b8e20e634897cacf84e3f195be4327635e3e6fde620ded3e554d02a7ffe23138

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
27-09-2024 22:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b8e20e634897cacf84e3f195be4327635e3e6fde620ded3e554d02a7ffe23138N.exe
Size

468KB
MD5

e8230ba31ff5da73a3aa00bf2fcddab0
SHA1

cb86d6cadd0e584083abc6a309e59e2895e809b3
SHA256

b8e20e634897cacf84e3f195be4327635e3e6fde620ded3e554d02a7ffe23138
SHA512

401640cc60fcbbe04d39cc821d00a9805efd02ff4ec88dbc791e8610439584d0e680d8d9eec72ea56766d8ce56f14e839f8427608fd77233c54c5cf539fcec11
SSDEEP

3072:tqonow3Njy8U6bY/fzzjYf5ElhEoI7BnmHePVgHjhhX9byNTklF:tqEo0LU6Uf/jYfc+3ojh1NyNT

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
1988	Unicorn-291.exe
2544	Unicorn-33047.exe
1488	Unicorn-47992.exe
2840	Unicorn-2367.exe
2276	Unicorn-45346.exe
2604	Unicorn-57690.exe
2632	Unicorn-43955.exe
2316	Unicorn-32876.exe
1852	Unicorn-758.exe
2020	Unicorn-59418.exe
348	Unicorn-42990.exe
2400	Unicorn-34822.exe
2504	Unicorn-55242.exe
1844	Unicorn-566.exe
2460	Unicorn-20166.exe
712	Unicorn-18569.exe
2440	Unicorn-45766.exe
3024	Unicorn-53187.exe
2636	Unicorn-53498.exe
1608	Unicorn-6700.exe
1652	Unicorn-29067.exe
1596	Unicorn-20136.exe
2256	Unicorn-59793.exe
3020	Unicorn-29158.exe
344	Unicorn-15423.exe
2800	Unicorn-35289.exe
2412	Unicorn-8546.exe
1996	Unicorn-60348.exe
2836	Unicorn-35542.exe
2892	Unicorn-55408.exe
2736	Unicorn-55408.exe
2572	Unicorn-33517.exe
2648	Unicorn-39648.exe
2580	Unicorn-11614.exe
1632	Unicorn-29342.exe
2536	Unicorn-3883.exe
1868	Unicorn-8729.exe
844	Unicorn-25620.exe
1856	Unicorn-39356.exe
804	Unicorn-42724.exe
2152	Unicorn-56368.exe
1248	Unicorn-43924.exe
812	Unicorn-37794.exe
632	Unicorn-43924.exe
1828	Unicorn-13289.exe
1732	Unicorn-65091.exe
1092	Unicorn-19420.exe
2468	Unicorn-47046.exe
836	Unicorn-41786.exe
2560	Unicorn-41786.exe
1448	Unicorn-41786.exe
1664	Unicorn-28718.exe
2348	Unicorn-16466.exe
1416	Unicorn-23815.exe
1992	Unicorn-59829.exe
2764	Unicorn-1905.exe
2584	Unicorn-42746.exe
2608	Unicorn-28356.exe
2740	Unicorn-8490.exe
2980	Unicorn-63066.exe
1384	Unicorn-50814.exe
1936	Unicorn-59357.exe
1656	Unicorn-21605.exe
1352	Unicorn-40079.exe

Loads dropped DLL 64 IoCs

pid	Process
2516	b8e20e634897cacf84e3f195be4327635e3e6fde620ded3e554d02a7ffe23138N.exe
2516	b8e20e634897cacf84e3f195be4327635e3e6fde620ded3e554d02a7ffe23138N.exe
1988	Unicorn-291.exe
1988	Unicorn-291.exe
2516	b8e20e634897cacf84e3f195be4327635e3e6fde620ded3e554d02a7ffe23138N.exe
2516	b8e20e634897cacf84e3f195be4327635e3e6fde620ded3e554d02a7ffe23138N.exe
2544	Unicorn-33047.exe
1488	Unicorn-47992.exe
2544	Unicorn-33047.exe
1488	Unicorn-47992.exe
2516	b8e20e634897cacf84e3f195be4327635e3e6fde620ded3e554d02a7ffe23138N.exe
2516	b8e20e634897cacf84e3f195be4327635e3e6fde620ded3e554d02a7ffe23138N.exe
1988	Unicorn-291.exe
1988	Unicorn-291.exe
2840	Unicorn-2367.exe
2840	Unicorn-2367.exe
1488	Unicorn-47992.exe
1488	Unicorn-47992.exe
2632	Unicorn-43955.exe
2632	Unicorn-43955.exe
1988	Unicorn-291.exe
1988	Unicorn-291.exe
2604	Unicorn-57690.exe
2604	Unicorn-57690.exe
2544	Unicorn-33047.exe
2544	Unicorn-33047.exe
2276	Unicorn-45346.exe
2276	Unicorn-45346.exe
2516	b8e20e634897cacf84e3f195be4327635e3e6fde620ded3e554d02a7ffe23138N.exe
2516	b8e20e634897cacf84e3f195be4327635e3e6fde620ded3e554d02a7ffe23138N.exe
2316	Unicorn-32876.exe
2316	Unicorn-32876.exe
2840	Unicorn-2367.exe
2840	Unicorn-2367.exe
2020	Unicorn-59418.exe
2020	Unicorn-59418.exe
1988	Unicorn-291.exe
1988	Unicorn-291.exe
2460	Unicorn-20166.exe
2460	Unicorn-20166.exe
2400	Unicorn-34822.exe
2516	b8e20e634897cacf84e3f195be4327635e3e6fde620ded3e554d02a7ffe23138N.exe
2400	Unicorn-34822.exe
2516	b8e20e634897cacf84e3f195be4327635e3e6fde620ded3e554d02a7ffe23138N.exe
2504	Unicorn-55242.exe
2504	Unicorn-55242.exe
2544	Unicorn-33047.exe
2604	Unicorn-57690.exe
1852	Unicorn-758.exe
2544	Unicorn-33047.exe
1852	Unicorn-758.exe
2604	Unicorn-57690.exe
1488	Unicorn-47992.exe
2632	Unicorn-43955.exe
1488	Unicorn-47992.exe
2632	Unicorn-43955.exe
2852	WerFault.exe
2852	WerFault.exe
2852	WerFault.exe
2852	WerFault.exe
2852	WerFault.exe
2852	WerFault.exe
2852	WerFault.exe
2852	WerFault.exe

Program crash 5 IoCs

pid	pid_target	Process	procid_target
2852	2412	WerFault.exe	56
1580	1632	WerFault.exe	66
3524	2872	WerFault.exe	131
5032	916	WerFault.exe	156
6668	6412	WerFault.exe	529

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53647.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40410.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2650.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26390.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46780.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17320.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42746.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8480.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39497.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30541.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32709.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2258.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3626.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42990.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19908.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51707.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39648.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12655.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32256.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3626.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52232.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5875.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26574.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15715.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38740.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12655.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26390.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31924.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31179.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12655.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42693.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60498.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23141.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20375.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53605.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63298.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60498.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63015.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54923.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16262.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19415.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62349.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56472.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22840.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43962.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31238.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26390.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20346.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29067.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8546.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41786.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51677.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17852.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53045.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19057.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29363.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23063.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53718.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12655.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18903.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26058.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43962.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39014.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26390.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2516	b8e20e634897cacf84e3f195be4327635e3e6fde620ded3e554d02a7ffe23138N.exe
1988	Unicorn-291.exe
2544	Unicorn-33047.exe
1488	Unicorn-47992.exe
2840	Unicorn-2367.exe
2276	Unicorn-45346.exe
2632	Unicorn-43955.exe
2604	Unicorn-57690.exe
2316	Unicorn-32876.exe
2020	Unicorn-59418.exe
1852	Unicorn-758.exe
2504	Unicorn-55242.exe
348	Unicorn-42990.exe
2400	Unicorn-34822.exe
2460	Unicorn-20166.exe
1844	Unicorn-566.exe
712	Unicorn-18569.exe
2440	Unicorn-45766.exe
3024	Unicorn-53187.exe
2636	Unicorn-53498.exe
1608	Unicorn-6700.exe
344	Unicorn-15423.exe
2256	Unicorn-59793.exe
1652	Unicorn-29067.exe
1596	Unicorn-20136.exe
3020	Unicorn-29158.exe
2412	Unicorn-8546.exe
2800	Unicorn-35289.exe
1996	Unicorn-60348.exe
2736	Unicorn-55408.exe
2836	Unicorn-35542.exe
2648	Unicorn-39648.exe
2580	Unicorn-11614.exe
2572	Unicorn-33517.exe
1632	Unicorn-29342.exe
2536	Unicorn-3883.exe
1856	Unicorn-39356.exe
844	Unicorn-25620.exe
1868	Unicorn-8729.exe
804	Unicorn-42724.exe
1248	Unicorn-43924.exe
632	Unicorn-43924.exe
2152	Unicorn-56368.exe
1732	Unicorn-65091.exe
1828	Unicorn-13289.exe
812	Unicorn-37794.exe
2560	Unicorn-41786.exe
2468	Unicorn-47046.exe
1092	Unicorn-19420.exe
1448	Unicorn-41786.exe
836	Unicorn-41786.exe
1664	Unicorn-28718.exe
2348	Unicorn-16466.exe
1416	Unicorn-23815.exe
1992	Unicorn-59829.exe
2764	Unicorn-1905.exe
2584	Unicorn-42746.exe
2608	Unicorn-28356.exe
2740	Unicorn-8490.exe
2980	Unicorn-63066.exe
1384	Unicorn-50814.exe
1936	Unicorn-59357.exe
1656	Unicorn-21605.exe
1352	Unicorn-40079.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2516 wrote to memory of 1988	2516	b8e20e634897cacf84e3f195be4327635e3e6fde620ded3e554d02a7ffe23138N.exe	30
PID 2516 wrote to memory of 1988	2516	b8e20e634897cacf84e3f195be4327635e3e6fde620ded3e554d02a7ffe23138N.exe	30
PID 2516 wrote to memory of 1988	2516	b8e20e634897cacf84e3f195be4327635e3e6fde620ded3e554d02a7ffe23138N.exe	30
PID 2516 wrote to memory of 1988	2516	b8e20e634897cacf84e3f195be4327635e3e6fde620ded3e554d02a7ffe23138N.exe	30
PID 1988 wrote to memory of 2544	1988	Unicorn-291.exe	31
PID 1988 wrote to memory of 2544	1988	Unicorn-291.exe	31
PID 1988 wrote to memory of 2544	1988	Unicorn-291.exe	31
PID 1988 wrote to memory of 2544	1988	Unicorn-291.exe	31
PID 2516 wrote to memory of 1488	2516	b8e20e634897cacf84e3f195be4327635e3e6fde620ded3e554d02a7ffe23138N.exe	32
PID 2516 wrote to memory of 1488	2516	b8e20e634897cacf84e3f195be4327635e3e6fde620ded3e554d02a7ffe23138N.exe	32
PID 2516 wrote to memory of 1488	2516	b8e20e634897cacf84e3f195be4327635e3e6fde620ded3e554d02a7ffe23138N.exe	32
PID 2516 wrote to memory of 1488	2516	b8e20e634897cacf84e3f195be4327635e3e6fde620ded3e554d02a7ffe23138N.exe	32
PID 2544 wrote to memory of 2276	2544	Unicorn-33047.exe	33
PID 2544 wrote to memory of 2276	2544	Unicorn-33047.exe	33
PID 2544 wrote to memory of 2276	2544	Unicorn-33047.exe	33
PID 2544 wrote to memory of 2276	2544	Unicorn-33047.exe	33
PID 1488 wrote to memory of 2840	1488	Unicorn-47992.exe	34
PID 1488 wrote to memory of 2840	1488	Unicorn-47992.exe	34
PID 1488 wrote to memory of 2840	1488	Unicorn-47992.exe	34
PID 1488 wrote to memory of 2840	1488	Unicorn-47992.exe	34
PID 2516 wrote to memory of 2604	2516	b8e20e634897cacf84e3f195be4327635e3e6fde620ded3e554d02a7ffe23138N.exe	35
PID 2516 wrote to memory of 2604	2516	b8e20e634897cacf84e3f195be4327635e3e6fde620ded3e554d02a7ffe23138N.exe	35
PID 2516 wrote to memory of 2604	2516	b8e20e634897cacf84e3f195be4327635e3e6fde620ded3e554d02a7ffe23138N.exe	35
PID 2516 wrote to memory of 2604	2516	b8e20e634897cacf84e3f195be4327635e3e6fde620ded3e554d02a7ffe23138N.exe	35
PID 1988 wrote to memory of 2632	1988	Unicorn-291.exe	36
PID 1988 wrote to memory of 2632	1988	Unicorn-291.exe	36
PID 1988 wrote to memory of 2632	1988	Unicorn-291.exe	36
PID 1988 wrote to memory of 2632	1988	Unicorn-291.exe	36
PID 2840 wrote to memory of 2316	2840	Unicorn-2367.exe	37
PID 2840 wrote to memory of 2316	2840	Unicorn-2367.exe	37
PID 2840 wrote to memory of 2316	2840	Unicorn-2367.exe	37
PID 2840 wrote to memory of 2316	2840	Unicorn-2367.exe	37
PID 1488 wrote to memory of 1852	1488	Unicorn-47992.exe	38
PID 1488 wrote to memory of 1852	1488	Unicorn-47992.exe	38
PID 1488 wrote to memory of 1852	1488	Unicorn-47992.exe	38
PID 1488 wrote to memory of 1852	1488	Unicorn-47992.exe	38
PID 2632 wrote to memory of 348	2632	Unicorn-43955.exe	39
PID 2632 wrote to memory of 348	2632	Unicorn-43955.exe	39
PID 2632 wrote to memory of 348	2632	Unicorn-43955.exe	39
PID 2632 wrote to memory of 348	2632	Unicorn-43955.exe	39
PID 1988 wrote to memory of 2020	1988	Unicorn-291.exe	40
PID 1988 wrote to memory of 2020	1988	Unicorn-291.exe	40
PID 1988 wrote to memory of 2020	1988	Unicorn-291.exe	40
PID 1988 wrote to memory of 2020	1988	Unicorn-291.exe	40
PID 2604 wrote to memory of 2400	2604	Unicorn-57690.exe	41
PID 2604 wrote to memory of 2400	2604	Unicorn-57690.exe	41
PID 2604 wrote to memory of 2400	2604	Unicorn-57690.exe	41
PID 2604 wrote to memory of 2400	2604	Unicorn-57690.exe	41
PID 2544 wrote to memory of 1844	2544	Unicorn-33047.exe	42
PID 2544 wrote to memory of 1844	2544	Unicorn-33047.exe	42
PID 2544 wrote to memory of 1844	2544	Unicorn-33047.exe	42
PID 2544 wrote to memory of 1844	2544	Unicorn-33047.exe	42
PID 2276 wrote to memory of 2504	2276	Unicorn-45346.exe	43
PID 2276 wrote to memory of 2504	2276	Unicorn-45346.exe	43
PID 2276 wrote to memory of 2504	2276	Unicorn-45346.exe	43
PID 2276 wrote to memory of 2504	2276	Unicorn-45346.exe	43
PID 2516 wrote to memory of 2460	2516	b8e20e634897cacf84e3f195be4327635e3e6fde620ded3e554d02a7ffe23138N.exe	44
PID 2516 wrote to memory of 2460	2516	b8e20e634897cacf84e3f195be4327635e3e6fde620ded3e554d02a7ffe23138N.exe	44
PID 2516 wrote to memory of 2460	2516	b8e20e634897cacf84e3f195be4327635e3e6fde620ded3e554d02a7ffe23138N.exe	44
PID 2516 wrote to memory of 2460	2516	b8e20e634897cacf84e3f195be4327635e3e6fde620ded3e554d02a7ffe23138N.exe	44
PID 2316 wrote to memory of 712	2316	Unicorn-32876.exe	45
PID 2316 wrote to memory of 712	2316	Unicorn-32876.exe	45
PID 2316 wrote to memory of 712	2316	Unicorn-32876.exe	45
PID 2316 wrote to memory of 712	2316	Unicorn-32876.exe	45

C:\Users\Admin\AppData\Local\Temp\b8e20e634897cacf84e3f195be4327635e3e6fde620ded3e554d02a7ffe23138N.exe
"C:\Users\Admin\AppData\Local\Temp\b8e20e634897cacf84e3f195be4327635e3e6fde620ded3e554d02a7ffe23138N.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2516
- C:\Users\Admin\AppData\Local\Temp\Unicorn-291.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-291.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1988
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33047.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33047.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45346.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45346.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55242.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:2504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59793.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43924.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55045.exe
        8⤵
        
        PID:1880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5875.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:3300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2650.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:5092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56785.exe
        9⤵
        
        PID:6412
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6412 -s 188
        10⤵
        Program crash
        
        PID:6668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3626.exe
        9⤵
        
        PID:6316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11438.exe
        8⤵
        
        PID:3676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53718.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35240.exe
        8⤵
        
        PID:5804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60498.exe
        8⤵
        
        PID:7492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50146.exe
        7⤵
        
        PID:536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57022.exe
        8⤵
        
        PID:3400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61965.exe
        8⤵
        
        PID:4248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51358.exe
        8⤵
        
        PID:7104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60498.exe
        8⤵
        
        PID:7444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2533.exe
        7⤵
        
        PID:3244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23590.exe
        7⤵
        
        PID:4948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43223.exe
        7⤵
        
        PID:7140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39497.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65091.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6036.exe
        7⤵
        
        PID:2792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-530.exe
        8⤵
        
        PID:1000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53605.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51358.exe
        8⤵
        
        PID:7056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26466.exe
        7⤵
        
        PID:3164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28346.exe
        8⤵
        
        PID:3796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56210.exe
        8⤵
        
        PID:5816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63273.exe
        8⤵
        
        PID:6776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36268.exe
        8⤵
        
        PID:7712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9963.exe
        7⤵
        
        PID:4108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10273.exe
        7⤵
        
        PID:5824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23258.exe
        7⤵
        
        PID:6496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43962.exe
        7⤵
        
        PID:7184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7882.exe
        6⤵
        
        PID:2472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40410.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26390.exe
        7⤵
        
        PID:5276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18903.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60498.exe
        7⤵
        
        PID:7420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26955.exe
        6⤵
        
        PID:3732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55002.exe
        6⤵
        
        PID:4800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43223.exe
        6⤵
        
        PID:7132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39497.exe
        6⤵
        
        PID:6188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39356.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62829.exe
        6⤵
        
        PID:1492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54417.exe
        7⤵
        
        PID:1540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39014.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26390.exe
        7⤵
        
        PID:5364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35240.exe
        7⤵
        
        PID:5908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60498.exe
        7⤵
        
        PID:7548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24821.exe
        6⤵
        
        PID:1832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22215.exe
        6⤵
        
        PID:3872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49552.exe
        6⤵
        
        PID:5564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23258.exe
        6⤵
        
        PID:6472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43962.exe
        6⤵
        
        PID:6816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42720.exe
        5⤵
        
        PID:2640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9876.exe
        6⤵
        
        PID:1516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30492.exe
        7⤵
        
        PID:4932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63470.exe
        7⤵
        
        PID:6172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63298.exe
        7⤵
        
        PID:6824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8480.exe
        6⤵
        
        PID:3900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43687.exe
        6⤵
        
        PID:5608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31924.exe
        6⤵
        
        PID:6356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60498.exe
        6⤵
        
        PID:7460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58123.exe
        5⤵
        
        PID:668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2880.exe
        5⤵
        
        PID:3424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41417.exe
        5⤵
        
        PID:5640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2258.exe
        5⤵
        
        PID:6432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34162.exe
        5⤵
        
        PID:6580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-566.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-566.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63066.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23141.exe
        6⤵
        
        PID:2524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15715.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28346.exe
        8⤵
        
        PID:3760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3117.exe
        8⤵
        
        PID:5764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63273.exe
        8⤵
        
        PID:6768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36268.exe
        8⤵
        
        PID:7720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16456.exe
        7⤵
        
        PID:4088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26390.exe
        7⤵
        
        PID:5300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35240.exe
        7⤵
        
        PID:5960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60498.exe
        7⤵
        
        PID:7532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40965.exe
        6⤵
        
        PID:2620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52750.exe
        6⤵
        
        PID:3188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32256.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26157.exe
        6⤵
        
        PID:7148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61028.exe
        6⤵
        
        PID:5948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22876.exe
        5⤵
        
        PID:1204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20375.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42304.exe
        6⤵
        
        PID:4484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53194.exe
        6⤵
        
        PID:5428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55157.exe
        6⤵
        
        PID:6860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46639.exe
        5⤵
        
        PID:3088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41417.exe
        5⤵
        
        PID:5516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2258.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7520.exe
        5⤵
        
        PID:6660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29158.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29158.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41786.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34241.exe
        6⤵
        
        PID:1480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19908.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28972.exe
        8⤵
        
        PID:7588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63820.exe
        7⤵
        
        PID:3616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26390.exe
        7⤵
        
        PID:5204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35240.exe
        7⤵
        
        PID:6044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60498.exe
        7⤵
        
        PID:7332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49051.exe
        6⤵
        
        PID:1484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29247.exe
        7⤵
        
        PID:7996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65303.exe
        6⤵
        
        PID:3696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32256.exe
        6⤵
        
        PID:4288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43980.exe
        6⤵
        
        PID:5704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17320.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51132.exe
        5⤵
        
        PID:2696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15715.exe
        6⤵
        
        PID:2728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16456.exe
        6⤵
        
        PID:4028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26390.exe
        6⤵
        
        PID:5316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57798.exe
        6⤵
        
        PID:2004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60498.exe
        6⤵
        
        PID:7436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19698.exe
        5⤵
        
        PID:1104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58615.exe
        5⤵
        
        PID:3224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23590.exe
        5⤵
        
        PID:4128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10039.exe
        5⤵
        
        PID:5968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61028.exe
        5⤵
        
        PID:2772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23815.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23815.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3981.exe
        5⤵
        
        PID:1928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45585.exe
        6⤵
        
        PID:3340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12655.exe
        6⤵
        
        PID:4172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29374.exe
        6⤵
        
        PID:5844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3626.exe
        6⤵
        
        PID:6520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60722.exe
        5⤵
        
        PID:3180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26390.exe
        5⤵
        
        PID:5388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35240.exe
        5⤵
        
        PID:5856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60498.exe
        5⤵
        
        PID:7572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1849.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1849.exe
      4⤵
      PID:2240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31304.exe
        5⤵
        
        PID:3720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9256.exe
        5⤵
        
        PID:4912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29374.exe
        5⤵
        
        PID:5492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3626.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63015.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63015.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20529.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20529.exe
      4⤵
      PID:4924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45537.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45537.exe
      4⤵
      PID:5752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34162.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34162.exe
      4⤵
      PID:6596
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43955.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43955.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42990.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42990.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25620.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21605.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61350.exe
        7⤵
        
        PID:1892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59892.exe
        8⤵
        
        PID:3856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40131.exe
        9⤵
        
        PID:3192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12655.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:5104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36901.exe
        9⤵
        
        PID:7000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19733.exe
        9⤵
        
        PID:7696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63820.exe
        8⤵
        
        PID:3572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26390.exe
        8⤵
        
        PID:5228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20366.exe
        8⤵
        
        PID:7016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36799.exe
        8⤵
        
        PID:7676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17852.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26390.exe
        7⤵
        
        PID:5188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52645.exe
        7⤵
        
        PID:5680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60498.exe
        7⤵
        
        PID:7340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40306.exe
        6⤵
        
        PID:1672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3374.exe
        7⤵
        
        PID:4000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12655.exe
        7⤵
        
        PID:5124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51358.exe
        7⤵
        
        PID:7112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60498.exe
        7⤵
        
        PID:7540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51707.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32256.exe
        6⤵
        
        PID:5132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26574.exe
        6⤵
        
        PID:6140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43962.exe
        6⤵
        
        PID:7176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33948.exe
        5⤵
        
        PID:1916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27967.exe
        6⤵
        
        PID:2268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39014.exe
        6⤵
        
        PID:3104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26390.exe
        6⤵
        
        PID:5108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35240.exe
        6⤵
        
        PID:6048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60498.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65034.exe
        5⤵
        
        PID:1624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19415.exe
        5⤵
        
        PID:4020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24351.exe
        5⤵
        
        PID:5672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23788.exe
        5⤵
        
        PID:6540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39497.exe
        5⤵
        
        PID:932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60348.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60348.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43924.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23141.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25419.exe
        7⤵
        
        PID:3216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62349.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6241.exe
        7⤵
        
        PID:6980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60498.exe
        7⤵
        
        PID:7516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37156.exe
        6⤵
        
        PID:3384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34156.exe
        7⤵
        
        PID:6268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25333.exe
        7⤵
        
        PID:7752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44974.exe
        6⤵
        
        PID:4152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35240.exe
        6⤵
        
        PID:2532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60498.exe
        6⤵
        
        PID:7524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29917.exe
        5⤵
        
        PID:680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14043.exe
        6⤵
        
        PID:3444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31238.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30746.exe
        6⤵
        
        PID:6168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60498.exe
        6⤵
        
        PID:7476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25173.exe
        5⤵
        
        PID:3652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28857.exe
        5⤵
        
        PID:4876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26574.exe
        5⤵
        
        PID:6076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43962.exe
        5⤵
        
        PID:7264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13289.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13289.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57458.exe
        5⤵
        
        PID:2972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42549.exe
        6⤵
        
        PID:1876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8480.exe
        6⤵
        
        PID:3452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43687.exe
        6⤵
        
        PID:5592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31924.exe
        6⤵
        
        PID:6388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60498.exe
        6⤵
        
        PID:7428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25205.exe
        5⤵
        
        PID:1836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25313.exe
        5⤵
        
        PID:4184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52837.exe
        5⤵
        
        PID:6104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27441.exe
        5⤵
        
        PID:6764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3716.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3716.exe
      4⤵
      PID:1720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62113.exe
        5⤵
        
        PID:3292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12655.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36901.exe
        5⤵
        
        PID:6900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19733.exe
        5⤵
        
        PID:7648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6120.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6120.exe
      4⤵
      PID:3148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7055.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7055.exe
      4⤵
      PID:4816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42112.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42112.exe
      4⤵
      PID:6948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34162.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34162.exe
      4⤵
      PID:6576
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59418.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59418.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53187.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53187.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39648.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40079.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9601.exe
        7⤵
        
        PID:904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31011.exe
        8⤵
        
        PID:6152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53647.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22979.exe
        7⤵
        
        PID:3460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26390.exe
        7⤵
        
        PID:5236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52645.exe
        7⤵
        
        PID:5688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60498.exe
        7⤵
        
        PID:7404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38936.exe
        6⤵
        
        PID:540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16294.exe
        6⤵
        
        PID:3544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32256.exe
        6⤵
        
        PID:5372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26574.exe
        6⤵
        
        PID:6124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43962.exe
        6⤵
        
        PID:7192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50748.exe
        5⤵
        
        PID:280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41890.exe
        6⤵
        
        PID:2832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20740.exe
        7⤵
        
        PID:4992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51933.exe
        7⤵
        
        PID:1848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3626.exe
        7⤵
        
        PID:1520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32709.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26390.exe
        6⤵
        
        PID:5252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20366.exe
        6⤵
        
        PID:1396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36799.exe
        6⤵
        
        PID:7728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37898.exe
        5⤵
        
        PID:1536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58605.exe
        6⤵
        
        PID:3276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12655.exe
        6⤵
        
        PID:4140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36901.exe
        6⤵
        
        PID:6928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19733.exe
        6⤵
        
        PID:7640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58340.exe
        5⤵
        
        PID:3228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23590.exe
        5⤵
        
        PID:5112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63643.exe
        5⤵
        
        PID:6940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39497.exe
        5⤵
        
        PID:6240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11614.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11614.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58361.exe
        5⤵
        
        PID:2664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3571.exe
        6⤵
        
        PID:3000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10782.exe
        7⤵
        
        PID:6872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64228.exe
        7⤵
        
        PID:7632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34655.exe
        6⤵
        
        PID:3352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26390.exe
        6⤵
        
        PID:5196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20366.exe
        6⤵
        
        PID:7052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36799.exe
        6⤵
        
        PID:7768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63633.exe
        5⤵
        
        PID:916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58.exe
        6⤵
        
        PID:3944
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 916 -s 236
        6⤵
        Program crash
        
        PID:5032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5988.exe
        5⤵
        
        PID:3408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32256.exe
        5⤵
        
        PID:5308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1001.exe
        5⤵
        
        PID:5464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43962.exe
        5⤵
        
        PID:6672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15858.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15858.exe
      4⤵
      PID:2096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47427.exe
        5⤵
        
        PID:2732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4505.exe
        5⤵
        
        PID:3836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26390.exe
        5⤵
        
        PID:5260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42693.exe
        5⤵
        
        PID:7076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43962.exe
        5⤵
        
        PID:6632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5828.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5828.exe
      4⤵
      PID:352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58880.exe
        5⤵
        
        PID:3260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12655.exe
        5⤵
        
        PID:4164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29374.exe
        5⤵
        
        PID:5736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3626.exe
        5⤵
        
        PID:6548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52197.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52197.exe
      4⤵
      PID:3936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7055.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7055.exe
      4⤵
      PID:4284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27105.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27105.exe
      4⤵
      PID:5900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39497.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39497.exe
      4⤵
      PID:2428
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53498.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53498.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29342.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29342.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1632
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1632 -s 220
        5⤵
        Program crash
        
        PID:1580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50748.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50748.exe
      4⤵
      PID:2548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5792.exe
        5⤵
        
        PID:2964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8480.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43687.exe
        5⤵
        
        PID:5624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31924.exe
        5⤵
        
        PID:6348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60498.exe
        5⤵
        
        PID:7300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6268.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6268.exe
      4⤵
      PID:988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28081.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28081.exe
      4⤵
      PID:3864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40887.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40887.exe
      4⤵
      PID:5532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6723.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6723.exe
      4⤵
      PID:6488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61028.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61028.exe
      4⤵
      PID:6908
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3883.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3883.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9497.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9497.exe
      4⤵
      PID:3064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12097.exe
        5⤵
        
        PID:3232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62349.exe
        5⤵
        
        PID:5004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29374.exe
        5⤵
        
        PID:5868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3626.exe
        5⤵
        
        PID:6312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34363.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34363.exe
      4⤵
      PID:3488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15661.exe
        5⤵
        
        PID:6256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53647.exe
        5⤵
        
        PID:6640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54923.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54923.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26574.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26574.exe
      4⤵
      PID:5988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43962.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43962.exe
      4⤵
      PID:7256
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25111.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25111.exe
    3⤵
    PID:1512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36903.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36903.exe
      4⤵
      PID:2148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46389.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46389.exe
      4⤵
      PID:4204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53194.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53194.exe
      4⤵
      PID:5404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20346.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20346.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6840
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57667.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57667.exe
    3⤵
    PID:2968
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14759.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14759.exe
    3⤵
    PID:4940
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-239.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-239.exe
    3⤵
    PID:5912
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38362.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38362.exe
    3⤵
    PID:6904
- C:\Users\Admin\AppData\Local\Temp\Unicorn-47992.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-47992.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1488
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2367.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2367.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32876.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32876.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18569.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55408.exe
        6⤵
        Executes dropped EXE
        
        PID:2892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59829.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40306.exe
        7⤵
        
        PID:2212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39939.exe
        8⤵
        
        PID:3772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12655.exe
        8⤵
        
        PID:4820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36901.exe
        8⤵
        
        PID:7008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19733.exe
        8⤵
        
        PID:7656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51707.exe
        7⤵
        
        PID:3508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32256.exe
        7⤵
        
        PID:5348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26574.exe
        7⤵
        
        PID:6040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43962.exe
        7⤵
        
        PID:7240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17010.exe
        6⤵
        
        PID:1304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25637.exe
        7⤵
        
        PID:2408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58880.exe
        8⤵
        
        PID:3264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12655.exe
        8⤵
        
        PID:5116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46780.exe
        8⤵
        
        PID:5724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3626.exe
        8⤵
        
        PID:6608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-120.exe
        7⤵
        
        PID:3468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26390.exe
        7⤵
        
        PID:5284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18903.exe
        7⤵
        
        PID:2948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60498.exe
        7⤵
        
        PID:7316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9611.exe
        6⤵
        
        PID:896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19415.exe
        6⤵
        
        PID:1004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27110.exe
        6⤵
        
        PID:5800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45859.exe
        6⤵
        
        PID:6728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9933.exe
        6⤵
        
        PID:7744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35542.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1905.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1625.exe
        7⤵
        
        PID:1888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53045.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:2364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14290.exe
        8⤵
        
        PID:6248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39069.exe
        8⤵
        
        PID:7760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34655.exe
        7⤵
        
        PID:3336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26390.exe
        7⤵
        
        PID:5244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9666.exe
        7⤵
        
        PID:5836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60498.exe
        7⤵
        
        PID:7484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53327.exe
        6⤵
        
        PID:1544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25632.exe
        7⤵
        
        PID:3816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12655.exe
        7⤵
        
        PID:4772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29374.exe
        7⤵
        
        PID:5944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42521.exe
        7⤵
        
        PID:6868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48391.exe
        6⤵
        
        PID:3324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32256.exe
        6⤵
        
        PID:5052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26574.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43962.exe
        6⤵
        
        PID:6820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50814.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31117.exe
        6⤵
        
        PID:964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63545.exe
        7⤵
        
        PID:2624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22799.exe
        7⤵
        
        PID:4956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35240.exe
        7⤵
        
        PID:5416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60498.exe
        7⤵
        
        PID:7500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7115.exe
        6⤵
        
        PID:2488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28445.exe
        6⤵
        
        PID:4840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52645.exe
        6⤵
        
        PID:5544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60498.exe
        6⤵
        
        PID:7308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57878.exe
        5⤵
        
        PID:1260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38740.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48151.exe
        6⤵
        
        PID:4388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30746.exe
        6⤵
        
        PID:6164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60498.exe
        6⤵
        
        PID:7468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22373.exe
        5⤵
        
        PID:3644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58311.exe
        5⤵
        
        PID:4380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42112.exe
        5⤵
        
        PID:6972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34162.exe
        5⤵
        
        PID:6604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45766.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45766.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55408.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42746.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6093.exe
        7⤵
        
        PID:1548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41261.exe
        7⤵
        
        PID:3956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26390.exe
        7⤵
        
        PID:5156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52645.exe
        7⤵
        
        PID:5664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60498.exe
        7⤵
        
        PID:7348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40581.exe
        6⤵
        
        PID:2388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30300.exe
        6⤵
        
        PID:3208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32256.exe
        6⤵
        
        PID:4280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1001.exe
        6⤵
        
        PID:5444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14624.exe
        6⤵
        
        PID:7964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8490.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29171.exe
        6⤵
        
        PID:2872
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2872 -s 240
        7⤵
        Program crash
        
        PID:3524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29720.exe
        6⤵
        
        PID:3976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19327.exe
        7⤵
        
        PID:3904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12655.exe
        7⤵
        
        PID:5012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46780.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3626.exe
        7⤵
        
        PID:6212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1328.exe
        6⤵
        
        PID:3964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32256.exe
        6⤵
        
        PID:4404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26574.exe
        6⤵
        
        PID:6064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43962.exe
        6⤵
        
        PID:7232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4265.exe
        5⤵
        
        PID:1020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19052.exe
        6⤵
        
        PID:3776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4408.exe
        6⤵
        
        PID:5808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31924.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60498.exe
        6⤵
        
        PID:7412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23063.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8867.exe
        6⤵
        
        PID:5660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12323.exe
        6⤵
        
        PID:6460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63298.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23590.exe
        5⤵
        
        PID:4212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15901.exe
        5⤵
        
        PID:7024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9933.exe
        5⤵
        
        PID:7668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33517.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33517.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28356.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1241.exe
        6⤵
        
        PID:1604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59975.exe
        7⤵
        
        PID:3376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12655.exe
        7⤵
        
        PID:4904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51358.exe
        7⤵
        
        PID:7092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60498.exe
        7⤵
        
        PID:7452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37971.exe
        6⤵
        
        PID:3500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26390.exe
        6⤵
        
        PID:5148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52645.exe
        6⤵
        
        PID:5528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33855.exe
        6⤵
        
        PID:6700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61303.exe
        5⤵
        
        PID:2372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21081.exe
        6⤵
        
        PID:3428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12655.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36901.exe
        6⤵
        
        PID:6992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19733.exe
        6⤵
        
        PID:7624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40031.exe
        5⤵
        
        PID:3552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32256.exe
        5⤵
        
        PID:5332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1001.exe
        5⤵
        
        PID:5456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43962.exe
        5⤵
        
        PID:6716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59357.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59357.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1324.exe
        5⤵
        
        PID:2672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39014.exe
        5⤵
        
        PID:3144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26390.exe
        5⤵
        
        PID:5140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52645.exe
        5⤵
        
        PID:5512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60498.exe
        5⤵
        
        PID:7396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3084.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3084.exe
      4⤵
      PID:1636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5563.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5563.exe
      4⤵
      PID:4896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5574.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5574.exe
      4⤵
      PID:5504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34162.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34162.exe
      4⤵
      PID:6588
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-758.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-758.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35289.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35289.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41786.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21662.exe
        6⤵
        
        PID:2984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20954.exe
        7⤵
        
        PID:5080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21861.exe
        7⤵
        
        PID:2884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63298.exe
        7⤵
        
        PID:6832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64998.exe
        6⤵
        
        PID:3880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26390.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35240.exe
        6⤵
        
        PID:6052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60498.exe
        6⤵
        
        PID:7364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9772.exe
        5⤵
        
        PID:2080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10538.exe
        6⤵
        
        PID:5892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12323.exe
        6⤵
        
        PID:6452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63298.exe
        6⤵
        
        PID:6808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7358.exe
        5⤵
        
        PID:3108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32256.exe
        5⤵
        
        PID:5340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1001.exe
        5⤵
        
        PID:5452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43962.exe
        5⤵
        
        PID:6676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16466.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16466.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29363.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51677.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51467.exe
        6⤵
        
        PID:4976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30746.exe
        6⤵
        
        PID:6020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33855.exe
        6⤵
        
        PID:6448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26466.exe
        5⤵
        
        PID:3120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65202.exe
        5⤵
        
        PID:5044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52645.exe
        5⤵
        
        PID:5696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60498.exe
        5⤵
        
        PID:7356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61935.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61935.exe
      4⤵
      PID:2892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44687.exe
        5⤵
        
        PID:328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8480.exe
        5⤵
        
        PID:3364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43687.exe
        5⤵
        
        PID:5600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31924.exe
        5⤵
        
        PID:6372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33855.exe
        5⤵
        
        PID:6740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13503.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13503.exe
      4⤵
      PID:2264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19415.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19415.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27110.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27110.exe
      4⤵
      PID:5788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45859.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45859.exe
      4⤵
      PID:6736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9933.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9933.exe
      4⤵
      PID:7736
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8546.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8546.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2412
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2412 -s 200
      4⤵
      Loads dropped DLL
      Program crash
      PID:2852
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2346.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2346.exe
    3⤵
    PID:1920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56358.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56358.exe
      4⤵
      PID:3916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12655.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12655.exe
      4⤵
      PID:4836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29374.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29374.exe
      4⤵
      PID:5496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3626.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3626.exe
      4⤵
      PID:2900
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22840.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22840.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3820
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7055.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7055.exe
    3⤵
    PID:4964
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28174.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28174.exe
    3⤵
    PID:5932
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39497.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39497.exe
    3⤵
    PID:6228
- C:\Users\Admin\AppData\Local\Temp\Unicorn-57690.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-57690.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2604
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34822.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34822.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2400
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29067.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29067.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41786.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30541.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20375.exe
        7⤵
        
        PID:2380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42304.exe
        7⤵
        
        PID:4468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22467.exe
        7⤵
        
        PID:5432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16262.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52232.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26499.exe
        6⤵
        
        PID:4788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35240.exe
        6⤵
        
        PID:5084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60498.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-945.exe
        5⤵
        
        PID:2120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46332.exe
        6⤵
        
        PID:3152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39790.exe
        6⤵
        
        PID:4872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29374.exe
        6⤵
        
        PID:5888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3626.exe
        6⤵
        
        PID:6296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40202.exe
        5⤵
        
        PID:3172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26719.exe
        5⤵
        
        PID:4156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26574.exe
        5⤵
        
        PID:6084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43962.exe
        5⤵
        
        PID:7224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28718.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28718.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57027.exe
        5⤵
        
        PID:2576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29916.exe
        6⤵
        
        PID:4780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15639.exe
        6⤵
        
        PID:5992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63298.exe
        6⤵
        
        PID:6836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23886.exe
        5⤵
        
        PID:4036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32256.exe
        5⤵
        
        PID:5380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26574.exe
        5⤵
        
        PID:6096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43962.exe
        5⤵
        
        PID:7216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57742.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57742.exe
      4⤵
      PID:2124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40410.exe
        5⤵
        
        PID:4040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26390.exe
        5⤵
        
        PID:5324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42693.exe
        5⤵
        
        PID:7120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43962.exe
        5⤵
        
        PID:7208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31039.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31039.exe
      4⤵
      PID:3628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50918.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50918.exe
      4⤵
      PID:4848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31528.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31528.exe
      4⤵
      PID:5480
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61028.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61028.exe
      4⤵
      PID:7088
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15423.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15423.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56368.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56368.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1568.exe
        5⤵
        
        PID:2888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35559.exe
        6⤵
        
        PID:548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27255.exe
        6⤵
        
        PID:3740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26390.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52645.exe
        6⤵
        
        PID:5540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60498.exe
        6⤵
        
        PID:7388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15693.exe
        5⤵
        
        PID:112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28346.exe
        6⤵
        
        PID:3568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3117.exe
        6⤵
        
        PID:5780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63273.exe
        6⤵
        
        PID:6780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36268.exe
        6⤵
        
        PID:7704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40991.exe
        5⤵
        
        PID:3692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32256.exe
        5⤵
        
        PID:5356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26574.exe
        5⤵
        
        PID:6116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43962.exe
        5⤵
        
        PID:7048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55216.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55216.exe
      4⤵
      PID:2596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42549.exe
        5⤵
        
        PID:2424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8480.exe
        5⤵
        
        PID:3256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43687.exe
        5⤵
        
        PID:5652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31924.exe
        5⤵
        
        PID:6396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60498.exe
        5⤵
        
        PID:7508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38941.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38941.exe
      4⤵
      PID:2464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28346.exe
        5⤵
        
        PID:3764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3117.exe
        5⤵
        
        PID:5772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26058.exe
        5⤵
        
        PID:6564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3626.exe
        5⤵
        
        PID:5476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31179.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31179.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44172.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44172.exe
      4⤵
      PID:6092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10906.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10906.exe
      4⤵
      PID:6756
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37794.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37794.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4749.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4749.exe
      4⤵
      PID:1776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48683.exe
        5⤵
        
        PID:3100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12655.exe
        5⤵
        
        PID:4972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3801.exe
        5⤵
        
        PID:2356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3626.exe
        5⤵
        
        PID:6200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48854.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48854.exe
      4⤵
      PID:3640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26390.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26390.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35240.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35240.exe
      4⤵
      PID:6036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60498.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60498.exe
      4⤵
      PID:7324
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2346.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2346.exe
    3⤵
    PID:2776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58880.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58880.exe
      4⤵
      PID:3132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12655.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12655.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29374.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29374.exe
      4⤵
      PID:5864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3626.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3626.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6236
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22840.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22840.exe
    3⤵
    PID:3828
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7055.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7055.exe
    3⤵
    PID:5056
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27105.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27105.exe
    3⤵
    PID:5952
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39497.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39497.exe
    3⤵
    PID:6196
- C:\Users\Admin\AppData\Local\Temp\Unicorn-20166.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-20166.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:2460
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6700.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6700.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8729.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8729.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23743.exe
        5⤵
        
        PID:1220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7162.exe
        6⤵
        
        PID:1900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33093.exe
        6⤵
        
        PID:4072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26390.exe
        6⤵
        
        PID:5172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42693.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43962.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38251.exe
        5⤵
        
        PID:860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63741.exe
        5⤵
        
        PID:3420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32256.exe
        5⤵
        
        PID:5220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37432.exe
        5⤵
        
        PID:7032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15268.exe
        5⤵
        
        PID:7688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38495.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38495.exe
      4⤵
      PID:952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3379.exe
        5⤵
        
        PID:2704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51568.exe
        5⤵
        
        PID:3788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26390.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63113.exe
        5⤵
        
        PID:6964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43962.exe
        5⤵
        
        PID:7248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65500.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65500.exe
      4⤵
      PID:3012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60862.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60862.exe
      4⤵
      PID:3984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23590.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23590.exe
      4⤵
      PID:4768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50003.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50003.exe
      4⤵
      PID:5840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61028.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61028.exe
      4⤵
      PID:6156
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42724.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42724.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19057.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19057.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31304.exe
        5⤵
        
        PID:3712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44067.exe
        5⤵
        
        PID:4812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29374.exe
        5⤵
        
        PID:5500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3626.exe
        5⤵
        
        PID:6284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13384.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13384.exe
      4⤵
      PID:3840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22799.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22799.exe
      4⤵
      PID:4908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9666.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9666.exe
      4⤵
      PID:5936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60498.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60498.exe
      4⤵
      PID:7380
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45599.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45599.exe
    3⤵
    PID:2880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37893.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37893.exe
      4⤵
      PID:3748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32256.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32256.exe
      4⤵
      PID:5396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46577.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46577.exe
      4⤵
      PID:6956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61028.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61028.exe
      4⤵
      PID:6468
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31039.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31039.exe
    3⤵
    PID:3620
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9309.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9309.exe
    3⤵
    PID:4352
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63643.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63643.exe
    3⤵
    PID:6932
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39497.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39497.exe
    3⤵
    PID:6924
- C:\Users\Admin\AppData\Local\Temp\Unicorn-20136.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-20136.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1596
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19420.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19420.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56472.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56472.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28346.exe
        5⤵
        
        PID:3608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3117.exe
        5⤵
        
        PID:5756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26058.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3626.exe
        5⤵
        
        PID:6884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64998.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64998.exe
      4⤵
      PID:3892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26390.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26390.exe
      4⤵
      PID:5180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35240.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35240.exe
      4⤵
      PID:6056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33855.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33855.exe
      4⤵
      PID:6656
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57027.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57027.exe
    3⤵
    PID:2760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63055.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63055.exe
      4⤵
      PID:5468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12323.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12323.exe
      4⤵
      PID:6512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63298.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63298.exe
      4⤵
      PID:6888
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28081.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28081.exe
    3⤵
    PID:3932
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40887.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40887.exe
    3⤵
    PID:5552
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6723.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6723.exe
    3⤵
    PID:6524
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61028.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61028.exe
    3⤵
    PID:7156
- C:\Users\Admin\AppData\Local\Temp\Unicorn-47046.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-47046.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2468
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32295.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32295.exe
    3⤵
    PID:2564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9300.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9300.exe
      4⤵
      PID:2368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12564.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12564.exe
      4⤵
      PID:3756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43687.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43687.exe
      4⤵
      PID:5580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31924.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31924.exe
      4⤵
      PID:6364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60498.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60498.exe
      4⤵
      PID:6748
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-125.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-125.exe
    3⤵
    PID:1348
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22215.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22215.exe
    3⤵
    PID:3992
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49552.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49552.exe
    3⤵
    PID:5616
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23258.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23258.exe
    3⤵
    PID:6480
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43962.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43962.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:7200
- C:\Users\Admin\AppData\Local\Temp\Unicorn-25841.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-25841.exe
  2⤵
  PID:2680
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50909.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50909.exe
    3⤵
    PID:1152
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8480.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8480.exe
    3⤵
    PID:3360
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43687.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43687.exe
    3⤵
    PID:5632
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31924.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31924.exe
    3⤵
    PID:6380
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60498.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60498.exe
    3⤵
    PID:7564
- C:\Users\Admin\AppData\Local\Temp\Unicorn-12618.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-12618.exe
  2⤵
  PID:1696
- C:\Users\Admin\AppData\Local\Temp\Unicorn-58616.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-58616.exe
  2⤵
  PID:3076
- C:\Users\Admin\AppData\Local\Temp\Unicorn-18751.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-18751.exe
  2⤵
  PID:5572
- C:\Users\Admin\AppData\Local\Temp\Unicorn-38924.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-38924.exe
  2⤵
  PID:6420
- C:\Users\Admin\AppData\Local\Temp\Unicorn-57963.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-57963.exe
  2⤵
  PID:7072

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-2367.exe

Filesize
468KB

MD5
84731ba9cd6cde890a140edc2903d075

SHA1
24a937a55e8559f64eed8a76c46c958c58e83d18

SHA256
36c88a391d7160e8aac77b80f6bd40cc0dff6fe690a99456dcb2033d7e778e9d

SHA512
c8dd961120bf203d2ab763f12576db85818a636c8c8aee42d11fcac92de3f61ce0cf28809f3f93d369a46bb9dbe57f63032a02c592aa57804098b2345d60e20f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-33047.exe

Filesize
468KB

MD5
01dd29bedb9ef64a31b336e9b2b703d0

SHA1
facd099c759aa26c3fc81b816614ab7ffbb19165

SHA256
bbfc30fd86abac8d75b35d2034da42e28e50813b98e8e94b3e4a1a84d5beab60

SHA512
b739e645954298f17bbd5c4828d1fbc9a7b3bd2048abb2ca0ca76c8fbfd7aa2a5d07e76d466a527e9482a42805de6343c7c72fa866d9f60ca07e155575e57009

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-34822.exe

Filesize
468KB

MD5
2e992c2294e8c91a7194f76488a835f3

SHA1
477d480965b418483b9bfea65ff7d4aeca9a6028

SHA256
9bf528c1489544602b62fcf652044c239f0fba6ae1e6c05768c24c32c9010ed4

SHA512
6562a2199b603ae7efbf5e48680b2a1f1d8c2ebb56128e51ea1d7cf243b5189e436bdfd66b47cd65d62241cd882286b85757cd62f21089b60592795d49d7e8e7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-53045.exe

Filesize
468KB

MD5
b2d1dd335d3f002278098bcd6a5820ca

SHA1
d2a53bc4a0f66c8783bbef9feef7ebe14411e17f

SHA256
38e5c54ace4fe18ab2163bc42611fe9eaac8f2fb2eb88c347c468d12bf32aa6f

SHA512
b666eb2dc4e1b761009bf8c545aa7cd0a626354b0ffe3ce68d9f7152761719621a8dd860377840e005bab9ead02fc36a7a6b108ba94ea38320072f78468d7ebd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-566.exe

Filesize
468KB

MD5
6afe4f29fd5fd3a7c555d291e6538c29

SHA1
ee82412b98ce037578f3a4183873ce00ac919e47

SHA256
e9e826486dd2270ba159d59c2b58e80da06c386259c05d724bb4bac7086a292c

SHA512
2eb63b0bb1cb595765870b28fca6f88099851b3eea481a9eecf80ce43947139c1495ecf81d8ac546840fbda86891dccd3b3dd0549d17b107cda1dc180121b411

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5792.exe

Filesize
468KB

MD5
af7ab6217cba127548a3061545645dfb

SHA1
00624082c83f13155cd9086cfe080235b9dc910c

SHA256
b433ce0c0bdb6003e6300cfe30cc25d7b52f07f7f6acab231502cfc5b45be977

SHA512
a173fcb376bdcb1db4ebd187ec0c0bbcda2c69663e6a86c4a0d71e297c9fb5d8b2499a3b8f02935d4283cd1187a8011c916d5d4bf56a8b4273b1ae5021a895e7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-61965.exe

Filesize
468KB

MD5
861cab3b5bfead7ac89dcc7b03485e27

SHA1
7e146a3aedb430f16bff4e5128d03e3ff5b6fe20

SHA256
3b761e680ecccb5abbfa579ea62dd3ae9ca6664f5c5c12b03dd4fc26b3d9da76

SHA512
2060a309f664602faa9932c36323800f25fd6b0a56d8b7ccb446af5f761aa328b74d1250573a65efa45f0fb364dd0b14a8808266a03bf19f85e58c36df8a0cf8

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-18569.exe

Filesize
468KB

MD5
e750b544a6404593112660a89fde5f5e

SHA1
281b69d26cc863e2898351133e88f745d19132ee

SHA256
469ca20f00db7eaddc93177a9e28596fe4b16757d445eab71b7de831a7eb36d2

SHA512
7a63d8e8bed0e0cca98bee5e5b2bd789d07263bd60f1a191b0efc49bdb672cb59158c57ad560e197c7566737b03a0c54b778574b8a097b011dfd444422d95e34

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-20166.exe

Filesize
468KB

MD5
e239b7bc6a89f3b6f515320ca14efb4a

SHA1
9b0b09544cdbf4041877fa82cca4396f51f88f5a

SHA256
7ce408c14f643629878e03e5aef3857448e3143176e72737831abb978bfec3c2

SHA512
83a122dbf66bbe17d6a59c24942c9600e8c92a5d6af570ac711f43ea6e5b001d0e312b6c287552bfd7bdd6ebe992738745b616a4d514f4c113af46c15ea02a27

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-291.exe

Filesize
468KB

MD5
359eddfb3856c6cd70cf4f36b88d62ad

SHA1
4c1b16ad7d096bc8f74ea373b24d836ad653e500

SHA256
814183270739c8897dabfe9ed2bc9b24134949c0cffd373145bfe65044bae219

SHA512
e1a15ddade9cfdd146b90c715b4ca987996e11197443f6173a26a648574f6ac2eac8ad763fea19082951f454a7d33a00a83428b38c2905e349eea2f292623adf

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-32876.exe

Filesize
468KB

MD5
c0ed600b770414432c18b22e8fdaa356

SHA1
f24ab040f79fa96553fa696e5814cfe418d77758

SHA256
0dd454e29fd3116c48144040662d035157e3742dcd2866a040cc5d762361bd47

SHA512
8bdf2dda252dd974819aadea76a2eabf01fd169d683eb759b7fee3d0100294da0c712efb65a3cc67637738e430d014be5f05fd2923772707c1fce2534388ec4c

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-42990.exe

Filesize
468KB

MD5
76dcb145cdbb1ea7ea1c9165fa8d5d4b

SHA1
befbcf14d584a9ab81aeeff06f021eeb7e6628db

SHA256
25dfc7d6af36afc932647fe595e05716e0746b139090153b1468145a169b7531

SHA512
2c7551bd01dd45e8aa3a94d02d4f96adbe10e1dc3b07028eea4a567fec86d9dacf62fe0a7ed0ef2c26120ce16c29e287bb2b443381653ce6487a18b34cd9149a

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-43955.exe

Filesize
468KB

MD5
9c98ab7f70e85ceb2cf60958d49b7242

SHA1
c4658e310fc3d493285125d082b6980a04bab8ea

SHA256
5274924577414105396d3f7dfea3111385da93a620beaa86c0556f37fcfd8e40

SHA512
7b9b4fc3c00b4a1aac32f7720cad45cc55d471eaea2c078fe4409ce30c98a7eec15b039b13b14dc406f4a04c0288bfb231415d75ff40a76a659ff6d85fb1a927

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-45346.exe

Filesize
468KB

MD5
2b0847c3b465a0c32b1fd3384f901e2e

SHA1
e63e937f74971d56caa21dde939b7315c5f4db99

SHA256
e66c9b36693ab7fd9a69f2ca8caf009d2d9a894f6aaa536f6113795391da7e45

SHA512
7d784c070c47b1300d770d026935161bbd202cbb7f69092503eb72ae5214bb0dfa3717e4dd05a05204ab8c1a8ad9a97ec7dcc423c05a9521bf856bd6af5ffb48

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-45766.exe

Filesize
468KB

MD5
b006e434d2124c68b58e9c7aa9032126

SHA1
39fee747165781c86490f528eb6adaf5b9421d62

SHA256
72495535311a6f3ea072ca4bd3d7d8c45a7e384e6a3b8e4aac947e47b87a8b01

SHA512
6b27f23498577035aff1769ea1106af172ebe633857a67fa06ea741456e9f557b802fdd0ba349c79133578c7457bb91246126af268dda9ea4648e837e898bce9

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-47992.exe

Filesize
468KB

MD5
fb656acb9f1e096b8de5e6bbe2e667b5

SHA1
b73b2bbd180d650e9aa738d0c8b66f7a07b76214

SHA256
8fd066f0275c261f56167e75189c310c90d0070ff2265a84b603d43ec6b1b3b9

SHA512
eca4b3e57c0687b3f7c0611416dfb5752c6556d0037ac15fe4e37b132ada8f7f2fd0d4f905e52f5879c07c7939a479374eb529ba1f1a5fddec92c215fc891997

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-53187.exe

Filesize
468KB

MD5
36eae0c70f6ebd21ff192cf4aa35d034

SHA1
2e2e99e21f4fbaee632753c09bd042c55cc17995

SHA256
914cc2e481b078c01b682703cc1fb3009d84b50372c9dd3432a8654697229141

SHA512
1ac5aac52f06b3ffd9866e38a741d4551c2046bc5b926343665c75d026e4cae5451a7fa8773c891db984163b3ffeb19925b656b55a9e63474e883aab8c47fedd

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-53498.exe

Filesize
468KB

MD5
c72e40de6fefcf5ddfaf92177b12d09d

SHA1
3c6b1f1b8e37c8ca6529864e0a873c9071812a41

SHA256
9efb214ec8eab3241ffe6e335db685331fce166ffe9a8dfb365e8191d7f2c072

SHA512
59050aec966cf716d81e958bc8d879c423c0800281407c08f165b27c3b0819a46c6791895edb4fd7b2d3742d7c67fac25a08ca7fcce0c3aea4322de1a1684500

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-55242.exe

Filesize
468KB

MD5
e0150ab5d6a376f7cf866e15dfd43b8f

SHA1
21a71845a48f1f2d45859f883d86b84aff86c83b

SHA256
ff4fb101bf3ca4d4ca7c1da9b54cf51d974b456dd70a8f76ed154b755d189dca

SHA512
971350bff1379fa7047efc296d7d1f2537544c358c6ec015c2467671f08336636b0faab0458059e5ad97bd1f5d7f396f4eb7d7d2eb76f8182cd98f8c0784df03

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-57690.exe

Filesize
468KB

MD5
4731271a77afcb56661e67de79e4eff8

SHA1
cfddc8d4674f7e6154674648e462f2a695197d8e

SHA256
62db0c959a7e8e54d14265f6213a256aaf51d890e51ac515d03acf7a4c4915b9

SHA512
18c9941b3ccc20e055a5e50c4963f93679dd94efc1f7b21c605026d85bb3252b2f89108a679b13703c74d7a8aa85a97236d4242bc3ba5aeca406a55903638415

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-59418.exe

Filesize
468KB

MD5
dbb0ca1cd7a756809a20b8b0075f7ebd

SHA1
d90334a5eb3a65e56f8e87ffbca3f2fcc12812c0

SHA256
4136a9556308bb6030766e1f9cee9617951e6bb132c8029ec538b994adcd732b

SHA512
f88c45b474fc3ff8634d32fb9f6bf4c39fa03d39c5dd4b2b97026b7c5b64d8f97e6da1285c99adf142048f0afe7375ec94bc121abd27c441d4aeacd79f9e6ecd

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-758.exe

Filesize
468KB

MD5
2831289859da31a20ed6268f1f7784c9

SHA1
830595c4061fac630f25250fcc654062a9732c10

SHA256
06bdd3ff6850b6d8869b93db4eb1c02378188931770bf790005c3c2c5d64ec52

SHA512
718027c2b51c5217fb66609000d052198d466fd07c4afacc6dc4daa2933ab9b894f5d286ff8a4c9cc55cf5a8632cabf7a49c4ffc8558370f59d11ef89432d2cb

Download Submit
memory/344-298-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/348-138-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/844-413-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1488-303-0x0000000002480000-0x00000000024F5000-memory.dmp

Filesize
468KB

Download
memory/1488-411-0x0000000002480000-0x00000000024F5000-memory.dmp

Filesize
468KB

Download
memory/1488-312-0x0000000002480000-0x00000000024F5000-memory.dmp

Filesize
468KB

Download
memory/1488-393-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1488-37-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1596-265-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1608-249-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1608-399-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/1608-398-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/1632-382-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1652-264-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1844-166-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1852-283-0x0000000002700000-0x0000000002775000-memory.dmp

Filesize
468KB

Download
memory/1852-296-0x0000000002700000-0x0000000002775000-memory.dmp

Filesize
468KB

Download
memory/1852-109-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1868-401-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1988-235-0x0000000000510000-0x0000000000585000-memory.dmp

Filesize
468KB

Download
memory/1988-73-0x0000000000510000-0x0000000000585000-memory.dmp

Filesize
468KB

Download
memory/1988-13-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1988-25-0x0000000000510000-0x0000000000585000-memory.dmp

Filesize
468KB

Download
memory/1988-236-0x0000000000510000-0x0000000000585000-memory.dmp

Filesize
468KB

Download
memory/1988-350-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1988-391-0x0000000000510000-0x0000000000585000-memory.dmp

Filesize
468KB

Download
memory/1988-369-0x0000000000510000-0x0000000000585000-memory.dmp

Filesize
468KB

Download
memory/1996-316-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2020-225-0x0000000000380000-0x00000000003F5000-memory.dmp

Filesize
468KB

Download
memory/2020-131-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2020-224-0x0000000000380000-0x00000000003F5000-memory.dmp

Filesize
468KB

Download
memory/2020-368-0x0000000000380000-0x00000000003F5000-memory.dmp

Filesize
468KB

Download
memory/2256-278-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2276-419-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2276-161-0x0000000003340000-0x00000000033B5000-memory.dmp

Filesize
468KB

Download
memory/2276-162-0x0000000003340000-0x00000000033B5000-memory.dmp

Filesize
468KB

Download
memory/2316-198-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2316-98-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2316-341-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2316-193-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2400-257-0x0000000001DA0000-0x0000000001E15000-memory.dmp

Filesize
468KB

Download
memory/2400-263-0x0000000001DA0000-0x0000000001E15000-memory.dmp

Filesize
468KB

Download
memory/2400-140-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2412-315-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2440-345-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2440-344-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2440-212-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2460-248-0x00000000025F0000-0x0000000002665000-memory.dmp

Filesize
468KB

Download
memory/2460-176-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2460-242-0x00000000025F0000-0x0000000002665000-memory.dmp

Filesize
468KB

Download
memory/2504-267-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2504-164-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2504-271-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2516-173-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2516-314-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2516-174-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2516-11-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2516-10-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2516-261-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2516-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2516-333-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2536-397-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2544-44-0x00000000023E0000-0x0000000002455000-memory.dmp

Filesize
468KB

Download
memory/2544-160-0x00000000023E0000-0x0000000002455000-memory.dmp

Filesize
468KB

Download
memory/2544-153-0x00000000023E0000-0x0000000002455000-memory.dmp

Filesize
468KB

Download
memory/2544-417-0x00000000023E0000-0x0000000002455000-memory.dmp

Filesize
468KB

Download
memory/2544-370-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2544-59-0x00000000023E0000-0x0000000002455000-memory.dmp

Filesize
468KB

Download
memory/2544-27-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2544-288-0x00000000023E0000-0x0000000002455000-memory.dmp

Filesize
468KB

Download
memory/2544-282-0x00000000023E0000-0x0000000002455000-memory.dmp

Filesize
468KB

Download
memory/2572-367-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2580-372-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2604-284-0x0000000002450000-0x00000000024C5000-memory.dmp

Filesize
468KB

Download
memory/2604-297-0x0000000002450000-0x00000000024C5000-memory.dmp

Filesize
468KB

Download
memory/2604-136-0x0000000002450000-0x00000000024C5000-memory.dmp

Filesize
468KB

Download
memory/2604-418-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2604-70-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2604-129-0x0000000002450000-0x00000000024C5000-memory.dmp

Filesize
468KB

Download
memory/2632-82-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2632-305-0x0000000002650000-0x00000000026C5000-memory.dmp

Filesize
468KB

Download
memory/2632-313-0x0000000002650000-0x00000000026C5000-memory.dmp

Filesize
468KB

Download
memory/2636-237-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2636-381-0x00000000026A0000-0x0000000002715000-memory.dmp

Filesize
468KB

Download
memory/2648-371-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2800-299-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2836-343-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2840-360-0x00000000028B0000-0x0000000002925000-memory.dmp

Filesize
468KB

Download
memory/2840-412-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2840-209-0x00000000028B0000-0x0000000002925000-memory.dmp

Filesize
468KB

Download
memory/2840-69-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2840-96-0x00000000028B0000-0x0000000002925000-memory.dmp

Filesize
468KB

Download
memory/2840-210-0x00000000026B0000-0x0000000002725000-memory.dmp

Filesize
468KB

Download
memory/2892-342-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3020-295-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3024-226-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download