40d10e4dc1a4877e5747721c530aba7a7eb679195fdf59df204eaf94a795b15d

Analysis

max time kernel
118s
max time network
16s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
08/09/2024, 13:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7183632edfb768b7763bd0b3381131c0N.exe
Size

468KB
MD5

7183632edfb768b7763bd0b3381131c0
SHA1

332210664dcf59ca33a3814fa6b4addc973aea5e
SHA256

40d10e4dc1a4877e5747721c530aba7a7eb679195fdf59df204eaf94a795b15d
SHA512

1f4eddc4079d3c8acd3b07457f08ac4c0d9115cb94f1ad05abf4395e389b514a8cbb58b3d8b8e55c6164ce22d8f58b7b8e37951ce8f62174b6461edea70f45ea
SSDEEP

3072:bRcsogu1PU8hwbY4PzrjOf8F6C58SZpwndH2ZVOCs6033VONvSls:bR/oVZhwvPPjOfIvbds66FONv

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2140	Unicorn-40530.exe
2300	Unicorn-24516.exe
2112	Unicorn-8734.exe
2836	Unicorn-31589.exe
2760	Unicorn-954.exe
2716	Unicorn-7084.exe
2768	Unicorn-40503.exe
2204	Unicorn-31588.exe
2240	Unicorn-63706.exe
2856	Unicorn-43094.exe
2944	Unicorn-55346.exe
1852	Unicorn-55346.exe
1824	Unicorn-31729.exe
752	Unicorn-25863.exe
2148	Unicorn-49077.exe
2224	Unicorn-29939.exe
996	Unicorn-58719.exe
2032	Unicorn-38853.exe
1400	Unicorn-52589.exe
1912	Unicorn-14946.exe
2160	Unicorn-16186.exe
1540	Unicorn-27884.exe
396	Unicorn-40498.exe
1548	Unicorn-60364.exe
1480	Unicorn-24162.exe
1660	Unicorn-44028.exe
864	Unicorn-6509.exe
3040	Unicorn-15439.exe
1940	Unicorn-15439.exe
2508	Unicorn-3882.exe
2540	Unicorn-63554.exe
2800	Unicorn-34381.exe
2732	Unicorn-40171.exe
2904	Unicorn-47785.exe
2588	Unicorn-60400.exe
2664	Unicorn-14728.exe
1700	Unicorn-14728.exe
1952	Unicorn-41463.exe
1584	Unicorn-47593.exe
1984	Unicorn-47328.exe
2120	Unicorn-15283.exe
2072	Unicorn-28097.exe
2952	Unicorn-1162.exe
2176	Unicorn-56856.exe
3060	Unicorn-23821.exe
1180	Unicorn-15268.exe
1840	Unicorn-20422.exe
2996	Unicorn-18583.exe
928	Unicorn-58200.exe
1696	Unicorn-12528.exe
2236	Unicorn-276.exe
1296	Unicorn-45128.exe
2984	Unicorn-32163.exe
1644	Unicorn-42378.exe
1488	Unicorn-25658.exe
1932	Unicorn-54993.exe
2740	Unicorn-9321.exe
2880	Unicorn-37339.exe
2132	Unicorn-46270.exe
2868	Unicorn-5600.exe
1520	Unicorn-60368.exe
1576	Unicorn-38464.exe
1032	Unicorn-10281.exe
1760	Unicorn-39616.exe

Loads dropped DLL 64 IoCs

pid	Process
2084	7183632edfb768b7763bd0b3381131c0N.exe
2084	7183632edfb768b7763bd0b3381131c0N.exe
2140	Unicorn-40530.exe
2140	Unicorn-40530.exe
2084	7183632edfb768b7763bd0b3381131c0N.exe
2084	7183632edfb768b7763bd0b3381131c0N.exe
2112	Unicorn-8734.exe
2112	Unicorn-8734.exe
2084	7183632edfb768b7763bd0b3381131c0N.exe
2300	Unicorn-24516.exe
2084	7183632edfb768b7763bd0b3381131c0N.exe
2300	Unicorn-24516.exe
2140	Unicorn-40530.exe
2140	Unicorn-40530.exe
2836	Unicorn-31589.exe
2112	Unicorn-8734.exe
2836	Unicorn-31589.exe
2112	Unicorn-8734.exe
2768	Unicorn-40503.exe
2716	Unicorn-7084.exe
2760	Unicorn-954.exe
2768	Unicorn-40503.exe
2716	Unicorn-7084.exe
2760	Unicorn-954.exe
2084	7183632edfb768b7763bd0b3381131c0N.exe
2084	7183632edfb768b7763bd0b3381131c0N.exe
2140	Unicorn-40530.exe
2140	Unicorn-40530.exe
2300	Unicorn-24516.exe
2300	Unicorn-24516.exe
2204	Unicorn-31588.exe
2204	Unicorn-31588.exe
2240	Unicorn-63706.exe
2240	Unicorn-63706.exe
2112	Unicorn-8734.exe
2836	Unicorn-31589.exe
2112	Unicorn-8734.exe
2836	Unicorn-31589.exe
2856	Unicorn-43094.exe
2856	Unicorn-43094.exe
2716	Unicorn-7084.exe
2716	Unicorn-7084.exe
1852	Unicorn-55346.exe
1852	Unicorn-55346.exe
2944	Unicorn-55346.exe
2768	Unicorn-40503.exe
2768	Unicorn-40503.exe
2944	Unicorn-55346.exe
2760	Unicorn-954.exe
1824	Unicorn-31729.exe
1824	Unicorn-31729.exe
2760	Unicorn-954.exe
2084	7183632edfb768b7763bd0b3381131c0N.exe
2148	Unicorn-49077.exe
752	Unicorn-25863.exe
2084	7183632edfb768b7763bd0b3381131c0N.exe
2148	Unicorn-49077.exe
752	Unicorn-25863.exe
2300	Unicorn-24516.exe
2140	Unicorn-40530.exe
2140	Unicorn-40530.exe
2300	Unicorn-24516.exe
2224	Unicorn-29939.exe
2224	Unicorn-29939.exe

Program crash 6 IoCs

pid	pid_target	Process	procid_target
2432	528	WerFault.exe	113
4020	3836	WerFault.exe	212
4056	4008	WerFault.exe	223
4528	3760	WerFault.exe	272
4140	2896	WerFault.exe	112
8188	1860	WerFault.exe	145

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39717.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64740.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63486.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7994.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40330.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54986.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35099.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57992.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10107.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15972.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35874.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16428.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31015.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63368.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18877.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58503.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58719.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52728.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52535.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28759.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58200.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54833.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65329.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47785.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2663.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2421.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43683.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39552.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2412.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31588.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25417.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40330.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6889.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59483.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58691.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54106.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-966.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22345.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64684.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-966.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38255.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44337.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24736.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8286.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50488.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16649.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63143.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37339.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11140.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36991.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48148.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52728.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6529.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51843.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48203.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22893.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64684.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32584.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1947.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41348.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4291.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21970.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28602.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19136.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2084	7183632edfb768b7763bd0b3381131c0N.exe
2140	Unicorn-40530.exe
2112	Unicorn-8734.exe
2300	Unicorn-24516.exe
2836	Unicorn-31589.exe
2716	Unicorn-7084.exe
2768	Unicorn-40503.exe
2760	Unicorn-954.exe
2204	Unicorn-31588.exe
2240	Unicorn-63706.exe
2856	Unicorn-43094.exe
1852	Unicorn-55346.exe
2148	Unicorn-49077.exe
1824	Unicorn-31729.exe
2944	Unicorn-55346.exe
752	Unicorn-25863.exe
2224	Unicorn-29939.exe
996	Unicorn-58719.exe
2032	Unicorn-38853.exe
1400	Unicorn-52589.exe
1912	Unicorn-14946.exe
2160	Unicorn-16186.exe
1540	Unicorn-27884.exe
864	Unicorn-6509.exe
1660	Unicorn-44028.exe
396	Unicorn-40498.exe
1480	Unicorn-24162.exe
2508	Unicorn-3882.exe
3040	Unicorn-15439.exe
1940	Unicorn-15439.exe
1548	Unicorn-60364.exe
2540	Unicorn-63554.exe
2800	Unicorn-34381.exe
2732	Unicorn-40171.exe
2904	Unicorn-47785.exe
2664	Unicorn-14728.exe
1584	Unicorn-47593.exe
1952	Unicorn-41463.exe
2588	Unicorn-60400.exe
1700	Unicorn-14728.exe
1984	Unicorn-47328.exe
2120	Unicorn-15283.exe
2072	Unicorn-28097.exe
2952	Unicorn-1162.exe
1180	Unicorn-15268.exe
3060	Unicorn-23821.exe
2176	Unicorn-56856.exe
1840	Unicorn-20422.exe
2996	Unicorn-18583.exe
2236	Unicorn-276.exe
928	Unicorn-58200.exe
2984	Unicorn-32163.exe
1696	Unicorn-12528.exe
1296	Unicorn-45128.exe
1644	Unicorn-42378.exe
1488	Unicorn-25658.exe
1932	Unicorn-54993.exe
2132	Unicorn-46270.exe
2740	Unicorn-9321.exe
2880	Unicorn-37339.exe
2868	Unicorn-5600.exe
1520	Unicorn-60368.exe
1576	Unicorn-38464.exe
1032	Unicorn-10281.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2084 wrote to memory of 2140	2084	7183632edfb768b7763bd0b3381131c0N.exe	31
PID 2084 wrote to memory of 2140	2084	7183632edfb768b7763bd0b3381131c0N.exe	31
PID 2084 wrote to memory of 2140	2084	7183632edfb768b7763bd0b3381131c0N.exe	31
PID 2084 wrote to memory of 2140	2084	7183632edfb768b7763bd0b3381131c0N.exe	31
PID 2140 wrote to memory of 2300	2140	Unicorn-40530.exe	32
PID 2140 wrote to memory of 2300	2140	Unicorn-40530.exe	32
PID 2140 wrote to memory of 2300	2140	Unicorn-40530.exe	32
PID 2140 wrote to memory of 2300	2140	Unicorn-40530.exe	32
PID 2084 wrote to memory of 2112	2084	7183632edfb768b7763bd0b3381131c0N.exe	33
PID 2084 wrote to memory of 2112	2084	7183632edfb768b7763bd0b3381131c0N.exe	33
PID 2084 wrote to memory of 2112	2084	7183632edfb768b7763bd0b3381131c0N.exe	33
PID 2084 wrote to memory of 2112	2084	7183632edfb768b7763bd0b3381131c0N.exe	33
PID 2112 wrote to memory of 2836	2112	Unicorn-8734.exe	34
PID 2112 wrote to memory of 2836	2112	Unicorn-8734.exe	34
PID 2112 wrote to memory of 2836	2112	Unicorn-8734.exe	34
PID 2112 wrote to memory of 2836	2112	Unicorn-8734.exe	34
PID 2084 wrote to memory of 2760	2084	7183632edfb768b7763bd0b3381131c0N.exe	35
PID 2084 wrote to memory of 2760	2084	7183632edfb768b7763bd0b3381131c0N.exe	35
PID 2084 wrote to memory of 2760	2084	7183632edfb768b7763bd0b3381131c0N.exe	35
PID 2084 wrote to memory of 2760	2084	7183632edfb768b7763bd0b3381131c0N.exe	35
PID 2300 wrote to memory of 2716	2300	Unicorn-24516.exe	36
PID 2300 wrote to memory of 2716	2300	Unicorn-24516.exe	36
PID 2300 wrote to memory of 2716	2300	Unicorn-24516.exe	36
PID 2300 wrote to memory of 2716	2300	Unicorn-24516.exe	36
PID 2140 wrote to memory of 2768	2140	Unicorn-40530.exe	37
PID 2140 wrote to memory of 2768	2140	Unicorn-40530.exe	37
PID 2140 wrote to memory of 2768	2140	Unicorn-40530.exe	37
PID 2140 wrote to memory of 2768	2140	Unicorn-40530.exe	37
PID 2836 wrote to memory of 2240	2836	Unicorn-31589.exe	38
PID 2836 wrote to memory of 2240	2836	Unicorn-31589.exe	38
PID 2836 wrote to memory of 2240	2836	Unicorn-31589.exe	38
PID 2836 wrote to memory of 2240	2836	Unicorn-31589.exe	38
PID 2112 wrote to memory of 2204	2112	Unicorn-8734.exe	39
PID 2112 wrote to memory of 2204	2112	Unicorn-8734.exe	39
PID 2112 wrote to memory of 2204	2112	Unicorn-8734.exe	39
PID 2112 wrote to memory of 2204	2112	Unicorn-8734.exe	39
PID 2768 wrote to memory of 1852	2768	Unicorn-40503.exe	40
PID 2768 wrote to memory of 1852	2768	Unicorn-40503.exe	40
PID 2768 wrote to memory of 1852	2768	Unicorn-40503.exe	40
PID 2768 wrote to memory of 1852	2768	Unicorn-40503.exe	40
PID 2716 wrote to memory of 2856	2716	Unicorn-7084.exe	41
PID 2716 wrote to memory of 2856	2716	Unicorn-7084.exe	41
PID 2716 wrote to memory of 2856	2716	Unicorn-7084.exe	41
PID 2716 wrote to memory of 2856	2716	Unicorn-7084.exe	41
PID 2760 wrote to memory of 2944	2760	Unicorn-954.exe	42
PID 2760 wrote to memory of 2944	2760	Unicorn-954.exe	42
PID 2760 wrote to memory of 2944	2760	Unicorn-954.exe	42
PID 2760 wrote to memory of 2944	2760	Unicorn-954.exe	42
PID 2084 wrote to memory of 1824	2084	7183632edfb768b7763bd0b3381131c0N.exe	43
PID 2084 wrote to memory of 1824	2084	7183632edfb768b7763bd0b3381131c0N.exe	43
PID 2084 wrote to memory of 1824	2084	7183632edfb768b7763bd0b3381131c0N.exe	43
PID 2084 wrote to memory of 1824	2084	7183632edfb768b7763bd0b3381131c0N.exe	43
PID 2140 wrote to memory of 752	2140	Unicorn-40530.exe	44
PID 2140 wrote to memory of 752	2140	Unicorn-40530.exe	44
PID 2140 wrote to memory of 752	2140	Unicorn-40530.exe	44
PID 2140 wrote to memory of 752	2140	Unicorn-40530.exe	44
PID 2300 wrote to memory of 2148	2300	Unicorn-24516.exe	45
PID 2300 wrote to memory of 2148	2300	Unicorn-24516.exe	45
PID 2300 wrote to memory of 2148	2300	Unicorn-24516.exe	45
PID 2300 wrote to memory of 2148	2300	Unicorn-24516.exe	45
PID 2204 wrote to memory of 2224	2204	Unicorn-31588.exe	46
PID 2204 wrote to memory of 2224	2204	Unicorn-31588.exe	46
PID 2204 wrote to memory of 2224	2204	Unicorn-31588.exe	46
PID 2204 wrote to memory of 2224	2204	Unicorn-31588.exe	46

C:\Users\Admin\AppData\Local\Temp\7183632edfb768b7763bd0b3381131c0N.exe
"C:\Users\Admin\AppData\Local\Temp\7183632edfb768b7763bd0b3381131c0N.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2084
- C:\Users\Admin\AppData\Local\Temp\Unicorn-40530.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-40530.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2140
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24516.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24516.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7084.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7084.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43094.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:2856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14946.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47593.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3374.exe
        8⤵
        
        PID:1924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33300.exe
        9⤵
        
        PID:4416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5640.exe
        9⤵
        
        PID:6068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9814.exe
        9⤵
        
        PID:6488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5006.exe
        9⤵
        
        PID:7816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40470.exe
        8⤵
        
        PID:2444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12754.exe
        8⤵
        
        PID:3368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21233.exe
        8⤵
        
        PID:4408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7837.exe
        8⤵
        
        PID:5352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50559.exe
        8⤵
        
        PID:6864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49682.exe
        8⤵
        
        PID:7904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46306.exe
        7⤵
        
        PID:2888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14887.exe
        8⤵
        
        PID:4028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58005.exe
        8⤵
        
        PID:4708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1120.exe
        8⤵
        
        PID:5744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64684.exe
        8⤵
        
        PID:6148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56883.exe
        8⤵
        
        PID:7192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58098.exe
        7⤵
        
        PID:2708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64949.exe
        7⤵
        
        PID:3268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20093.exe
        7⤵
        
        PID:4308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41456.exe
        7⤵
        
        PID:5892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10668.exe
        7⤵
        
        PID:6392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65329.exe
        7⤵
        
        PID:7440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15283.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64142.exe
        7⤵
        
        PID:1944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7056.exe
        8⤵
        
        PID:932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44042.exe
        9⤵
        
        PID:4356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47057.exe
        9⤵
        
        PID:5828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1947.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:5316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16546.exe
        9⤵
        
        PID:6852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24736.exe
        8⤵
        
        PID:3240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22893.exe
        8⤵
        
        PID:4944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1120.exe
        8⤵
        
        PID:5692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64684.exe
        8⤵
        
        PID:6316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56883.exe
        8⤵
        
        PID:6436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52728.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14643.exe
        8⤵
        
        PID:2268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24736.exe
        8⤵
        
        PID:3244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22893.exe
        8⤵
        
        PID:5016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1120.exe
        8⤵
        
        PID:5956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64684.exe
        8⤵
        
        PID:6308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56883.exe
        8⤵
        
        PID:7336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28933.exe
        7⤵
        
        PID:1964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44337.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20093.exe
        7⤵
        
        PID:4320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35300.exe
        7⤵
        
        PID:5572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3284.exe
        7⤵
        
        PID:7160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36807.exe
        7⤵
        
        PID:8148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45760.exe
        6⤵
        
        PID:2020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35874.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42038.exe
        7⤵
        
        PID:5156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35764.exe
        7⤵
        
        PID:4604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14387.exe
        7⤵
        
        PID:6760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48203.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53091.exe
        6⤵
        
        PID:3400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6529.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51843.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45032.exe
        6⤵
        
        PID:7104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16186.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28097.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29031.exe
        7⤵
        
        PID:2896
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2896 -s 240
        8⤵
        Program crash
        
        PID:4140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17995.exe
        7⤵
        
        PID:1856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6889.exe
        7⤵
        
        PID:3692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18748.exe
        7⤵
        
        PID:4136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23477.exe
        7⤵
        
        PID:6020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16649.exe
        7⤵
        
        PID:6648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43876.exe
        7⤵
        
        PID:7544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45922.exe
        6⤵
        
        PID:1992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31084.exe
        7⤵
        
        PID:4620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11016.exe
        7⤵
        
        PID:908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10107.exe
        7⤵
        
        PID:5528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14496.exe
        7⤵
        
        PID:7120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60319.exe
        6⤵
        
        PID:1500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12754.exe
        6⤵
        
        PID:3384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10083.exe
        6⤵
        
        PID:4292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6942.exe
        6⤵
        
        PID:6000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33715.exe
        6⤵
        
        PID:6616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22345.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1162.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27879.exe
        6⤵
        
        PID:2840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49568.exe
        7⤵
        
        PID:788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32473.exe
        8⤵
        
        PID:6536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27319.exe
        8⤵
        
        PID:7704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38472.exe
        7⤵
        
        PID:3796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28759.exe
        7⤵
        
        PID:4236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57992.exe
        7⤵
        
        PID:5720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48148.exe
        7⤵
        
        PID:6156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20663.exe
        7⤵
        
        PID:6696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29702.exe
        6⤵
        
        PID:2612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8748.exe
        7⤵
        
        PID:3204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20092.exe
        7⤵
        
        PID:4324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61119.exe
        7⤵
        
        PID:5464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39717.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23101.exe
        7⤵
        
        PID:7148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28217.exe
        6⤵
        
        PID:3752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17867.exe
        7⤵
        
        PID:4640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47057.exe
        7⤵
        
        PID:5812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16338.exe
        7⤵
        
        PID:6956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38255.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34457.exe
        6⤵
        
        PID:4960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65226.exe
        6⤵
        
        PID:4568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31390.exe
        6⤵
        
        PID:6140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2101.exe
        6⤵
        
        PID:6976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57738.exe
        5⤵
        
        PID:1636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-912.exe
        6⤵
        
        PID:3052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58691.exe
        6⤵
        
        PID:3760
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3760 -s 188
        7⤵
        Program crash
        
        PID:4528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8799.exe
        6⤵
        
        PID:4452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15972.exe
        6⤵
        
        PID:5440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6023.exe
        6⤵
        
        PID:6896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59483.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55298.exe
        5⤵
        
        PID:2500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39748.exe
        5⤵
        
        PID:3292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20623.exe
        5⤵
        
        PID:5020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36991.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38348.exe
        5⤵
        
        PID:6008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63535.exe
        5⤵
        
        PID:6636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49077.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49077.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15439.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20422.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62855.exe
        7⤵
        
        PID:1572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18877.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9857.exe
        8⤵
        
        PID:7456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44337.exe
        7⤵
        
        PID:3100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20093.exe
        7⤵
        
        PID:4316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41456.exe
        7⤵
        
        PID:5804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10668.exe
        7⤵
        
        PID:6408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65329.exe
        7⤵
        
        PID:7412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21993.exe
        6⤵
        
        PID:1816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5469.exe
        7⤵
        
        PID:5604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28367.exe
        7⤵
        
        PID:5140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22933.exe
        7⤵
        
        PID:6684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3718.exe
        6⤵
        
        PID:2688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4202.exe
        6⤵
        
        PID:4052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10083.exe
        6⤵
        
        PID:4152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64311.exe
        6⤵
        
        PID:6092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33715.exe
        6⤵
        
        PID:6640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22345.exe
        6⤵
        
        PID:7580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58200.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35528.exe
        6⤵
        
        PID:1588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18737.exe
        7⤵
        
        PID:6888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40330.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3836
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3836 -s 148
        7⤵
        Program crash
        
        PID:4020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63870.exe
        6⤵
        
        PID:4700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57992.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48148.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20663.exe
        6⤵
        
        PID:6952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50970.exe
        5⤵
        
        PID:2748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54227.exe
        6⤵
        
        PID:7548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59931.exe
        5⤵
        
        PID:3892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50488.exe
        5⤵
        
        PID:5060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52775.exe
        5⤵
        
        PID:5008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33494.exe
        5⤵
        
        PID:5152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50258.exe
        5⤵
        
        PID:6776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63554.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63554.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12528.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49568.exe
        6⤵
        
        PID:2372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33423.exe
        7⤵
        
        PID:7584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38472.exe
        6⤵
        
        PID:3916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28759.exe
        6⤵
        
        PID:4212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57992.exe
        6⤵
        
        PID:5908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48148.exe
        6⤵
        
        PID:6172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20663.exe
        6⤵
        
        PID:6456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31159.exe
        5⤵
        
        PID:840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28057.exe
        6⤵
        
        PID:7136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44337.exe
        5⤵
        
        PID:3184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20093.exe
        5⤵
        
        PID:4344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41456.exe
        5⤵
        
        PID:5924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10668.exe
        5⤵
        
        PID:6416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65329.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7432
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45128.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45128.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7056.exe
        5⤵
        
        PID:1312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14482.exe
        6⤵
        
        PID:3808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53288.exe
        6⤵
        
        PID:4016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57992.exe
        6⤵
        
        PID:5964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48148.exe
        6⤵
        
        PID:6180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20663.exe
        6⤵
        
        PID:6576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19531.exe
        5⤵
        
        PID:3352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33251.exe
        5⤵
        
        PID:4884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8354.exe
        5⤵
        
        PID:4128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32963.exe
        5⤵
        
        PID:5208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54724.exe
        5⤵
        
        PID:6820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28359.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28359.exe
      4⤵
      PID:2988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19136.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19136.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20623.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20623.exe
      4⤵
      PID:4160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36991.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36991.exe
      4⤵
      PID:5940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38348.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38348.exe
      4⤵
      PID:924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63535.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63535.exe
      4⤵
      PID:6544
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40503.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40503.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55346.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55346.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:1852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27884.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25658.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11140.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15079.exe
        8⤵
        
        PID:3844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39552.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14357.exe
        8⤵
        
        PID:5324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55285.exe
        8⤵
        
        PID:5172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23101.exe
        8⤵
        
        PID:6940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14482.exe
        7⤵
        
        PID:3928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53288.exe
        7⤵
        
        PID:5084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57992.exe
        7⤵
        
        PID:5760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48148.exe
        7⤵
        
        PID:6216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8411.exe
        7⤵
        
        PID:7200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1088.exe
        6⤵
        
        PID:2520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21970.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65083.exe
        7⤵
        
        PID:7780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38472.exe
        6⤵
        
        PID:3948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28759.exe
        6⤵
        
        PID:4260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57992.exe
        6⤵
        
        PID:5844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48148.exe
        6⤵
        
        PID:6188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20663.exe
        6⤵
        
        PID:6560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5600.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26704.exe
        6⤵
        
        PID:1988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24736.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22893.exe
        6⤵
        
        PID:4924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1120.exe
        6⤵
        
        PID:5780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64684.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48714.exe
        6⤵
        
        PID:7304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35685.exe
        5⤵
        
        PID:688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44337.exe
        5⤵
        
        PID:3116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20093.exe
        5⤵
        
        PID:4364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41456.exe
        5⤵
        
        PID:5860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65214.exe
        5⤵
        
        PID:5288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64670.exe
        5⤵
        
        PID:7004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40498.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40498.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9321.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52728.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15079.exe
        7⤵
        
        PID:3852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60684.exe
        7⤵
        
        PID:4660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34769.exe
        7⤵
        
        PID:5540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7749.exe
        7⤵
        
        PID:6348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63673.exe
        7⤵
        
        PID:8132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44337.exe
        6⤵
        
        PID:3192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20093.exe
        6⤵
        
        PID:4380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41456.exe
        6⤵
        
        PID:5852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10668.exe
        6⤵
        
        PID:6424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65329.exe
        6⤵
        
        PID:7424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32190.exe
        5⤵
        
        PID:1396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33023.exe
        6⤵
        
        PID:6476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55955.exe
        6⤵
        
        PID:7284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52535.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8286.exe
        5⤵
        
        PID:3264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55200.exe
        5⤵
        
        PID:2420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56309.exe
        5⤵
        
        PID:5624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2101.exe
        5⤵
        
        PID:6404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60368.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60368.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46553.exe
        5⤵
        
        PID:2272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8736.exe
        6⤵
        
        PID:6728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33701.exe
        6⤵
        
        PID:7660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38472.exe
        5⤵
        
        PID:3784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28759.exe
        5⤵
        
        PID:4164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18234.exe
        5⤵
        
        PID:5552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24814.exe
        5⤵
        
        PID:6332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42142.exe
        5⤵
        
        PID:8168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6791.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6791.exe
      4⤵
      PID:1860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16381.exe
        5⤵
        
        PID:6692
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1860 -s 236
        5⤵
        Program crash
        
        PID:8188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35671.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35671.exe
      4⤵
      PID:3980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3558.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3558.exe
      4⤵
      PID:4132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58522.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58522.exe
      4⤵
      PID:5684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43683.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43683.exe
      4⤵
      PID:5988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59334.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59334.exe
      4⤵
      PID:6580
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25863.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25863.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15439.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15439.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29585.exe
        5⤵
        
        PID:2356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58151.exe
        6⤵
        
        PID:1552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24736.exe
        6⤵
        
        PID:4068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22893.exe
        6⤵
        
        PID:4996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1120.exe
        6⤵
        
        PID:5700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64684.exe
        6⤵
        
        PID:6300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48714.exe
        6⤵
        
        PID:7312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2628.exe
        5⤵
        
        PID:2332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44337.exe
        5⤵
        
        PID:3148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20093.exe
        5⤵
        
        PID:4292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44035.exe
        5⤵
        
        PID:4932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52980.exe
        5⤵
        
        PID:5796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41348.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33730.exe
        5⤵
        
        PID:7484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54993.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54993.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52056.exe
        5⤵
        
        PID:1668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9361.exe
        6⤵
        
        PID:6024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64740.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23592.exe
        6⤵
        
        PID:7396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38799.exe
        5⤵
        
        PID:3284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63874.exe
        5⤵
        
        PID:3988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18748.exe
        5⤵
        
        PID:4280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23477.exe
        5⤵
        
        PID:6012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16649.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43876.exe
        5⤵
        
        PID:7532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5085.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5085.exe
      4⤵
      PID:1936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30906.exe
        5⤵
        
        PID:6432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21118.exe
        5⤵
        
        PID:8080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6646.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6646.exe
      4⤵
      PID:3868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50488.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50488.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15634.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15634.exe
      4⤵
      PID:5256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37578.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37578.exe
      4⤵
      PID:5368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50258.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50258.exe
      4⤵
      PID:6808
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3882.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3882.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42378.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42378.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49568.exe
        5⤵
        
        PID:1320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33215.exe
        6⤵
        
        PID:6384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52208.exe
        6⤵
        
        PID:8084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14482.exe
        5⤵
        
        PID:3920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53288.exe
        5⤵
        
        PID:5104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8354.exe
        5⤵
        
        PID:4404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14324.exe
        5⤵
        
        PID:6048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23631.exe
        5⤵
        
        PID:7072
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31159.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31159.exe
      4⤵
      PID:1072
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44337.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44337.exe
      4⤵
      PID:3152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39202.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39202.exe
      4⤵
      PID:4412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7648.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7648.exe
      4⤵
      PID:5144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-966.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-966.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7036
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37339.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37339.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2663.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2663.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27922.exe
        5⤵
        
        PID:5272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12166.exe
        5⤵
        
        PID:7008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40330.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40330.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4008
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4008 -s 148
        5⤵
        Program crash
        
        PID:4056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53288.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53288.exe
      4⤵
      PID:3768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40835.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40835.exe
      4⤵
      PID:5240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37047.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37047.exe
      4⤵
      PID:5348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54724.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54724.exe
      4⤵
      PID:6772
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43886.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43886.exe
    3⤵
    PID:2960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20488.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20488.exe
      4⤵
      PID:5356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35684.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35684.exe
      4⤵
      PID:4900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25901.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25901.exe
      4⤵
      PID:6360
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51796.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51796.exe
    3⤵
    PID:3876
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29487.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29487.exe
    3⤵
    PID:5048
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38890.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38890.exe
    3⤵
    PID:4768
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10828.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10828.exe
    3⤵
    PID:5228
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21388.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21388.exe
    3⤵
    PID:6708
- C:\Users\Admin\AppData\Local\Temp\Unicorn-8734.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-8734.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2112
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31589.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31589.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63706.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63706.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58719.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47785.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5102.exe
        7⤵
        
        PID:1124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30316.exe
        8⤵
        
        PID:4172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11208.exe
        8⤵
        
        PID:4992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10107.exe
        8⤵
        
        PID:5524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23101.exe
        8⤵
        
        PID:7132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55520.exe
        7⤵
        
        PID:2720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55706.exe
        7⤵
        
        PID:4116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2412.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7307.exe
        7⤵
        
        PID:6004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46472.exe
        7⤵
        
        PID:6552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32584.exe
        7⤵
        
        PID:8104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34245.exe
        6⤵
        
        PID:1704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57911.exe
        7⤵
        
        PID:7080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52208.exe
        7⤵
        
        PID:8096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23946.exe
        6⤵
        
        PID:3164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4202.exe
        6⤵
        
        PID:4000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10083.exe
        6⤵
        
        PID:4288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60227.exe
        6⤵
        
        PID:6056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33715.exe
        6⤵
        
        PID:6608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22345.exe
        6⤵
        
        PID:7568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60400.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60250.exe
        6⤵
        
        PID:1236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53865.exe
        7⤵
        
        PID:3228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28068.exe
        7⤵
        
        PID:4384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60792.exe
        7⤵
        
        PID:5884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7812.exe
        7⤵
        
        PID:6200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20133.exe
        7⤵
        
        PID:6656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31342.exe
        6⤵
        
        PID:2972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38472.exe
        6⤵
        
        PID:3804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28759.exe
        6⤵
        
        PID:4244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18234.exe
        6⤵
        
        PID:5616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4291.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58012.exe
        5⤵
        
        PID:1332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62023.exe
        6⤵
        
        PID:4516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47057.exe
        6⤵
        
        PID:5972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1947.exe
        6⤵
        
        PID:6276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8378.exe
        6⤵
        
        PID:7364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48203.exe
        5⤵
        
        PID:1620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35671.exe
        5⤵
        
        PID:3972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3558.exe
        5⤵
        
        PID:4872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58522.exe
        5⤵
        
        PID:5916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43683.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59334.exe
        5⤵
        
        PID:6672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38853.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38853.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14728.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39638.exe
        6⤵
        
        PID:1592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55396.exe
        7⤵
        
        PID:4652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27544.exe
        7⤵
        
        PID:2004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10107.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23101.exe
        7⤵
        
        PID:7116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28602.exe
        6⤵
        
        PID:2348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38472.exe
        6⤵
        
        PID:3776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28759.exe
        6⤵
        
        PID:3316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57992.exe
        6⤵
        
        PID:5708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48148.exe
        6⤵
        
        PID:6240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8411.exe
        6⤵
        
        PID:7208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8013.exe
        5⤵
        
        PID:1632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33300.exe
        6⤵
        
        PID:4428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5640.exe
        6⤵
        
        PID:6080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9814.exe
        6⤵
        
        PID:6496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4953.exe
        6⤵
        
        PID:7500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54206.exe
        5⤵
        
        PID:1648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44337.exe
        5⤵
        
        PID:3136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35099.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35300.exe
        5⤵
        
        PID:5564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3284.exe
        5⤵
        
        PID:5248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36807.exe
        5⤵
        
        PID:8160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41463.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41463.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56166.exe
        5⤵
        
        PID:1536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60336.exe
        6⤵
        
        PID:2260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6889.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63865.exe
        6⤵
        
        PID:4808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7307.exe
        6⤵
        
        PID:5792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46472.exe
        6⤵
        
        PID:6516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32584.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33266.exe
        5⤵
        
        PID:3344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39117.exe
        5⤵
        
        PID:4876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65226.exe
        5⤵
        
        PID:4680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31390.exe
        5⤵
        
        PID:5344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2101.exe
        5⤵
        
        PID:6340
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59985.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59985.exe
      4⤵
      PID:596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13548.exe
        5⤵
        
        PID:3248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54223.exe
        5⤵
        
        PID:3684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62084.exe
        5⤵
        
        PID:4580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15972.exe
        5⤵
        
        PID:5492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6023.exe
        5⤵
        
        PID:6920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59483.exe
        5⤵
        
        PID:7744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42278.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42278.exe
      4⤵
      PID:1008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4619.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4619.exe
      4⤵
      PID:3688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38283.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38283.exe
      4⤵
      PID:4472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46508.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46508.exe
      4⤵
      PID:5420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49424.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49424.exe
      4⤵
      PID:3044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26147.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26147.exe
      4⤵
      PID:7732
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31588.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31588.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29939.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29939.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34381.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10281.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47897.exe
        7⤵
        
        PID:2504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34348.exe
        8⤵
        
        PID:3860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39552.exe
        8⤵
        
        PID:5112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6573.exe
        8⤵
        
        PID:3048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41629.exe
        8⤵
        
        PID:5192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5722.exe
        8⤵
        
        PID:6900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38472.exe
        7⤵
        
        PID:3728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28759.exe
        7⤵
        
        PID:4228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57992.exe
        7⤵
        
        PID:5736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48148.exe
        7⤵
        
        PID:6232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-243.exe
        7⤵
        
        PID:7296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11861.exe
        6⤵
        
        PID:1676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38472.exe
        6⤵
        
        PID:3820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28759.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57992.exe
        6⤵
        
        PID:5728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48148.exe
        6⤵
        
        PID:4744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20663.exe
        6⤵
        
        PID:6800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39616.exe
        5⤵
        Executes dropped EXE
        
        PID:1760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14685.exe
        6⤵
        
        PID:4844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54291.exe
        6⤵
        
        PID:2096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35764.exe
        6⤵
        
        PID:5128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14387.exe
        6⤵
        
        PID:6844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4429.exe
        5⤵
        
        PID:2928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44337.exe
        5⤵
        
        PID:3084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20093.exe
        5⤵
        
        PID:4332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41456.exe
        5⤵
        
        PID:5900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64270.exe
        5⤵
        
        PID:6992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11919.exe
        5⤵
        
        PID:7684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40171.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40171.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34402.exe
        5⤵
        
        PID:2044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21247.exe
        6⤵
        
        PID:1324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48126.exe
        7⤵
        
        PID:4300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35323.exe
        7⤵
        
        PID:5404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16363.exe
        7⤵
        
        PID:5276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31767.exe
        7⤵
        
        PID:7024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43267.exe
        6⤵
        
        PID:3124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64834.exe
        6⤵
        
        PID:4200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42045.exe
        6⤵
        
        PID:1736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37040.exe
        6⤵
        
        PID:6132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22972.exe
        6⤵
        
        PID:6584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32190.exe
        5⤵
        
        PID:1056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37861.exe
        6⤵
        
        PID:2804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59079.exe
        6⤵
        
        PID:4732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54986.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7307.exe
        6⤵
        
        PID:5460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55025.exe
        6⤵
        
        PID:6880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11011.exe
        6⤵
        
        PID:7852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7994.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8286.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25509.exe
        5⤵
        
        PID:2092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54106.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1442.exe
        5⤵
        
        PID:6604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52776.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52776.exe
      4⤵
      PID:1064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27706.exe
        5⤵
        
        PID:4248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33486.exe
        5⤵
        
        PID:5220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35764.exe
        5⤵
        
        PID:4692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14387.exe
        5⤵
        
        PID:6840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30715.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30715.exe
      4⤵
      PID:2820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35671.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35671.exe
      4⤵
      PID:3748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48081.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48081.exe
      4⤵
      PID:4740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13769.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13769.exe
      4⤵
      PID:5580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63486.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63486.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49175.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49175.exe
      4⤵
      PID:8036
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52589.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52589.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1400
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14728.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14728.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31086.exe
        5⤵
        
        PID:2344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59091.exe
        6⤵
        
        PID:4588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47057.exe
        6⤵
        
        PID:5980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1947.exe
        6⤵
        
        PID:6260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28799.exe
        6⤵
        
        PID:6508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28602.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38472.exe
        5⤵
        
        PID:3704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28759.exe
        5⤵
        
        PID:4220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57992.exe
        5⤵
        
        PID:5772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48148.exe
        5⤵
        
        PID:6208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20663.exe
        5⤵
        
        PID:6788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41069.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41069.exe
      4⤵
      PID:2876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10559.exe
        5⤵
        
        PID:2936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24736.exe
        5⤵
        
        PID:3212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22893.exe
        5⤵
        
        PID:5032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34769.exe
        5⤵
        
        PID:5548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7749.exe
        5⤵
        
        PID:6256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63673.exe
        5⤵
        
        PID:8140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20573.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20573.exe
      4⤵
      PID:2968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44337.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44337.exe
      4⤵
      PID:2668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35118.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35118.exe
      4⤵
      PID:4392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7648.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7648.exe
      4⤵
      PID:5148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-966.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-966.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7056
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47328.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47328.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29031.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29031.exe
      4⤵
      PID:528
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 528 -s 240
        5⤵
        Program crash
        
        PID:2432
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16521.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16521.exe
      4⤵
      PID:2548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38472.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38472.exe
      4⤵
      PID:3956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28759.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28759.exe
      4⤵
      PID:4268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57992.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57992.exe
      4⤵
      PID:5820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48148.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48148.exe
      4⤵
      PID:6164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20663.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20663.exe
      4⤵
      PID:6524
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52773.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52773.exe
    3⤵
    PID:1672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53917.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53917.exe
      4⤵
      PID:4796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35385.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35385.exe
      4⤵
      PID:4760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10107.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10107.exe
      4⤵
      PID:5384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14688.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14688.exe
      4⤵
      PID:6936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10481.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10481.exe
      4⤵
      PID:7872
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40983.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40983.exe
    3⤵
    PID:2388
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53436.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53436.exe
    3⤵
    PID:2488
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42367.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42367.exe
    3⤵
    PID:1744
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46508.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46508.exe
    3⤵
    PID:5716
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40872.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40872.exe
    3⤵
    PID:6472
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47719.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47719.exe
    3⤵
    PID:8072
- C:\Users\Admin\AppData\Local\Temp\Unicorn-954.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-954.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2760
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55346.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55346.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60364.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60364.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46270.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41859.exe
        6⤵
        
        PID:372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50236.exe
        7⤵
        
        PID:7028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15067.exe
        7⤵
        
        PID:7788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55520.exe
        6⤵
        
        PID:984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29740.exe
        7⤵
        
        PID:4476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6932.exe
        7⤵
        
        PID:4544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10107.exe
        7⤵
        
        PID:5452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23101.exe
        7⤵
        
        PID:7140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48416.exe
        6⤵
        
        PID:4752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46321.exe
        6⤵
        
        PID:4860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56309.exe
        6⤵
        
        PID:5312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6361.exe
        6⤵
        
        PID:7144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55017.exe
        6⤵
        
        PID:7740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1381.exe
        5⤵
        
        PID:2516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61995.exe
        6⤵
        
        PID:7088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64460.exe
        6⤵
        
        PID:8052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52919.exe
        5⤵
        
        PID:3088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4202.exe
        5⤵
        
        PID:4084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5999.exe
        5⤵
        
        PID:4484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56309.exe
        5⤵
        
        PID:5412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6553.exe
        5⤵
        
        PID:6912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55017.exe
        5⤵
        
        PID:7772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38464.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38464.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60336.exe
        5⤵
        
        PID:1624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12484.exe
        5⤵
        
        PID:4036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22893.exe
        5⤵
        
        PID:4780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1120.exe
        5⤵
        
        PID:5932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64684.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48714.exe
        5⤵
        
        PID:7352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2628.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2628.exe
      4⤵
      PID:1656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44337.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44337.exe
      4⤵
      PID:3188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31015.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31015.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27132.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27132.exe
      4⤵
      PID:5628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3284.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3284.exe
      4⤵
      PID:7152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8842.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8842.exe
      4⤵
      PID:7604
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24162.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24162.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1480
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-276.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-276.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62855.exe
        5⤵
        
        PID:3068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2490.exe
        6⤵
        
        PID:4776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37570.exe
        6⤵
        
        PID:5596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32950.exe
        6⤵
        
        PID:5176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63143.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1083.exe
        5⤵
        
        PID:1612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2421.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2412.exe
        5⤵
        
        PID:4540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7307.exe
        5⤵
        
        PID:5660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54833.exe
        5⤵
        
        PID:7016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11011.exe
        5⤵
        
        PID:7756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5849.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5849.exe
      4⤵
      PID:2180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23646.exe
        5⤵
        
        PID:5680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8082.exe
        5⤵
        
        PID:7000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34083.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34083.exe
      4⤵
      PID:3740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25791.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25791.exe
      4⤵
      PID:4952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48690.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48690.exe
      4⤵
      PID:4508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9859.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9859.exe
      4⤵
      PID:6104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62303.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62303.exe
      4⤵
      PID:6368
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32163.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32163.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52728.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52728.exe
      4⤵
      PID:1692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30077.exe
        5⤵
        
        PID:3176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54223.exe
        5⤵
        
        PID:3312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58000.exe
        5⤵
        
        PID:4804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15972.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5831.exe
        5⤵
        
        PID:7096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59483.exe
        5⤵
        
        PID:7804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54066.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54066.exe
      4⤵
      PID:3884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59153.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59153.exe
      4⤵
      PID:5092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65226.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65226.exe
      4⤵
      PID:4720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16428.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16428.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6252.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6252.exe
      4⤵
      PID:6784
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49303.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49303.exe
    3⤵
    PID:2772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62023.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62023.exe
      4⤵
      PID:4492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47057.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47057.exe
      4⤵
      PID:5836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1947.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1947.exe
      4⤵
      PID:6268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16546.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16546.exe
      4⤵
      PID:7176
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25417.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25417.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3696
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9256.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9256.exe
    3⤵
    PID:4976
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-219.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-219.exe
    3⤵
    PID:2192
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11963.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11963.exe
    3⤵
    PID:5200
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44923.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44923.exe
    3⤵
    PID:6700
- C:\Users\Admin\AppData\Local\Temp\Unicorn-31729.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-31729.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:1824
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44028.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44028.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23821.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23821.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49568.exe
        5⤵
        
        PID:1724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37861.exe
        6⤵
        
        PID:536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59079.exe
        6⤵
        
        PID:4724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54986.exe
        6⤵
        
        PID:4868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7307.exe
        6⤵
        
        PID:5504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54833.exe
        6⤵
        
        PID:7048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11011.exe
        6⤵
        
        PID:7828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59796.exe
        5⤵
        
        PID:2756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2421.exe
        5⤵
        
        PID:3324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2412.exe
        5⤵
        
        PID:4564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7307.exe
        5⤵
        
        PID:5672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54833.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11011.exe
        5⤵
        
        PID:7860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52728.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52728.exe
      4⤵
      PID:3000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24736.exe
        5⤵
        
        PID:3220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22893.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1120.exe
        5⤵
        
        PID:5948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64684.exe
        5⤵
        
        PID:6324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48714.exe
        5⤵
        
        PID:7344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44337.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44337.exe
      4⤵
      PID:3120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20093.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20093.exe
      4⤵
      PID:4352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41456.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41456.exe
      4⤵
      PID:5868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8001.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8001.exe
      4⤵
      PID:6664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53882.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53882.exe
      4⤵
      PID:7868
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56856.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56856.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49568.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49568.exe
      4⤵
      PID:844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58503.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38472.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38472.exe
      4⤵
      PID:3824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28759.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28759.exe
      4⤵
      PID:4188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7837.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7837.exe
      4⤵
      PID:5396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50559.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50559.exe
      4⤵
      PID:6856
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43438.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43438.exe
    3⤵
    PID:2624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13936.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13936.exe
      4⤵
      PID:7844
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34083.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34083.exe
    3⤵
    PID:3732
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25791.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25791.exe
    3⤵
    PID:4968
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48690.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48690.exe
    3⤵
    PID:4108
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33494.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33494.exe
    3⤵
    PID:5184
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50258.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50258.exe
    3⤵
    PID:6816
- C:\Users\Admin\AppData\Local\Temp\Unicorn-6509.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-6509.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:864
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15268.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15268.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57427.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57427.exe
      4⤵
      PID:2104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12353.exe
        5⤵
        
        PID:6120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9198.exe
        5⤵
        
        PID:6568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50476.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50476.exe
      4⤵
      PID:2360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23033.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23033.exe
      4⤵
      PID:4048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14664.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14664.exe
      4⤵
      PID:4460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7307.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7307.exe
      4⤵
      PID:5428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55025.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55025.exe
      4⤵
      PID:6904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11011.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11011.exe
      4⤵
      PID:7832
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42989.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42989.exe
    3⤵
    PID:2940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33300.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33300.exe
      4⤵
      PID:4436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37570.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37570.exe
      4⤵
      PID:5584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32950.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32950.exe
      4⤵
      PID:6196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63143.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63143.exe
      4⤵
      PID:6468
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14818.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14818.exe
    3⤵
    PID:1600
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8286.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8286.exe
    3⤵
    PID:3996
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63368.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63368.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4616
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56309.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56309.exe
    3⤵
    PID:5612
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2101.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2101.exe
    3⤵
    PID:6932
- C:\Users\Admin\AppData\Local\Temp\Unicorn-18583.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-18583.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2996
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53320.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53320.exe
    3⤵
    PID:1176
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58691.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58691.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3396
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58000.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58000.exe
    3⤵
    PID:4824
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15972.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15972.exe
    3⤵
    PID:5768
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6566.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6566.exe
    3⤵
    PID:6980
- C:\Users\Admin\AppData\Local\Temp\Unicorn-20010.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-20010.exe
  2⤵
  PID:2652
- C:\Users\Admin\AppData\Local\Temp\Unicorn-14671.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-14671.exe
  2⤵
  PID:3792
- C:\Users\Admin\AppData\Local\Temp\Unicorn-59294.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-59294.exe
  2⤵
  PID:4904
- C:\Users\Admin\AppData\Local\Temp\Unicorn-35856.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-35856.exe
  2⤵
  PID:5632
- C:\Users\Admin\AppData\Local\Temp\Unicorn-14813.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-14813.exe
  2⤵
  PID:5332
- C:\Users\Admin\AppData\Local\Temp\Unicorn-17598.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-17598.exe
  2⤵
  PID:6484

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-11016.exe

Filesize
468KB

MD5
c30f203d9b24ae82acaeea9d1a14f695

SHA1
0a5bf2953bf2d635e6a7823eebe1a14b4b69da2d

SHA256
e9db9ab38bfff0f3c5f251c4d2ab5f28ae1a06d261f9586de8287db766b8a562

SHA512
38da94df92af25d0882bf70698388035b73254a3a32bd9eb017f979c5176c681ae373b737a1258b1c95af1a7dfecaa76daca5662c442fb206ba4d8b83c47d06d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-23946.exe

Filesize
468KB

MD5
534ae6a36fd7c577b6ea44a02a09aa50

SHA1
b6816874479eff5469ca1caeab8f68d40cf97846

SHA256
0f73dac464a7a751ac63f3a9f1534c24a7707a33e415da23e22e6c7fc86d6ef6

SHA512
5c9693ffcd9f7d092a8c7ac545ae0f2b28bcadd9518dd2c8be1aec58218f9775bf3448b833455a8f6e361939aeae8317bfc1b1a4314838a3f63dfcaddc54619a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-25863.exe

Filesize
468KB

MD5
91acec88f035340a7ef73bc1f26609bc

SHA1
de22cc971d49c8873da18e45636f03367aada99d

SHA256
aeea349a17b96b46948954b58130e6102212e12584144dfa4b0e295c981ed75c

SHA512
09099bc23af2c1690af055832bb38f5e2a7fa3e9b83315914cd4b765a43cecc0da5d58b742cbdf6b72e067adf3c3c4bef2d4fc9cea21e61e173d3a634583c9f4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-31588.exe

Filesize
468KB

MD5
719c8fb995e22441f7171bed5a18ce84

SHA1
393edae37650d59812074d2613d7113929b928fa

SHA256
96a3b491485bd5c023f398d1528a6c5b539b3891c6ac7322caec85bbd6dacbc7

SHA512
87356b5c4bcbbaa3f2b5fda0b1878774c2d90b357acbc25ce081d14639865d295e74b5556ec3d01ae8c7ef758401893164a19c8327ed45e52b54c955edbc0c10

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-31729.exe

Filesize
468KB

MD5
5f88b1c4e76569937a331f8b81a3ebf3

SHA1
c4871edacc5849cc94056bde33bb635b90e684d1

SHA256
6d344c2b7ebbf7e54a36bb42013cb398bbbacaadceb550381c95d8b6f53d7062

SHA512
27abc9440935474ead6853047ceff1ca95ac965aeab66d1a40032d619c030cc98f129cfebaf1067483778137e6cd120e1cb015b9988290da9140e911d6358d9a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-40171.exe

Filesize
468KB

MD5
88b1b03a5a595f86520a0bf18ef1393a

SHA1
ca40e9df0ff3804f8b209db0ab8946bc0ba6910c

SHA256
2d5faff72bbb0ce36eda9a469b4700237c5782a34d8f33cdfd3c8d9ab7c5f4b0

SHA512
a043db4c7424721bd9a65a528974408fb2e272e5dd89d15761a992f1b1466760bdb0dcc28373826b710a86e5011273247f35b53d67e91ac25e18e440d7f3646f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-40503.exe

Filesize
468KB

MD5
440525c7a7d0a7258708b5c7eab1fbcf

SHA1
36f7325f2416a89e07a4326761c46bc71164b866

SHA256
0b9048bc538b7473fd34c2dba389eea6a6c8c46f85d9f2a5071782c235763784

SHA512
13f39c42c8be06797c0288422b517fbf394c1c8491b667fdcf2f1567f57ab7a90e706fb67a4f2c475f4579735b51aea4dca3ff1b4b3f0a8e07e3d41fce32e149

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-58719.exe

Filesize
468KB

MD5
81392986f64f60641a900aaa98b3e29a

SHA1
2264f02c4850dd7ebf957c7cc0c91898b12f7a76

SHA256
5abbc3bd2d5af775c5d14e80aeeea14deff1baaa3a3a2f9c3b7a07d32942a9d8

SHA512
0e5a3164cc8884f904f79006bfcf09749aca5f188f8527fc6a59c5170a1708eb7bb6037b3290432bbe5b9588f0d8114df5a896ce715bc9477f44788d64cfc69b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-60684.exe

Filesize
468KB

MD5
a2bf3c91e5ab97073d83f5ebe4b21abc

SHA1
600687734615a78821ef397604e34ee844338aa3

SHA256
6aadf01f6ece311928a0e79d6d59a861c83abd706d60181ee0b0cd628889de95

SHA512
1d798570061b8264d71c7abca67637aa839620f441133127bf23a046b176ddaca8c75ffdd767496e11f836326dc921c8f19285984f85c27f9021885c24e75722

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-8734.exe

Filesize
468KB

MD5
0169b7502195edbf1555a94338e470a2

SHA1
500e8b96490d29718ce96028ae6dfa3cf9bc6e3a

SHA256
f1f9d30ddaea5b4af90ddc400da76878e2e35b256b98dd1713ce7c4bbc8c1834

SHA512
2e3d7dd9e3841f0dee462897db6f2d58ddcc7ec4c5852b8fb6796bd00ca8bf78e726a982267ab11c5f197b5045484e703040d129516e158497b81cbf18c48507

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-954.exe

Filesize
468KB

MD5
b8e2b051a1db0c5f5b5347ffe2c7eb2a

SHA1
6c750e8eb44cb8ccd51344ae75588d3a61f0317b

SHA256
f059f09db62d1faadf5be45203bc7ef779f7718cb17020817e89491e1c21d028

SHA512
60b6c72b7ea73442d5db58e7342f42525c23fe6133fbf498c4999e66d1e257032573c4da06b425055e5118700a161024df387357e0af51d0d4ba705eeea18aa8

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-24516.exe

Filesize
468KB

MD5
980850c856c85f61557ea9595419cc31

SHA1
375894cff2b6493754e78ea72cc198154f284b85

SHA256
3ff1c81413c8d4ef3f4c59e7543736242791d8d9093e4e91e7c5425943b4e0d2

SHA512
435757b518cf1f35d32c0a5212d47e3ce88215e93bfd40088e19b30b5f949ac2ed869cb53d47cf02c9b670499de331a5c65f3c479cb1fa514543d0e91b756711

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-29939.exe

Filesize
468KB

MD5
c0793016cb16af2d6f1e5739c24bb5a7

SHA1
1ddbafa481a2387751c0858750427c1517cafa5f

SHA256
e7a4b90481ec9ef57ef26f0affbfb3202cd3122b875c0eb2299c20ce3026f539

SHA512
99f9f4283b251c55cb8c60bd1f73e7d79c24d3a5228a060ca4fc7e921722097eea66312178ec56f39f426ba9ccc3b00c59cd33c40b50ca241f48444fe38cb712

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-31589.exe

Filesize
468KB

MD5
1be0106f4ab62ba589e77f653414fcc5

SHA1
e5b425afefebc52ab784d6779310ba08a5155cfa

SHA256
5cf2e3e7c725af6d0bb02ab8e4bc1a16a5876f1251ff269ec8a810ec8c38bc40

SHA512
4e32dd2b8feedf1471d07cd91e56188f3f8257b787b60a55a765abe6ff4b718208b3db49c0bc06aab8b492b8cac7e0df049829d38e71465038729638fc7c2186

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-38853.exe

Filesize
468KB

MD5
6611e489ccb0bd464d170c85e0d4bb99

SHA1
21d12d6cbf0b2e76806855aafa0fb71e821c10f3

SHA256
74392f7a94abdc185c57d9683f0569ec693ff5c5b0bc56fc59e7783a594ac9ed

SHA512
83f9c48da988c00d6de252049c2030a4c4eb5943df94db5ebffe77a813a6629891afc10586f3c1e5c812397508f766d9d4696acfeefe93a0a2b2bbf819369fcf

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-40530.exe

Filesize
468KB

MD5
1ce22da2ae1156e61ce753e67aa2b9a8

SHA1
824592fd4f716d0ad97d5126de2de6cd6a68c13e

SHA256
af87a9c0885db416ee57fbd336d0d802c74e200328aab4ff50f0bac7ef4d2c5f

SHA512
a177a4d6dc38a09c6738c53dd12bf191b11f7bc0ab2e1d3b0617296a21df42cc1327050a7911141ef55680f05c746d6184cfb7d8e9710e379a0f41223f968530

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-43094.exe

Filesize
468KB

MD5
ce110c51d5ff5717504519fc95a1f39b

SHA1
2eb92d6aec6937a68d348fd853ada1f3e93e2d5a

SHA256
e0e88ef3f73452ac645219486a00ea84c69f435cc80cd5f62c37275ee5e2556a

SHA512
baeac0dad0ab87aaa35ce980fb72b9d1747c98b60d3dffd92e13ecfa80ff421caee986efa16bcdebcac8263b0e6b7e3fefa61309db15696f3d2e6cfff6b2bc4f

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-49077.exe

Filesize
468KB

MD5
4dbd8506e8b22603e7bdfd75615e98ec

SHA1
9be490a6e0677bcddf9cc1812a3973bcd87e2cd7

SHA256
9e72539427696059918d549038669f19814363b976c5edb02c380d835b66e221

SHA512
3d14ce6151e3fc44867375d026804e207a675bc605f2996638d1d7c908ba9295a32ed81c86f1fd55ad05157ced165fba5525b51e02f72dffa93bc4fcebff28d5

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-52589.exe

Filesize
468KB

MD5
c443e197d6d7304b6564935295b0d649

SHA1
e0ed94d1c06c605b2a0a161698acacb8bdfb374e

SHA256
d976339fcce05fcc56eb3bdb85148c33f04ac77f5ee02418b8781300091b4f6d

SHA512
3ec2a75463bcf30e41ddf1838515eec77bb7ef61033550200ed0fb5a2a8abef15718833ba6a51ab68c6ee089e0928b42dcb25bb808ba61b3d8075502df9452ac

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-55346.exe

Filesize
468KB

MD5
2a8c2904b0889f3f9960d576c5a6cd11

SHA1
5c87eb0a41fbd6cf501fe35d04d4779f0b83cb0d

SHA256
0463d8e3661e9b4ea3d5654a91d1ec3d7f604b19188651814b28fddd2fc0727d

SHA512
de8f4b2a914b457a4e083d4e59a76120da946d94df0299f815799890338120b7e2e6678301f205c67dd31f91323d0c8c1df1d4c59666bf07779ceea871a255fa

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-63706.exe

Filesize
468KB

MD5
4f12097625abf4ba973db2a9d1cf424c

SHA1
d14ac7947e6b7326a1290eb651ee544c0530d395

SHA256
693f361c8a1b1b0308af9aeb266cf35a9191d858f609b8cda379b2855cfb0031

SHA512
4369d86b838a9c31d8509ac5460dbcb01b37173cc270ee0e179d208a30c5aa0116007bde755718b591f45cb454264c857fe4be51cefefb8e6bf22535fed5bf07

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-7084.exe

Filesize
468KB

MD5
bf91431567a64b9f725f34a4319ff660

SHA1
0ece51c87af5ef7841168f7b2a8b446f4f8f4df4

SHA256
ca2e02d7b68ebb603bacfa34ab4eaaa9c45d7f355a59bd2fe5904fcd06e5162d

SHA512
7acadcb670025336cc20ebeb79d5650d4b3dcb6f215c52e719c87da897a7adf5df3a7431ad8bdd306a1b2825423b4f9a5b1939d99b25738e412d8ba39a5a976c

Download Submit
memory/396-272-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/752-161-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/752-303-0x00000000028D0000-0x0000000002945000-memory.dmp

Filesize
468KB

Download
memory/752-295-0x0000000003400000-0x0000000003475000-memory.dmp

Filesize
468KB

Download
memory/864-300-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/996-364-0x0000000002A40000-0x0000000002AB5000-memory.dmp

Filesize
468KB

Download
memory/996-205-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1400-227-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1400-377-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/1480-287-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1540-256-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1548-276-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1584-401-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1660-288-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1824-155-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1824-277-0x00000000025E0000-0x0000000002655000-memory.dmp

Filesize
468KB

Download
memory/1824-285-0x00000000025E0000-0x0000000002655000-memory.dmp

Filesize
468KB

Download
memory/1852-255-0x0000000002670000-0x00000000026E5000-memory.dmp

Filesize
468KB

Download
memory/1852-252-0x0000000002670000-0x00000000026E5000-memory.dmp

Filesize
468KB

Download
memory/1912-230-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1912-388-0x0000000002830000-0x00000000028A5000-memory.dmp

Filesize
468KB

Download
memory/1952-400-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2032-378-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2032-384-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2032-220-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2084-293-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2084-299-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2084-6-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2084-149-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2084-360-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2084-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2084-150-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2084-69-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2112-402-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2112-33-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2112-47-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2112-219-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2112-208-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2112-393-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2140-309-0x0000000001E90000-0x0000000001F05000-memory.dmp

Filesize
468KB

Download
memory/2140-313-0x0000000001E90000-0x0000000001F05000-memory.dmp

Filesize
468KB

Download
memory/2140-23-0x0000000001E90000-0x0000000001F05000-memory.dmp

Filesize
468KB

Download
memory/2140-379-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2148-301-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2148-294-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2148-168-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2160-247-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2204-187-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2204-358-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2204-354-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2204-189-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2204-108-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2224-344-0x00000000033C0000-0x0000000003435000-memory.dmp

Filesize
468KB

Download
memory/2224-345-0x0000000002890000-0x0000000002905000-memory.dmp

Filesize
468KB

Download
memory/2224-188-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2240-375-0x00000000025A0000-0x0000000002615000-memory.dmp

Filesize
468KB

Download
memory/2240-203-0x00000000025A0000-0x0000000002615000-memory.dmp

Filesize
468KB

Download
memory/2240-374-0x00000000025A0000-0x0000000002615000-memory.dmp

Filesize
468KB

Download
memory/2240-198-0x00000000025A0000-0x0000000002615000-memory.dmp

Filesize
468KB

Download
memory/2240-109-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2300-318-0x00000000025C0000-0x0000000002635000-memory.dmp

Filesize
468KB

Download
memory/2300-169-0x00000000025C0000-0x0000000002635000-memory.dmp

Filesize
468KB

Download
memory/2300-25-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2300-307-0x00000000025C0000-0x0000000002635000-memory.dmp

Filesize
468KB

Download
memory/2300-389-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2300-167-0x00000000025C0000-0x0000000002635000-memory.dmp

Filesize
468KB

Download
memory/2508-317-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2540-319-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2588-376-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2664-383-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2716-245-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2716-128-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2716-246-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2716-71-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2732-359-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2760-129-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2760-278-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2760-121-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2760-70-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2760-286-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2768-120-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2768-269-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2768-79-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2800-346-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2836-226-0x0000000002680000-0x00000000026F5000-memory.dmp

Filesize
468KB

Download
memory/2836-211-0x0000000002680000-0x00000000026F5000-memory.dmp

Filesize
468KB

Download
memory/2836-91-0x0000000002680000-0x00000000026F5000-memory.dmp

Filesize
468KB

Download
memory/2836-48-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2856-228-0x0000000001E00000-0x0000000001E75000-memory.dmp

Filesize
468KB

Download
memory/2856-229-0x0000000001E00000-0x0000000001E75000-memory.dmp

Filesize
468KB

Download
memory/2856-133-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2904-366-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2944-268-0x0000000000560000-0x00000000005D5000-memory.dmp

Filesize
468KB

Download
memory/2944-134-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2944-270-0x0000000000560000-0x00000000005D5000-memory.dmp

Filesize
468KB

Download
memory/3040-302-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download