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2339.exe
        8⤵
        
        PID:5496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38057.exe
        8⤵
        
        PID:6076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34813.exe
        8⤵
        
        PID:6292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21645.exe
        7⤵
        
        PID:2664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12023.exe
        7⤵
        
        PID:3436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10374.exe
        7⤵
        
        PID:3648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15287.exe
        7⤵
        
        PID:4856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7595.exe
        7⤵
        
        PID:5676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65361.exe
        7⤵
        
        PID:6396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6605.exe
        6⤵
        
        PID:976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3182.exe
        7⤵
        
        PID:4040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61773.exe
        7⤵
        
        PID:4840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57989.exe
        7⤵
        
        PID:1496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13034.exe
        7⤵
        
        PID:5252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38189.exe
        7⤵
        
        PID:6048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63996.exe
        6⤵
        
        PID:1060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9223.exe
        6⤵
        
        PID:3220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13186.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50628.exe
        6⤵
        
        PID:5020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37831.exe
        6⤵
        
        PID:6020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9907.exe
        6⤵
        
        PID:5420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46975.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26467.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12735.exe
        7⤵
        
        PID:1584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32295.exe
        8⤵
        
        PID:2080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48854.exe
        8⤵
        
        PID:3096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9971.exe
        8⤵
        
        PID:4884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41296.exe
        8⤵
        
        PID:4344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47348.exe
        8⤵
        
        PID:5512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10278.exe
        8⤵
        
        PID:6452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44396.exe
        7⤵
        
        PID:1688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12023.exe
        7⤵
        
        PID:3272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50639.exe
        7⤵
        
        PID:3212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33761.exe
        7⤵
        
        PID:4680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26069.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49025.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9974.exe
        6⤵
        
        PID:2796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32295.exe
        7⤵
        
        PID:1284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61302.exe
        7⤵
        
        PID:2976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5478.exe
        7⤵
        
        PID:4176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11769.exe
        7⤵
        
        PID:6000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40127.exe
        7⤵
        
        PID:6248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58131.exe
        6⤵
        
        PID:1212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17888.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44571.exe
        6⤵
        
        PID:4164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33161.exe
        6⤵
        
        PID:4372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26347.exe
        6⤵
        
        PID:5408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39372.exe
        6⤵
        
        PID:6628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61177.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49679.exe
        6⤵
        
        PID:2176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63825.exe
        6⤵
        
        PID:3500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4235.exe
        6⤵
        
        PID:4180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32630.exe
        6⤵
        
        PID:4156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10976.exe
        6⤵
        
        PID:5548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11013.exe
        6⤵
        
        PID:5232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53031.exe
        5⤵
        
        PID:1236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30437.exe
        5⤵
        
        PID:392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43253.exe
        5⤵
        
        PID:4076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46596.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19798.exe
        5⤵
        
        PID:5096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51738.exe
        5⤵
        
        PID:5388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8762.exe
        5⤵
        
        PID:6680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35661.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35661.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:1680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23286.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38143.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10488.exe
        7⤵
        
        PID:2768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8317.exe
        8⤵
        
        PID:4244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23641.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16917.exe
        8⤵
        
        PID:6036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12629.exe
        8⤵
        
        PID:6064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61007.exe
        7⤵
        
        PID:1440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1691.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54151.exe
        7⤵
        
        PID:4744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63158.exe
        7⤵
        
        PID:4128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54982.exe
        7⤵
        
        PID:5784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5678.exe
        7⤵
        
        PID:5380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10213.exe
        6⤵
        
        PID:3008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62310.exe
        7⤵
        
        PID:2792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61302.exe
        7⤵
        
        PID:1732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40289.exe
        7⤵
        
        PID:5080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11769.exe
        7⤵
        
        PID:5976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48295.exe
        7⤵
        
        PID:6232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26164.exe
        6⤵
        
        PID:980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2917.exe
        6⤵
        
        PID:3152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46066.exe
        6⤵
        
        PID:4936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59074.exe
        6⤵
        
        PID:4384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54982.exe
        6⤵
        
        PID:5672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5678.exe
        6⤵
        
        PID:6404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25075.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30826.exe
        6⤵
        
        PID:1552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8392.exe
        7⤵
        
        PID:4292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58452.exe
        7⤵
        
        PID:5060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3351.exe
        7⤵
        
        PID:6108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6023.exe
        7⤵
        
        PID:7132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21645.exe
        6⤵
        
        PID:2724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12023.exe
        6⤵
        
        PID:3288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10374.exe
        6⤵
        
        PID:3328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12011.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56118.exe
        6⤵
        
        PID:5532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7029.exe
        6⤵
        
        PID:6116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6605.exe
        5⤵
        
        PID:2960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19145.exe
        6⤵
        
        PID:480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63825.exe
        6⤵
        
        PID:3492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9963.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23953.exe
        6⤵
        
        PID:4804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54857.exe
        6⤵
        
        PID:5760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40127.exe
        6⤵
        
        PID:6300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63996.exe
        5⤵
        
        PID:2232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9223.exe
        5⤵
        
        PID:3396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21354.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34292.exe
        5⤵
        
        PID:4700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33856.exe
        5⤵
        
        PID:5800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38495.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17155.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17155.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33758.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37858.exe
        6⤵
        
        PID:4004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46200.exe
        6⤵
        
        PID:4256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19111.exe
        6⤵
        
        PID:5860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63135.exe
        6⤵
        
        PID:6664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59772.exe
        5⤵
        
        PID:1448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27399.exe
        5⤵
        
        PID:3116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58502.exe
        5⤵
        
        PID:3836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15088.exe
        5⤵
        
        PID:1252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12299.exe
        5⤵
        
        PID:5956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43830.exe
        5⤵
        
        PID:6204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23955.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23955.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13358.exe
        5⤵
        
        PID:2276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22267.exe
        6⤵
        
        PID:5552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49288.exe
        6⤵
        
        PID:6088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34813.exe
        6⤵
        
        PID:6352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14328.exe
        5⤵
        
        PID:2272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17389.exe
        5⤵
        
        PID:3568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61796.exe
        5⤵
        
        PID:4484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1904.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10976.exe
        5⤵
        
        PID:5664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11013.exe
        5⤵
        
        PID:6276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12679.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12679.exe
      4⤵
      PID:1468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20233.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20233.exe
      4⤵
      PID:988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37501.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37501.exe
      4⤵
      PID:1776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5288.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5288.exe
      4⤵
      PID:5048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24444.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24444.exe
      4⤵
      PID:5936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41602.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41602.exe
      4⤵
      PID:5224
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63482.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63482.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2648
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49397.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49397.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47982.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47982.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26275.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16623.exe
        6⤵
        
        PID:2864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63825.exe
        6⤵
        
        PID:3516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2179.exe
        6⤵
        
        PID:3228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51602.exe
        6⤵
        
        PID:4280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12537.exe
        6⤵
        
        PID:5396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25436.exe
        6⤵
        
        PID:6968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2704.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63964.exe
        5⤵
        
        PID:2588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58502.exe
        5⤵
        
        PID:3692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15088.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12299.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43830.exe
        5⤵
        
        PID:6380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47826.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47826.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18154.exe
        5⤵
        
        PID:3540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53379.exe
        5⤵
        
        PID:3984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39515.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56013.exe
        5⤵
        
        PID:5444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26813.exe
        5⤵
        
        PID:6528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31597.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31597.exe
      4⤵
      PID:2208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33265.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33265.exe
      4⤵
      PID:532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59789.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59789.exe
      4⤵
      PID:3952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56173.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56173.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37245.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37245.exe
      4⤵
      PID:4868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61157.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61157.exe
      4⤵
      PID:5340
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-478.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-478.exe
      4⤵
      PID:6460
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23021.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23021.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24220.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24220.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29389.exe
        5⤵
        
        PID:4400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29863.exe
        5⤵
        
        PID:4512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19111.exe
        5⤵
        
        PID:5824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32013.exe
        5⤵
        
        PID:6560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59772.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59772.exe
      4⤵
      PID:1972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27399.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27399.exe
      4⤵
      PID:3108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47202.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47202.exe
      4⤵
      PID:3992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37245.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37245.exe
      4⤵
      PID:5016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57073.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57073.exe
      4⤵
      PID:5504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28080.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28080.exe
      4⤵
      PID:6888
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41740.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41740.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33810.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33810.exe
      4⤵
      PID:2528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62922.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62922.exe
      4⤵
      PID:3636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62816.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62816.exe
      4⤵
      PID:4768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36714.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36714.exe
      4⤵
      PID:4820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61539.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61539.exe
      4⤵
      PID:5564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7883.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7883.exe
      4⤵
      PID:6764
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54172.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54172.exe
    3⤵
    PID:2608
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25130.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25130.exe
    3⤵
    PID:3100
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38788.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38788.exe
    3⤵
    PID:4032
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19730.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19730.exe
    3⤵
    PID:4960
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18663.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18663.exe
    3⤵
    PID:4132
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63013.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63013.exe
    3⤵
    PID:5428
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4818.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4818.exe
    3⤵
    PID:6772
- C:\Users\Admin\AppData\Local\Temp\Unicorn-7400.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-7400.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2152
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43685.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43685.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61941.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61941.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49736.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:2852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31345.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20795.exe
        7⤵
        
        PID:1444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17581.exe
        8⤵
        
        PID:4632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52422.exe
        8⤵
        
        PID:4824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19111.exe
        8⤵
        
        PID:5836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32013.exe
        8⤵
        
        PID:6596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26164.exe
        7⤵
        
        PID:2004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2917.exe
        7⤵
        
        PID:3144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46066.exe
        7⤵
        
        PID:4952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59074.exe
        7⤵
        
        PID:4348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13067.exe
        7⤵
        
        PID:5628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9897.exe
        7⤵
        
        PID:6648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19595.exe
        6⤵
        
        PID:2676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37894.exe
        7⤵
        
        PID:2860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52087.exe
        7⤵
        
        PID:3976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62816.exe
        7⤵
        
        PID:4760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32630.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30812.exe
        7⤵
        
        PID:5536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27344.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11151.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23255.exe
        6⤵
        
        PID:3584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53131.exe
        6⤵
        
        PID:4476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38653.exe
        6⤵
        
        PID:4540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54982.exe
        6⤵
        
        PID:6044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5678.exe
        6⤵
        
        PID:6348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5257.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50670.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55704.exe
        7⤵
        
        PID:2252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61302.exe
        7⤵
        
        PID:3928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40289.exe
        7⤵
        
        PID:3588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30703.exe
        7⤵
        
        PID:5336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32544.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35765.exe
        6⤵
        
        PID:2896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17888.exe
        6⤵
        
        PID:3264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41974.exe
        6⤵
        
        PID:3160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17226.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24660.exe
        6⤵
        
        PID:5704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4936.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50570.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30951.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31809.exe
        6⤵
        
        PID:4876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19111.exe
        6⤵
        
        PID:5852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32013.exe
        6⤵
        
        PID:6568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56814.exe
        5⤵
        
        PID:2748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9223.exe
        5⤵
        
        PID:3360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60249.exe
        5⤵
        
        PID:3132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34292.exe
        5⤵
        
        PID:4688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3130.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38495.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54375.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54375.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55849.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20795.exe
        6⤵
        
        PID:2392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24229.exe
        7⤵
        
        PID:5292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58027.exe
        7⤵
        
        PID:6216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13944.exe
        6⤵
        
        PID:1488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1691.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7442.exe
        6⤵
        
        PID:3184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40799.exe
        6⤵
        
        PID:4412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10976.exe
        6⤵
        
        PID:5812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11013.exe
        6⤵
        
        PID:6320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-929.exe
        5⤵
        
        PID:2156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16623.exe
        6⤵
        
        PID:2868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63825.exe
        6⤵
        
        PID:3416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4509.exe
        6⤵
        
        PID:3672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42427.exe
        6⤵
        
        PID:4588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11878.exe
        6⤵
        
        PID:5608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31959.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34804.exe
        5⤵
        
        PID:2692
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2692 -s 188
        6⤵
        Program crash
        
        PID:940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17888.exe
        5⤵
        
        PID:3304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58310.exe
        5⤵
        
        PID:4000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17226.exe
        5⤵
        
        PID:4612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12408.exe
        5⤵
        
        PID:5600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35662.exe
        5⤵
        
        PID:1232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47581.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47581.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63498.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1052.exe
        6⤵
        
        PID:4704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29863.exe
        6⤵
        
        PID:4572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19111.exe
        6⤵
        
        PID:5876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32013.exe
        6⤵
        
        PID:6504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4349.exe
        5⤵
        
        PID:2684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12023.exe
        5⤵
        
        PID:3344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50639.exe
        5⤵
        
        PID:2256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33761.exe
        5⤵
        
        PID:4668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7595.exe
        5⤵
        
        PID:5692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26467.exe
        5⤵
        
        PID:6120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63617.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63617.exe
      4⤵
      Executes dropped EXE
      PID:1476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63166.exe
        5⤵
        
        PID:3028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62589.exe
        5⤵
        
        PID:3088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15836.exe
        5⤵
        
        PID:4900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32630.exe
        5⤵
        
        PID:2944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30812.exe
        5⤵
        
        PID:1140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-701.exe
        5⤵
        
        PID:6616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38227.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38227.exe
      4⤵
      PID:2876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58225.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58225.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42504.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42504.exe
      4⤵
      PID:3948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12761.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12761.exe
      4⤵
      PID:4648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16269.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16269.exe
      4⤵
      PID:5632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42695.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42695.exe
      4⤵
      PID:6172
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23601.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23601.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:3016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9087.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9087.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62455.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56700.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33810.exe
        7⤵
        
        PID:2632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53493.exe
        7⤵
        
        PID:3880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1577.exe
        7⤵
        
        PID:4028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41296.exe
        7⤵
        
        PID:4208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17447.exe
        7⤵
        
        PID:5560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37213.exe
        6⤵
        
        PID:2700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12023.exe
        6⤵
        
        PID:3468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15828.exe
        6⤵
        
        PID:3320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26401.exe
        6⤵
        
        PID:4304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4899.exe
        6⤵
        
        PID:5268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3732.exe
        6⤵
        
        PID:5308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43632.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33810.exe
        6⤵
        
        PID:2260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53493.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1577.exe
        6⤵
        
        PID:912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49464.exe
        6⤵
        
        PID:4160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59448.exe
        6⤵
        
        PID:5984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32544.exe
        6⤵
        
        PID:6432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18084.exe
        5⤵
        
        PID:1256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17888.exe
        5⤵
        
        PID:3460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37889.exe
        5⤵
        
        PID:264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64289.exe
        5⤵
        
        PID:4808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55387.exe
        5⤵
        
        PID:5788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43830.exe
        5⤵
        
        PID:6372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38889.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38889.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63882.exe
        5⤵
        
        PID:2052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20624.exe
        6⤵
        
        PID:2088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33810.exe
        7⤵
        
        PID:2560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62922.exe
        7⤵
        
        PID:3600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1577.exe
        7⤵
        
        PID:3576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45380.exe
        7⤵
        
        PID:4920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17447.exe
        7⤵
        
        PID:5576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8164.exe
        7⤵
        
        PID:6200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18028.exe
        6⤵
        
        PID:1844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11120.exe
        6⤵
        
        PID:3612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7442.exe
        6⤵
        
        PID:4012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1904.exe
        6⤵
        
        PID:4992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10976.exe
        6⤵
        
        PID:5584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11013.exe
        6⤵
        
        PID:6268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21178.exe
        5⤵
        
        PID:2368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18847.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58502.exe
        5⤵
        
        PID:3900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15088.exe
        5⤵
        
        PID:2704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47110.exe
        5⤵
        
        PID:5920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4936.exe
        5⤵
        
        PID:5228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39278.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39278.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60260.exe
        5⤵
        
        PID:1572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3654.exe
        5⤵
        
        PID:3632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55931.exe
        5⤵
        
        PID:4468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6485.exe
        5⤵
        
        PID:4428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45968.exe
        5⤵
        
        PID:5208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44754.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44754.exe
      4⤵
      PID:1636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9223.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9223.exe
      4⤵
      PID:3312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25438.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25438.exe
      4⤵
      PID:3248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34292.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34292.exe
      4⤵
      PID:4660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3130.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3130.exe
      4⤵
      PID:5728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22159.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22159.exe
      4⤵
      PID:5996
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45936.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45936.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26275.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26275.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20712.exe
        5⤵
        
        PID:1928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39044.exe
        6⤵
        
        PID:4272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58452.exe
        6⤵
        
        PID:4192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16297.exe
        6⤵
        
        PID:5272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40679.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62678.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2068
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2068 -s 188
        6⤵
        Program crash
        
        PID:1380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12023.exe
        5⤵
        
        PID:3280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53353.exe
        5⤵
        
        PID:3704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33761.exe
        5⤵
        
        PID:4580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26069.exe
        5⤵
        
        PID:5656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65361.exe
        5⤵
        
        PID:6224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58407.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58407.exe
      4⤵
      PID:576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23037.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63825.exe
        5⤵
        
        PID:3508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35236.exe
        5⤵
        
        PID:2980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42427.exe
        5⤵
        
        PID:4716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42605.exe
        5⤵
        
        PID:5640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40127.exe
        5⤵
        
        PID:6308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64545.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64545.exe
      4⤵
      PID:2800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17888.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17888.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18998.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18998.exe
      4⤵
      PID:4136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33161.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33161.exe
      4⤵
      PID:4216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49647.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49647.exe
      4⤵
      PID:5972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38224.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38224.exe
      4⤵
      PID:7124
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24448.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24448.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41044.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41044.exe
      4⤵
      PID:996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7935.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7935.exe
      4⤵
      PID:2372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62589.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62589.exe
      4⤵
      PID:3176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54731.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54731.exe
      4⤵
      PID:5100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40799.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40799.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10976.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10976.exe
      4⤵
      PID:5756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11013.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11013.exe
      4⤵
      PID:6412
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28797.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28797.exe
    3⤵
    PID:2072
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8064.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8064.exe
    3⤵
    PID:3076
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60319.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60319.exe
    3⤵
    PID:4068
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25065.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25065.exe
    3⤵
    PID:4972
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14463.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14463.exe
    3⤵
    PID:4500
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55938.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55938.exe
    3⤵
    PID:5468
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23019.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23019.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6788
- C:\Users\Admin\AppData\Local\Temp\Unicorn-11680.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-11680.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2668
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43467.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43467.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49544.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49544.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-426.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22850.exe
        6⤵
        
        PID:2856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28546.exe
        7⤵
        
        PID:4440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3605.exe
        7⤵
        
        PID:5212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16297.exe
        7⤵
        
        PID:5436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40679.exe
        7⤵
        
        PID:6336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55880.exe
        6⤵
        
        PID:2384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12023.exe
        6⤵
        
        PID:3452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41942.exe
        7⤵
        
        PID:3996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3221.exe
        7⤵
        
        PID:4232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19111.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32013.exe
        7⤵
        
        PID:6552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15828.exe
        6⤵
        
        PID:3532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57128.exe
        6⤵
        
        PID:4332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4899.exe
        6⤵
        
        PID:5280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17188.exe
        6⤵
        
        PID:6056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54131.exe
        5⤵
        
        PID:3000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21610.exe
        6⤵
        
        PID:1472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10082.exe
        7⤵
        
        PID:6612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25833.exe
        6⤵
        
        PID:2824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62589.exe
        6⤵
        
        PID:3168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15836.exe
        6⤵
        
        PID:4832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36714.exe
        6⤵
        
        PID:4996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10976.exe
        6⤵
        
        PID:5780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11013.exe
        6⤵
        
        PID:6072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65256.exe
        5⤵
        
        PID:2008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45434.exe
        5⤵
        
        PID:2548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59789.exe
        5⤵
        
        PID:3956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56173.exe
        5⤵
        
        PID:4860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59803.exe
        5⤵
        
        PID:4456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60319.exe
        5⤵
        
        PID:5424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44830.exe
        5⤵
        
        PID:6244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59118.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59118.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58407.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-717.exe
        6⤵
        
        PID:3668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62728.exe
        6⤵
        
        PID:4376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3351.exe
        6⤵
        
        PID:6096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32013.exe
        6⤵
        
        PID:6544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58131.exe
        5⤵
        
        PID:2108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8320.exe
        5⤵
        
        PID:3624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47778.exe
        5⤵
        
        PID:4052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55719.exe
        5⤵
        
        PID:4496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48905.exe
        5⤵
        
        PID:5244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11853.exe
        5⤵
        
        PID:5528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28203.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28203.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51724.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21967.exe
        5⤵
        
        PID:4320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4704.exe
        5⤵
        
        PID:5044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10446.exe
        5⤵
        
        PID:5904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15478.exe
        5⤵
        
        PID:1080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13835.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13835.exe
      4⤵
      PID:2752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9223.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9223.exe
      4⤵
      PID:3476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25438.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25438.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15817.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15817.exe
      4⤵
      PID:4788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3130.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3130.exe
      4⤵
      PID:5736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5823.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5823.exe
      4⤵
      PID:5384
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7696.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7696.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44941.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44941.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63882.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54996.exe
        6⤵
        
        PID:5116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29863.exe
        6⤵
        
        PID:4508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15337.exe
        6⤵
        
        PID:5684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63081.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27291.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12023.exe
        5⤵
        
        PID:3428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41101.exe
        5⤵
        
        PID:3912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55189.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10976.exe
        5⤵
        
        PID:5748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11013.exe
        5⤵
        
        PID:6332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60353.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60353.exe
      4⤵
      PID:2280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33250.exe
        5⤵
        
        PID:3332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30135.exe
        5⤵
        
        PID:4352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43599.exe
        5⤵
        
        PID:4560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21202.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30897.exe
        5⤵
        
        PID:6668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4078.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4078.exe
      4⤵
      PID:2816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17888.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17888.exe
      4⤵
      PID:3352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11247.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11247.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17226.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17226.exe
      4⤵
      PID:4696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24660.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24660.exe
      4⤵
      PID:5712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27494.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27494.exe
      4⤵
      PID:5964
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12168.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12168.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24215.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24215.exe
      4⤵
      PID:2680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63825.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63825.exe
      4⤵
      PID:3484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44774.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44774.exe
      4⤵
      PID:3200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42427.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42427.exe
      4⤵
      PID:4652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54857.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54857.exe
      4⤵
      PID:5772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9401.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9401.exe
      4⤵
      PID:5888
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53031.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53031.exe
    3⤵
    PID:1032
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22269.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22269.exe
    3⤵
    PID:2356
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59032.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59032.exe
    3⤵
    PID:3904
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10623.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10623.exe
    3⤵
    PID:4108
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50970.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50970.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5988
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26359.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26359.exe
    3⤵
    PID:5300
- C:\Users\Admin\AppData\Local\Temp\Unicorn-6253.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-6253.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:2504
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23286.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23286.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2154.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2154.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10447.exe
        5⤵
        
        PID:4092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30439.exe
        5⤵
        
        PID:4800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50148.exe
        5⤵
        
        PID:5580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63081.exe
        5⤵
        
        PID:6872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17862.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17862.exe
      4⤵
      PID:864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17888.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17888.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1709.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1709.exe
      4⤵
      PID:3652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17226.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17226.exe
      4⤵
      PID:4596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12408.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12408.exe
      4⤵
      PID:5592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35662.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35662.exe
      4⤵
      PID:5376
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23129.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23129.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45699.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45699.exe
      4⤵
      PID:1180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61302.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61302.exe
      4⤵
      PID:2936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40289.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40289.exe
      4⤵
      PID:1632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46580.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46580.exe
      4⤵
      PID:5912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48295.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48295.exe
      4⤵
      PID:6280
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7970.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7970.exe
    3⤵
    PID:1204
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33265.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33265.exe
    3⤵
    PID:444
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59789.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59789.exe
    3⤵
    PID:3960
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29530.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29530.exe
    3⤵
    PID:5088
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41329.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41329.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4408
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49647.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49647.exe
    3⤵
    PID:5944
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9878.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9878.exe
    3⤵
    PID:6444
- C:\Users\Admin\AppData\Local\Temp\Unicorn-14355.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-14355.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2956
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1770.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1770.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34246.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34246.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23037.exe
        5⤵
        
        PID:2716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28333.exe
        5⤵
        
        PID:3680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54151.exe
        5⤵
        
        PID:4752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46821.exe
        5⤵
        
        PID:4676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47878.exe
        5⤵
        
        PID:5484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5813.exe
        5⤵
        
        PID:6496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9777.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9777.exe
      4⤵
      PID:2880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12023.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12023.exe
      4⤵
      PID:3444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46555.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46555.exe
      4⤵
      PID:3720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33761.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33761.exe
      4⤵
      PID:4732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38321.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38321.exe
      4⤵
      PID:5840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65361.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65361.exe
      4⤵
      PID:6388
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-758.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-758.exe
    3⤵
    PID:2888
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33237.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33237.exe
    3⤵
    PID:2536
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58502.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58502.exe
    3⤵
    PID:3892
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15088.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15088.exe
    3⤵
    PID:2988
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47110.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47110.exe
    3⤵
    PID:5928
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27494.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27494.exe
    3⤵
    PID:5880
- C:\Users\Admin\AppData\Local\Temp\Unicorn-54094.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-54094.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1280
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55709.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55709.exe
    3⤵
    PID:2540
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17032.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17032.exe
    3⤵
    PID:3856
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27124.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27124.exe
    3⤵
    PID:4600
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38653.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38653.exe
    3⤵
    PID:4524
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4899.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4899.exe
    3⤵
    PID:5264
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53944.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53944.exe
    3⤵
    PID:6416
- C:\Users\Admin\AppData\Local\Temp\Unicorn-14169.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-14169.exe
  2⤵
  PID:2488
- C:\Users\Admin\AppData\Local\Temp\Unicorn-9437.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-9437.exe
  2⤵
  PID:304
- C:\Users\Admin\AppData\Local\Temp\Unicorn-33453.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-33453.exe
  2⤵
  PID:4056
- C:\Users\Admin\AppData\Local\Temp\Unicorn-50572.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-50572.exe
  2⤵
  PID:4912
- C:\Users\Admin\AppData\Local\Temp\Unicorn-48296.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-48296.exe
  2⤵
  PID:4264
- C:\Users\Admin\AppData\Local\Temp\Unicorn-44813.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-44813.exe
  2⤵
  PID:5488
- C:\Users\Admin\AppData\Local\Temp\Unicorn-39679.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-39679.exe
  2⤵
  PID:6508

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-12168.exe

Filesize
468KB

MD5
fd3e4eec5a49f2dbae9b0e50be4eb3c6

SHA1
986218381178cfb5e1a060e4592daed155e13b48

SHA256
4a337087e3f683b6e5eb6d469b3dc2ab7767837a6cfe42069cad07b4de485d92

SHA512
0248517a0a50e775ad2e4a1edd9598c01f0161ecb6354899ee785b4db621f64168b5578b06696538dca6d8bfc408bf2b199d4ce313fd850c36288e7a326275c0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-22269.exe

Filesize
468KB

MD5
31f621d64ae6b2fb64f4275778576c09

SHA1
9ba948b44a07345892900cf25bbedb74ba46380b

SHA256
2895c5890ce125273b8553dc9b783f89c3a7794a3d34b3b96b14b3b2c1f94570

SHA512
5148e476cf6991249c762589be06fd99a09ece300fae16cfffdea3ce71cb6abb5a2a2e8d636bc764293cf46c74811fadf56c26cf9ea522136125dd34fa6f5902

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-24215.exe

Filesize
468KB

MD5
6b395e038f463ff1915c25136d129786

SHA1
c24b047f80482d763ae837bdee7c7c95bf88034b

SHA256
27a250edcabcc8984b4e3b6252de5227d6318721f6c73028d9db600524487069

SHA512
4b122d344a6097bf3be53074b342cf5d50cf26a7502cd96bc9ed2fdb7ef5e0e60330f65bee85f0f2f11d0dd8cad14f5bfb8fba19735322002cedc8e96114ed7a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-296.exe

Filesize
468KB

MD5
acc375a064785dde19c5d6e3c356f042

SHA1
e483f581a71f1adb1fbde58d8b166a64b1f506ea

SHA256
dd47c062d2f80792bde022b6fce9a626b81f7d433b9b491b64a9fd7a7f7f51e8

SHA512
f3c4f027887cb297a2e4822d68e0ce26e64a72a5659a37d71964422ed6ed8d04c3129d2e3a4040c3bde364c6fded5a94da78f9c3ae2795ca9cbaa606b500cf00

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-3221.exe

Filesize
468KB

MD5
ed4b3198247583f1eb4ec486dc15f6f1

SHA1
b01b1d6545ea4d04f3bf7e309e59f39047bbff7f

SHA256
20080ea2bf3271dbfb86f24e07e6a53c8b95c3e293c9c45cac6bb990019900ed

SHA512
5e484fb5ef2cd87ec461ee5b3a372a49841f98b9422403fb21897abafe2bc77b22f938d9f814cd1f185f76a4ebc9e39bb568fbabb268fd079c27299172ffbdf5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-43467.exe

Filesize
468KB

MD5
ff342c976456cd80dc585b6644536806

SHA1
67eb1db007acea388d025fa3fa8fa4f5bf8f17bc

SHA256
f85fbda9aa2ed6158d6f4b879155cb25d8570ae16d6dd4a0153323b371b6024e

SHA512
299dd001da205016c8013c429eb9844feae6e1fef7fc037e84d49aed899141131eb3cec8415fa5174f6da8b20989129a0ba600a8566245fcca864e422b9960fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-49736.exe

Filesize
468KB

MD5
245a7be054ea7c328583add6417f30b3

SHA1
4811bd19113fab047bfddd215b4eb5afecb903e0

SHA256
faa3491b30e7d5d6bf8c80bfe2a96276976fa1954db2ea93bf54dce0bbadc899

SHA512
acdff2183b6f9438d1ef324ba6aac35442cb6f447d72b41daf66e9efc40afa5dc31b491f20033500b358c13ebf4b44c6aed88fb35b7ea68510d8ea29dafd9198

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-54375.exe

Filesize
468KB

MD5
623ce1644b377b19e28e835be4973496

SHA1
a9b5f6efdeeac7883e0d03415d8e6c17fafcfeba

SHA256
f57117870cc17d9ad4809245563d69b0fa4f7606b331c0776c0833829209d2af

SHA512
5fbe06ae93c51ecf868130cb4c500bb8b0419b30feb83586651773a8e7cd6bd7290537cad288e4e3b42273c2cbf24007b653aa6749f204c2957b1c73c42fa318

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-62728.exe

Filesize
468KB

MD5
150bff10f8a8ac95c49da734c4bf3e9f

SHA1
9e336c01eeabaddd649e56fdf4b095eac01db3ca

SHA256
c46440fb4c36615ee76c91a04ef6ab07058adf63b57c2f741efc5642821d415a

SHA512
18c1fc1ce9cf58fcf29664f39793f38e14b409de26b8748cde903e9cc24a7aba151d90ceec765bc1fb79f05a29be73994c17adfacb1fb1d7665fd153dd415579

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-7400.exe

Filesize
468KB

MD5
462c62b201b9aa0510c8c3730c341229

SHA1
e29e436ff4b2e330859e038b6a72c077cf07ba7e

SHA256
99e125ee5d00a09a61a71a97bb9d4c45129cbe91d7e2c362da5cfdcacae32698

SHA512
491c557283727a05318a6b77f5375a8bd081dd2f7469888d30710b12e0d01d390d4196d85b60cd7ce1381a57b7393bd39b5860601f5f9acf63434a1b609658d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-7696.exe

Filesize
468KB

MD5
19c71645d0ca971708fe029bd8479f0f

SHA1
99bf792795125ed1145484b1461fed9f40f396de

SHA256
4f1479ae1599fea2adbc7886cc50f1547e10b00bc85a6ea09e64d8bc331c64f1

SHA512
486bcbadbe8532cb4a89d10c0e3c8ce5a101b48fed9dbcb28ce679411625c37e316f4271fa640cc0fb2c1a71bda14f02612e9020f8aa24bf519cf93c449d1359

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-11680.exe

Filesize
468KB

MD5
7a402d1fad61d1a448dfaa590f417423

SHA1
f6be4019bf6cf425e0e09a4b29133aadd2560db0

SHA256
636ca0349bb7493c9d5ebca091d9a78a1136e5e221307d174a07a7583f804d8d

SHA512
292d74d5ccceb097b58b55331044746568a13f88d62253d4e15cfa542e4b4674c725f7ce610d9209a0449d8ff647e00c70c1fbb15628c61bd8e7b5adb5e60e4c

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-14930.exe

Filesize
468KB

MD5
b1c067ade661412a7399f740b7d2c564

SHA1
bdd6bb40702c6423b352332a59e7ecc2173440d9

SHA256
2799fc26e9bd0803ce114a18e88037e64fb3be0f871d0ca134ee2f5d7da8e5df

SHA512
198b1bbf6919c051455ae253dd637f802cc6a5fee27a7840e6100f6a80da1b3e39f2dd4dfc58a7b7fc87969bd307b0674f212fbbb2166a0c3911f4f0fb00cd2f

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-23601.exe

Filesize
468KB

MD5
58eeefc0c5c976675208410d0e5d581f

SHA1
a313506d503e443c802a48f7488cc6adfd7a2c23

SHA256
db74f8adaadd1176f08d48697762c1d50a3ba437729396c5fc5c2ab7f146c945

SHA512
c0fe53a40b369c8582e9df9572904a15a59527bb794f52d3c4bcd2258d547e55e2ea32805321e50c8c3ad02f57a8d51c5fc89930668fecd5f3ad78a06be87a5f

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-35661.exe

Filesize
468KB

MD5
4ecf765bdbb190a4d3589470875ecce6

SHA1
2597f8711a1477c21745055b4c1eebe830a456e7

SHA256
d40f99da5a7027a2035f377c0977660f38df51dc34a9a1e249bf55d5f4aacb59

SHA512
52377079082e1cb1ab50e128750791823b446d9c858842e0b53bf90e34ae526465e6098c7d2d7a79db0d3a392ebf0dc3f6ac4f95b464f4a22f775862acfe4c33

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-43685.exe

Filesize
468KB

MD5
b69386c081f606e2ef4debeea09ee58f

SHA1
134f6e3eb3bf4fcabb32cdc421e925d48d7c0e4e

SHA256
503369051cf0f30b21853b4a23d296f6c2fd5ba86ad2aca80c97d946f07f219a

SHA512
cb7409ad7d3e3c577ddbd04aebe0424d11b6ae61584ae543562e88f637897dc28feaf534cc9271f67bdbf54acea7aa29e1b1bdd192c46a874426aab0f22bf6b3

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-45740.exe

Filesize
468KB

MD5
1afeb7109f51b7a327c99ef0debbcaff

SHA1
bb852a716efcdefa0993fac37a1814a3476b0ad2

SHA256
5b661844cc65e47cc1f938188bb4b4d57163e2a2c2d791a5258a171d5601463f

SHA512
b1de656d1236ac1a9f3a0a5f1f3bac8bdc8de4d401bb670199cfaa37d8cc3a1f44e16d6d88da34b04c1dcaec7f92fe4fb73bacd200fef421ea0fe132f588ee51

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-4790.exe

Filesize
468KB

MD5
4f9b3f54bfb344729d21b605ca7ec036

SHA1
b62d0f27717adddbc0dff75da47f67315f100a9c

SHA256
12913348dd4705451051f132cb98dc7ea2c06fbb72964db7a982553db8ac3a1f

SHA512
396466241fcacafc09bfa4f1b447c1cbacaf745d254f894ed8f514647b45e92f3630988f76983d951ae59a26165e0a207ac2a3ccfc26e289875ca78622f3a6e5

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-49397.exe

Filesize
468KB

MD5
c186cbcbce9bbc976c5495885ec70407

SHA1
fd1f25723090e1779fbf4033f8c6046b18849520

SHA256
a94cee99d0d54955e78ffc9cdbc2366dee8fe2e97bf692bcbbf669c35db6cc88

SHA512
6fa8655976601734f9d40dea588959d64509b2e6bf65fec6d012c7fc84b467b11328d36e74072812a996825cbba77a9ec2c801f4865c78a6986b59316c9aa309

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-49544.exe

Filesize
468KB

MD5
0f37bbb8c538992dfb8eb65872df13c9

SHA1
af0642208e5f51572f68b205d7d5217dad59ace2

SHA256
5db00676d20faf525f0e6ae11986eb40d7e957411c813123c94904b851f93c83

SHA512
c75c4a934a176bbce79c8bd23a3781a9dfe6adb7e12fbaedbbc0512507def4f89602d36f474884af658937af5e4c32c5b4ee73b9de3ccf918d07aa2293359abf

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-61941.exe

Filesize
468KB

MD5
d42df6c1fbaf5e5abf45ec64c029f156

SHA1
ef6b55ac8df4d70d34c85a8f533f997d9c24be2c

SHA256
026789779f8314961c175ed92d33986fac8f0867430d5e904fcf2c12174c6349

SHA512
af6578a6dfa56680297e15d28143e5e3b7d6842960c989a2372618d91357999bdad5f6fb8f0ac4ef8e1822f8b2f88da7d836fc4f9a48c8e11f1b65af023c87f1

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-6253.exe

Filesize
468KB

MD5
3266728241f106deff4153e9bfb387a4

SHA1
de93bd2c0ea826cc2514cf42f531a611e74c8c6e

SHA256
6cf0eeb61cbf22f421b1544d19da8c980508ab8e48ea08e82fc212e8c45362a5

SHA512
b6cbbe0c9555509c5bda462d7e6471d7627e6e6171a6aad9c7f711d6f722ccb3509bf52f15d38e3bd20763dc630510a8b0415eeb1d661d3f71f102b5ab899d11

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-63482.exe

Filesize
468KB

MD5
e8025e0e495606ae314f2c47efd9575e

SHA1
11f58445006fc466e462d5c77056dbebc7b90948

SHA256
8073b139828f40cad04ab8af20a89ebf9edf1aa8f994fc646485a69fde7100de

SHA512
431ea0c109c5baae1f2228c1dca26cff53b5abbc087c363798c8f73481534cc68e1035ff8ca575a4cbc019c2dfa3af4dd88710180954e573d14dee039b21be1b

Download Submit
memory/1040-360-0x00000000025E0000-0x0000000002655000-memory.dmp

Filesize
468KB

Download
memory/1040-216-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1040-364-0x00000000025E0000-0x0000000002655000-memory.dmp

Filesize
468KB

Download
memory/1092-169-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1092-257-0x0000000002400000-0x0000000002475000-memory.dmp

Filesize
468KB

Download
memory/1092-253-0x0000000002400000-0x0000000002475000-memory.dmp

Filesize
468KB

Download
memory/1208-348-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1336-292-0x0000000002990000-0x0000000002A05000-memory.dmp

Filesize
468KB

Download
memory/1336-148-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1336-291-0x00000000034C0000-0x0000000003535000-memory.dmp

Filesize
468KB

Download
memory/1420-295-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1428-304-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1484-402-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1508-296-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1532-258-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1616-241-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1616-388-0x00000000024D0000-0x0000000002545000-memory.dmp

Filesize
468KB

Download
memory/1616-389-0x00000000024D0000-0x0000000002545000-memory.dmp

Filesize
468KB

Download
memory/1660-345-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1680-267-0x0000000002500000-0x0000000002575000-memory.dmp

Filesize
468KB

Download
memory/1680-162-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1680-289-0x0000000002500000-0x0000000002575000-memory.dmp

Filesize
468KB

Download
memory/1696-168-0x0000000002A30000-0x0000000002AA5000-memory.dmp

Filesize
468KB

Download
memory/1696-404-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1696-270-0x0000000001C90000-0x0000000001D05000-memory.dmp

Filesize
468KB

Download
memory/1696-293-0x0000000001C90000-0x0000000001D05000-memory.dmp

Filesize
468KB

Download
memory/1696-35-0x0000000002A30000-0x0000000002AA5000-memory.dmp

Filesize
468KB

Download
memory/1696-13-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1748-303-0x0000000001D20000-0x0000000001D95000-memory.dmp

Filesize
468KB

Download
memory/1748-146-0x0000000001D20000-0x0000000001D95000-memory.dmp

Filesize
468KB

Download
memory/1748-145-0x0000000001D20000-0x0000000001D95000-memory.dmp

Filesize
468KB

Download
memory/1748-64-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1748-305-0x0000000001D20000-0x0000000001D95000-memory.dmp

Filesize
468KB

Download
memory/1752-288-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1768-250-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1960-340-0x00000000031D0000-0x0000000003245000-memory.dmp

Filesize
468KB

Download
memory/1960-344-0x00000000031D0000-0x0000000003245000-memory.dmp

Filesize
468KB

Download
memory/1960-96-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1960-186-0x00000000031D0000-0x0000000003245000-memory.dmp

Filesize
468KB

Download
memory/1960-187-0x00000000026A0000-0x0000000002715000-memory.dmp

Filesize
468KB

Download
memory/2152-36-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2152-249-0x0000000002850000-0x00000000028C5000-memory.dmp

Filesize
468KB

Download
memory/2152-44-0x0000000002850000-0x00000000028C5000-memory.dmp

Filesize
468KB

Download
memory/2152-251-0x0000000002850000-0x00000000028C5000-memory.dmp

Filesize
468KB

Download
memory/2224-11-0x0000000002950000-0x00000000029C5000-memory.dmp

Filesize
468KB

Download
memory/2224-271-0x0000000002950000-0x00000000029C5000-memory.dmp

Filesize
468KB

Download
memory/2224-390-0x0000000003480000-0x00000000034F5000-memory.dmp

Filesize
468KB

Download
memory/2224-10-0x0000000003480000-0x00000000034F5000-memory.dmp

Filesize
468KB

Download
memory/2224-1-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2224-34-0x0000000003480000-0x00000000034F5000-memory.dmp

Filesize
468KB

Download
memory/2224-290-0x0000000002950000-0x00000000029C5000-memory.dmp

Filesize
468KB

Download
memory/2224-408-0x0000000002950000-0x00000000029C5000-memory.dmp

Filesize
468KB

Download
memory/2224-132-0x0000000003480000-0x00000000034F5000-memory.dmp

Filesize
468KB

Download
memory/2224-131-0x0000000003480000-0x00000000034F5000-memory.dmp

Filesize
468KB

Download
memory/2224-373-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2332-330-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2360-347-0x00000000031F0000-0x0000000003265000-memory.dmp

Filesize
468KB

Download
memory/2360-201-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2360-346-0x00000000031F0000-0x0000000003265000-memory.dmp

Filesize
468KB

Download
memory/2468-287-0x00000000024D0000-0x0000000002545000-memory.dmp

Filesize
468KB

Download
memory/2468-159-0x00000000024D0000-0x0000000002545000-memory.dmp

Filesize
468KB

Download
memory/2468-265-0x00000000024D0000-0x0000000002545000-memory.dmp

Filesize
468KB

Download
memory/2468-158-0x00000000024D0000-0x0000000002545000-memory.dmp

Filesize
468KB

Download
memory/2484-297-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2484-412-0x0000000002480000-0x00000000024F5000-memory.dmp

Filesize
468KB

Download
memory/2504-269-0x0000000001DA0000-0x0000000001E15000-memory.dmp

Filesize
468KB

Download
memory/2504-133-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2552-374-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2556-391-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2592-372-0x0000000002620000-0x0000000002695000-memory.dmp

Filesize
468KB

Download
memory/2592-214-0x0000000002620000-0x0000000002695000-memory.dmp

Filesize
468KB

Download
memory/2592-217-0x0000000002620000-0x0000000002695000-memory.dmp

Filesize
468KB

Download
memory/2592-112-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2648-82-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2656-357-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2668-111-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2668-228-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2668-227-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2668-78-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2688-413-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2708-365-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2788-231-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2852-188-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2852-329-0x0000000001DA0000-0x0000000001E15000-memory.dmp

Filesize
468KB

Download
memory/2852-325-0x0000000001DA0000-0x0000000001E15000-memory.dmp

Filesize
468KB

Download
memory/2956-294-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3004-199-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/3004-200-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/3004-355-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/3004-359-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/3004-62-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3016-400-0x0000000002880000-0x00000000028F5000-memory.dmp

Filesize
468KB

Download
memory/3016-118-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3016-403-0x0000000002880000-0x00000000028F5000-memory.dmp

Filesize
468KB

Download
memory/3016-243-0x0000000002880000-0x00000000028F5000-memory.dmp

Filesize
468KB

Download
memory/3016-239-0x0000000002880000-0x00000000028F5000-memory.dmp

Filesize
468KB

Download