b1f5c58a4cd3dc1294572b64af6154b02bc7ef49f36c7f6eef15beaf1b6d31b6

Analysis

max time kernel
150s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
29/09/2024, 01:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b1f5c58a4cd3dc1294572b64af6154b02bc7ef49f36c7f6eef15beaf1b6d31b6.exe
Size

468KB
MD5

412b44c4c910fc627ac4a1445ab01567
SHA1

c9be554a65db90eb5721f5fcfee2ee80698ead06
SHA256

b1f5c58a4cd3dc1294572b64af6154b02bc7ef49f36c7f6eef15beaf1b6d31b6
SHA512

3c092663c24573b5674062af3795f01e45499b1b0f9a533107d0bd42d643975bd7935b8504c58a3a3d43c9a304b3b1f04b0621599979cb539c07b56d0a68cefc
SSDEEP

3072:pqMFo7Lgjy8nBbYkPz5jtfLeYqjBFp9nbHeoVdnYG2F5GyNYulD:pqmooLnB3P1jtfkDMKYGysyNY

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2012	Unicorn-1550.exe
2892	Unicorn-25700.exe
2704	Unicorn-63644.exe
2568	Unicorn-23443.exe
2828	Unicorn-42794.exe
2724	Unicorn-33369.exe
2556	Unicorn-47105.exe
2628	Unicorn-63248.exe
772	Unicorn-17577.exe
324	Unicorn-17577.exe
568	Unicorn-26845.exe
1784	Unicorn-27110.exe
852	Unicorn-34684.exe
1304	Unicorn-17577.exe
2040	Unicorn-63524.exe
2196	Unicorn-43658.exe
2176	Unicorn-57394.exe
1312	Unicorn-63524.exe
376	Unicorn-65340.exe
1408	Unicorn-13638.exe
1936	Unicorn-6897.exe
2952	Unicorn-52569.exe
1052	Unicorn-6632.exe
804	Unicorn-6897.exe
1776	Unicorn-63504.exe
988	Unicorn-31489.exe
584	Unicorn-57235.exe
2888	Unicorn-6425.exe
2460	Unicorn-37950.exe
1060	Unicorn-15216.exe
1792	Unicorn-6791.exe
2700	Unicorn-25038.exe
2972	Unicorn-17943.exe
2584	Unicorn-22734.exe
2624	Unicorn-37809.exe
2688	Unicorn-3444.exe
2456	Unicorn-36500.exe
2852	Unicorn-36500.exe
3064	Unicorn-41047.exe
1816	Unicorn-34932.exe
1680	Unicorn-20033.exe
1516	Unicorn-17233.exe
3060	Unicorn-57108.exe
1820	Unicorn-57108.exe
1444	Unicorn-57108.exe
884	Unicorn-52702.exe
2648	Unicorn-900.exe
304	Unicorn-17929.exe
1536	Unicorn-59023.exe
2420	Unicorn-22729.exe
1780	Unicorn-32083.exe
2172	Unicorn-38214.exe
2244	Unicorn-5852.exe
2440	Unicorn-43471.exe
2308	Unicorn-24373.exe
2316	Unicorn-11950.exe
2452	Unicorn-39666.exe
2760	Unicorn-33772.exe
2612	Unicorn-12178.exe
2872	Unicorn-12178.exe
2720	Unicorn-53917.exe
2808	Unicorn-10082.exe
808	Unicorn-40512.exe
1508	Unicorn-12386.exe

Loads dropped DLL 64 IoCs

pid	Process
2084	b1f5c58a4cd3dc1294572b64af6154b02bc7ef49f36c7f6eef15beaf1b6d31b6.exe
2084	b1f5c58a4cd3dc1294572b64af6154b02bc7ef49f36c7f6eef15beaf1b6d31b6.exe
2012	Unicorn-1550.exe
2012	Unicorn-1550.exe
2084	b1f5c58a4cd3dc1294572b64af6154b02bc7ef49f36c7f6eef15beaf1b6d31b6.exe
2084	b1f5c58a4cd3dc1294572b64af6154b02bc7ef49f36c7f6eef15beaf1b6d31b6.exe
2892	Unicorn-25700.exe
2892	Unicorn-25700.exe
2704	Unicorn-63644.exe
2704	Unicorn-63644.exe
2012	Unicorn-1550.exe
2012	Unicorn-1550.exe
2084	b1f5c58a4cd3dc1294572b64af6154b02bc7ef49f36c7f6eef15beaf1b6d31b6.exe
2084	b1f5c58a4cd3dc1294572b64af6154b02bc7ef49f36c7f6eef15beaf1b6d31b6.exe
2704	Unicorn-63644.exe
2704	Unicorn-63644.exe
2556	Unicorn-47105.exe
2828	Unicorn-42794.exe
2568	Unicorn-23443.exe
2828	Unicorn-42794.exe
2568	Unicorn-23443.exe
2724	Unicorn-33369.exe
2724	Unicorn-33369.exe
2084	b1f5c58a4cd3dc1294572b64af6154b02bc7ef49f36c7f6eef15beaf1b6d31b6.exe
2084	b1f5c58a4cd3dc1294572b64af6154b02bc7ef49f36c7f6eef15beaf1b6d31b6.exe
2012	Unicorn-1550.exe
2012	Unicorn-1550.exe
2900	WerFault.exe
2900	WerFault.exe
2900	WerFault.exe
2900	WerFault.exe
2900	WerFault.exe
2900	WerFault.exe
2900	WerFault.exe
772	Unicorn-17577.exe
2568	Unicorn-23443.exe
2628	Unicorn-63248.exe
2892	Unicorn-25700.exe
2568	Unicorn-23443.exe
2892	Unicorn-25700.exe
772	Unicorn-17577.exe
2628	Unicorn-63248.exe
2828	Unicorn-42794.exe
324	Unicorn-17577.exe
2828	Unicorn-42794.exe
324	Unicorn-17577.exe
2012	Unicorn-1550.exe
852	Unicorn-34684.exe
852	Unicorn-34684.exe
1784	Unicorn-27110.exe
1784	Unicorn-27110.exe
2724	Unicorn-33369.exe
2724	Unicorn-33369.exe
2084	b1f5c58a4cd3dc1294572b64af6154b02bc7ef49f36c7f6eef15beaf1b6d31b6.exe
2084	b1f5c58a4cd3dc1294572b64af6154b02bc7ef49f36c7f6eef15beaf1b6d31b6.exe
2012	Unicorn-1550.exe
2556	Unicorn-47105.exe
2556	Unicorn-47105.exe
3036	WerFault.exe
3036	WerFault.exe
3036	WerFault.exe
3036	WerFault.exe
3036	WerFault.exe
3036	WerFault.exe

Program crash 15 IoCs

pid	pid_target	Process	procid_target
2900	2704	WerFault.exe	33
3036	2828	WerFault.exe	35
624	2628	WerFault.exe	38
316	2452	WerFault.exe	90
648	3060	WerFault.exe	75
1824	1820	WerFault.exe	77
640	1444	WerFault.exe	76
2140	376	WerFault.exe	50
2896	2808	WerFault.exe	96
1472	2972	WerFault.exe	65
3740	3024	WerFault.exe	100
3860	1404	WerFault.exe	123
3892	2388	WerFault.exe	101
5108	2180	WerFault.exe	129
5100	2144	WerFault.exe	130

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23711.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57824.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27574.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19527.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27547.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12344.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59062.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5552.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64893.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15364.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33858.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32339.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65412.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34184.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23443.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63524.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17943.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56699.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53168.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23107.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11417.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33815.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46876.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9877.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14922.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43658.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38205.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40575.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39666.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31475.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37137.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38205.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21968.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53943.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37950.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9137.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27695.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27949.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1367.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12412.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25269.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32083.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18718.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58104.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35606.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41304.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29234.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63644.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39507.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61928.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12178.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53857.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39936.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40531.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30070.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11971.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23308.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12344.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63108.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37060.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25274.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33369.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29235.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45904.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2084	b1f5c58a4cd3dc1294572b64af6154b02bc7ef49f36c7f6eef15beaf1b6d31b6.exe
2012	Unicorn-1550.exe
2892	Unicorn-25700.exe
2704	Unicorn-63644.exe
2828	Unicorn-42794.exe
2568	Unicorn-23443.exe
2556	Unicorn-47105.exe
2724	Unicorn-33369.exe
2628	Unicorn-63248.exe
772	Unicorn-17577.exe
324	Unicorn-17577.exe
568	Unicorn-26845.exe
1784	Unicorn-27110.exe
852	Unicorn-34684.exe
2196	Unicorn-43658.exe
2176	Unicorn-57394.exe
1408	Unicorn-13638.exe
2040	Unicorn-63524.exe
804	Unicorn-6897.exe
1936	Unicorn-6897.exe
1312	Unicorn-63524.exe
2952	Unicorn-52569.exe
376	Unicorn-65340.exe
1052	Unicorn-6632.exe
988	Unicorn-31489.exe
1776	Unicorn-63504.exe
584	Unicorn-57235.exe
2888	Unicorn-6425.exe
2460	Unicorn-37950.exe
1060	Unicorn-15216.exe
1792	Unicorn-6791.exe
2700	Unicorn-25038.exe
2972	Unicorn-17943.exe
2584	Unicorn-22734.exe
2624	Unicorn-37809.exe
3064	Unicorn-41047.exe
2852	Unicorn-36500.exe
2456	Unicorn-36500.exe
2688	Unicorn-3444.exe
1816	Unicorn-34932.exe
1516	Unicorn-17233.exe
1444	Unicorn-57108.exe
884	Unicorn-52702.exe
1680	Unicorn-20033.exe
3060	Unicorn-57108.exe
1820	Unicorn-57108.exe
2648	Unicorn-900.exe
304	Unicorn-17929.exe
1536	Unicorn-59023.exe
2420	Unicorn-22729.exe
2244	Unicorn-5852.exe
2172	Unicorn-38214.exe
1780	Unicorn-32083.exe
2440	Unicorn-43471.exe
2308	Unicorn-24373.exe
2316	Unicorn-11950.exe
2760	Unicorn-33772.exe
2612	Unicorn-12178.exe
2872	Unicorn-12178.exe
2720	Unicorn-53917.exe
2808	Unicorn-10082.exe
808	Unicorn-40512.exe
1508	Unicorn-12386.exe
1768	Unicorn-56910.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2084 wrote to memory of 2012	2084	b1f5c58a4cd3dc1294572b64af6154b02bc7ef49f36c7f6eef15beaf1b6d31b6.exe	31
PID 2084 wrote to memory of 2012	2084	b1f5c58a4cd3dc1294572b64af6154b02bc7ef49f36c7f6eef15beaf1b6d31b6.exe	31
PID 2084 wrote to memory of 2012	2084	b1f5c58a4cd3dc1294572b64af6154b02bc7ef49f36c7f6eef15beaf1b6d31b6.exe	31
PID 2084 wrote to memory of 2012	2084	b1f5c58a4cd3dc1294572b64af6154b02bc7ef49f36c7f6eef15beaf1b6d31b6.exe	31
PID 2012 wrote to memory of 2892	2012	Unicorn-1550.exe	32
PID 2012 wrote to memory of 2892	2012	Unicorn-1550.exe	32
PID 2012 wrote to memory of 2892	2012	Unicorn-1550.exe	32
PID 2012 wrote to memory of 2892	2012	Unicorn-1550.exe	32
PID 2084 wrote to memory of 2704	2084	b1f5c58a4cd3dc1294572b64af6154b02bc7ef49f36c7f6eef15beaf1b6d31b6.exe	33
PID 2084 wrote to memory of 2704	2084	b1f5c58a4cd3dc1294572b64af6154b02bc7ef49f36c7f6eef15beaf1b6d31b6.exe	33
PID 2084 wrote to memory of 2704	2084	b1f5c58a4cd3dc1294572b64af6154b02bc7ef49f36c7f6eef15beaf1b6d31b6.exe	33
PID 2084 wrote to memory of 2704	2084	b1f5c58a4cd3dc1294572b64af6154b02bc7ef49f36c7f6eef15beaf1b6d31b6.exe	33
PID 2892 wrote to memory of 2568	2892	Unicorn-25700.exe	34
PID 2892 wrote to memory of 2568	2892	Unicorn-25700.exe	34
PID 2892 wrote to memory of 2568	2892	Unicorn-25700.exe	34
PID 2892 wrote to memory of 2568	2892	Unicorn-25700.exe	34
PID 2704 wrote to memory of 2828	2704	Unicorn-63644.exe	35
PID 2704 wrote to memory of 2828	2704	Unicorn-63644.exe	35
PID 2704 wrote to memory of 2828	2704	Unicorn-63644.exe	35
PID 2704 wrote to memory of 2828	2704	Unicorn-63644.exe	35
PID 2012 wrote to memory of 2724	2012	Unicorn-1550.exe	36
PID 2012 wrote to memory of 2724	2012	Unicorn-1550.exe	36
PID 2012 wrote to memory of 2724	2012	Unicorn-1550.exe	36
PID 2012 wrote to memory of 2724	2012	Unicorn-1550.exe	36
PID 2084 wrote to memory of 2556	2084	b1f5c58a4cd3dc1294572b64af6154b02bc7ef49f36c7f6eef15beaf1b6d31b6.exe	37
PID 2084 wrote to memory of 2556	2084	b1f5c58a4cd3dc1294572b64af6154b02bc7ef49f36c7f6eef15beaf1b6d31b6.exe	37
PID 2084 wrote to memory of 2556	2084	b1f5c58a4cd3dc1294572b64af6154b02bc7ef49f36c7f6eef15beaf1b6d31b6.exe	37
PID 2084 wrote to memory of 2556	2084	b1f5c58a4cd3dc1294572b64af6154b02bc7ef49f36c7f6eef15beaf1b6d31b6.exe	37
PID 2704 wrote to memory of 2628	2704	Unicorn-63644.exe	38
PID 2704 wrote to memory of 2628	2704	Unicorn-63644.exe	38
PID 2704 wrote to memory of 2628	2704	Unicorn-63644.exe	38
PID 2704 wrote to memory of 2628	2704	Unicorn-63644.exe	38
PID 2828 wrote to memory of 324	2828	Unicorn-42794.exe	40
PID 2828 wrote to memory of 324	2828	Unicorn-42794.exe	40
PID 2828 wrote to memory of 324	2828	Unicorn-42794.exe	40
PID 2828 wrote to memory of 324	2828	Unicorn-42794.exe	40
PID 2568 wrote to memory of 772	2568	Unicorn-23443.exe	41
PID 2568 wrote to memory of 772	2568	Unicorn-23443.exe	41
PID 2568 wrote to memory of 772	2568	Unicorn-23443.exe	41
PID 2568 wrote to memory of 772	2568	Unicorn-23443.exe	41
PID 2724 wrote to memory of 1784	2724	Unicorn-33369.exe	42
PID 2724 wrote to memory of 1784	2724	Unicorn-33369.exe	42
PID 2724 wrote to memory of 1784	2724	Unicorn-33369.exe	42
PID 2724 wrote to memory of 1784	2724	Unicorn-33369.exe	42
PID 2084 wrote to memory of 568	2084	b1f5c58a4cd3dc1294572b64af6154b02bc7ef49f36c7f6eef15beaf1b6d31b6.exe	43
PID 2084 wrote to memory of 568	2084	b1f5c58a4cd3dc1294572b64af6154b02bc7ef49f36c7f6eef15beaf1b6d31b6.exe	43
PID 2084 wrote to memory of 568	2084	b1f5c58a4cd3dc1294572b64af6154b02bc7ef49f36c7f6eef15beaf1b6d31b6.exe	43
PID 2084 wrote to memory of 568	2084	b1f5c58a4cd3dc1294572b64af6154b02bc7ef49f36c7f6eef15beaf1b6d31b6.exe	43
PID 2012 wrote to memory of 852	2012	Unicorn-1550.exe	44
PID 2012 wrote to memory of 852	2012	Unicorn-1550.exe	44
PID 2012 wrote to memory of 852	2012	Unicorn-1550.exe	44
PID 2012 wrote to memory of 852	2012	Unicorn-1550.exe	44
PID 2704 wrote to memory of 2900	2704	Unicorn-63644.exe	45
PID 2704 wrote to memory of 2900	2704	Unicorn-63644.exe	45
PID 2704 wrote to memory of 2900	2704	Unicorn-63644.exe	45
PID 2704 wrote to memory of 2900	2704	Unicorn-63644.exe	45
PID 772 wrote to memory of 1312	772	Unicorn-17577.exe	46
PID 772 wrote to memory of 1312	772	Unicorn-17577.exe	46
PID 772 wrote to memory of 1312	772	Unicorn-17577.exe	46
PID 772 wrote to memory of 1312	772	Unicorn-17577.exe	46
PID 2628 wrote to memory of 2040	2628	Unicorn-63248.exe	48
PID 2628 wrote to memory of 2040	2628	Unicorn-63248.exe	48
PID 2628 wrote to memory of 2040	2628	Unicorn-63248.exe	48
PID 2628 wrote to memory of 2040	2628	Unicorn-63248.exe	48

C:\Users\Admin\AppData\Local\Temp\b1f5c58a4cd3dc1294572b64af6154b02bc7ef49f36c7f6eef15beaf1b6d31b6.exe
"C:\Users\Admin\AppData\Local\Temp\b1f5c58a4cd3dc1294572b64af6154b02bc7ef49f36c7f6eef15beaf1b6d31b6.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2084
- C:\Users\Admin\AppData\Local\Temp\Unicorn-1550.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-1550.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2012
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25700.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25700.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23443.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23443.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17577.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63524.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57108.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63040.exe
        8⤵
        
        PID:3024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21440.exe
        9⤵
        
        PID:2152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59456.exe
        10⤵
        
        PID:6576
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3024 -s 236
        9⤵
        Program crash
        
        PID:3740
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1820 -s 236
        8⤵
        Program crash
        
        PID:1824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64389.exe
        7⤵
        
        PID:2932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33434.exe
        8⤵
        
        PID:916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49953.exe
        9⤵
        
        PID:3300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35606.exe
        9⤵
        
        PID:4348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33815.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:5856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40575.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:6264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46897.exe
        9⤵
        
        PID:7912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64402.exe
        8⤵
        
        PID:3520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8814.exe
        8⤵
        
        PID:4708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18111.exe
        8⤵
        
        PID:5288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23989.exe
        8⤵
        
        PID:6060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21675.exe
        8⤵
        
        PID:6444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18390.exe
        8⤵
        
        PID:7420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25959.exe
        7⤵
        
        PID:1796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54318.exe
        7⤵
        
        PID:3508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30535.exe
        7⤵
        
        PID:4208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21968.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9228.exe
        7⤵
        
        PID:6316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14099.exe
        7⤵
        
        PID:7180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52702.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53168.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31362.exe
        8⤵
        
        PID:3692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55074.exe
        8⤵
        
        PID:4940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32339.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:2264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38977.exe
        8⤵
        
        PID:6744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61928.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:7752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13992.exe
        7⤵
        
        PID:3836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3272.exe
        7⤵
        
        PID:4864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35709.exe
        7⤵
        
        PID:5364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11471.exe
        7⤵
        
        PID:6784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48459.exe
        7⤵
        
        PID:7808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53857.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55767.exe
        7⤵
        
        PID:3084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62977.exe
        7⤵
        
        PID:4532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29843.exe
        7⤵
        
        PID:5308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48868.exe
        7⤵
        
        PID:6816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31393.exe
        7⤵
        
        PID:7828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29819.exe
        7⤵
        
        PID:8108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65445.exe
        6⤵
        
        PID:3272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6014.exe
        6⤵
        
        PID:4628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27695.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20772.exe
        6⤵
        
        PID:5924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1367.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12412.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43658.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57235.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17929.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11971.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:2344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2648.exe
        9⤵
        
        PID:1636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60621.exe
        9⤵
        
        PID:3600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32339.exe
        9⤵
        
        PID:4656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38977.exe
        9⤵
        
        PID:6728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61928.exe
        9⤵
        
        PID:7760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-598.exe
        8⤵
        
        PID:2936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8819.exe
        8⤵
        
        PID:3568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38205.exe
        8⤵
        
        PID:4768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4783.exe
        8⤵
        
        PID:5616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5832.exe
        8⤵
        
        PID:6680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49143.exe
        8⤵
        
        PID:7472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3227.exe
        7⤵
        
        PID:2200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40723.exe
        8⤵
        
        PID:2772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3272.exe
        8⤵
        
        PID:4904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18111.exe
        8⤵
        
        PID:5280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44083.exe
        8⤵
        
        PID:5544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21675.exe
        8⤵
        
        PID:6212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53943.exe
        8⤵
        
        PID:7176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19927.exe
        7⤵
        
        PID:2496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57824.exe
        7⤵
        
        PID:4228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44231.exe
        7⤵
        
        PID:4236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3707.exe
        7⤵
        
        PID:5964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22897.exe
        7⤵
        
        PID:6868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46963.exe
        7⤵
        
        PID:7628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59023.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1795.exe
        7⤵
        
        PID:2768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-588.exe
        8⤵
        
        PID:2912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58104.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18111.exe
        8⤵
        
        PID:5272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44083.exe
        8⤵
        
        PID:5968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21675.exe
        8⤵
        
        PID:6440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18390.exe
        8⤵
        
        PID:1692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63688.exe
        7⤵
        
        PID:3216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41471.exe
        7⤵
        
        PID:4468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25149.exe
        7⤵
        
        PID:5740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61346.exe
        7⤵
        
        PID:6200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37060.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24373.exe
        7⤵
        
        PID:7960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1119.exe
        6⤵
        
        PID:3048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65412.exe
        7⤵
        
        PID:4076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35606.exe
        7⤵
        
        PID:4344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33815.exe
        7⤵
        
        PID:5800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12344.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35069.exe
        7⤵
        
        PID:6500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45904.exe
        7⤵
        
        PID:7884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45518.exe
        6⤵
        
        PID:3240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6014.exe
        6⤵
        
        PID:4644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27695.exe
        6⤵
        
        PID:4548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20772.exe
        6⤵
        
        PID:5932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1367.exe
        6⤵
        
        PID:6632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22277.exe
        6⤵
        
        PID:7496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37950.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38214.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60781.exe
        7⤵
        
        PID:2712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17937.exe
        8⤵
        
        PID:3384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60616.exe
        8⤵
        
        PID:4668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32339.exe
        8⤵
        
        PID:2292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38977.exe
        8⤵
        
        PID:6736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25274.exe
        8⤵
        
        PID:7524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64402.exe
        7⤵
        
        PID:3512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35713.exe
        7⤵
        
        PID:5072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27401.exe
        7⤵
        
        PID:4600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39507.exe
        7⤵
        
        PID:6696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59408.exe
        7⤵
        
        PID:7596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34857.exe
        7⤵
        
        PID:7644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29197.exe
        6⤵
        
        PID:2004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34457.exe
        7⤵
        
        PID:5952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58828.exe
        7⤵
        
        PID:6236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18798.exe
        7⤵
        
        PID:8032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51656.exe
        6⤵
        
        PID:3612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31604.exe
        6⤵
        
        PID:4136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21968.exe
        6⤵
        
        PID:5420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9228.exe
        6⤵
        
        PID:6352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59900.exe
        6⤵
        
        PID:8160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5852.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32508.exe
        6⤵
        
        PID:2224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40978.exe
        6⤵
        
        PID:4292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48357.exe
        6⤵
        
        PID:5316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46300.exe
        6⤵
        
        PID:6952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26928.exe
        6⤵
        
        PID:7816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38736.exe
        5⤵
        
        PID:1860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55021.exe
        5⤵
        
        PID:3320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27574.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2989.exe
        5⤵
        
        PID:5180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11875.exe
        5⤵
        
        PID:5748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61262.exe
        5⤵
        
        PID:7468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57394.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57394.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15216.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43471.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33434.exe
        7⤵
        
        PID:2328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64234.exe
        8⤵
        
        PID:5024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31759.exe
        8⤵
        
        PID:5400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26789.exe
        8⤵
        
        PID:6080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46876.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:7136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2593.exe
        8⤵
        
        PID:7324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50644.exe
        7⤵
        
        PID:3340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11417.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27611.exe
        7⤵
        
        PID:5736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35069.exe
        7⤵
        
        PID:7100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45904.exe
        7⤵
        
        PID:4652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12224.exe
        6⤵
        
        PID:840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3253.exe
        6⤵
        
        PID:3896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39201.exe
        6⤵
        
        PID:4212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38504.exe
        6⤵
        
        PID:5580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57700.exe
        6⤵
        
        PID:6456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24373.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10288.exe
        6⤵
        
        PID:2380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2536.exe
        7⤵
        
        PID:3864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8620.exe
        7⤵
        
        PID:5472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60806.exe
        7⤵
        
        PID:6112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31801.exe
        7⤵
        
        PID:5884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51109.exe
        7⤵
        
        PID:7640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49953.exe
        6⤵
        
        PID:3152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35606.exe
        6⤵
        
        PID:4364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33815.exe
        6⤵
        
        PID:5768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12344.exe
        6⤵
        
        PID:5920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35069.exe
        6⤵
        
        PID:7120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45904.exe
        6⤵
        
        PID:2508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59062.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4281.exe
        6⤵
        
        PID:3424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21870.exe
        6⤵
        
        PID:4412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27949.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21009.exe
        6⤵
        
        PID:6160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36529.exe
        6⤵
        
        PID:6864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41816.exe
        5⤵
        
        PID:3632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22228.exe
        5⤵
        
        PID:4100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-192.exe
        5⤵
        
        PID:5972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2454.exe
        5⤵
        
        PID:6324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19411.exe
        5⤵
        
        PID:7316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55552.exe
        5⤵
        
        PID:7492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6791.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6791.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11950.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56611.exe
        6⤵
        
        PID:2532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14684.exe
        6⤵
        
        PID:3552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29539.exe
        6⤵
        
        PID:4780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39507.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63945.exe
        6⤵
        
        PID:7564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45446.exe
        5⤵
        
        PID:1500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14684.exe
        5⤵
        
        PID:2436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29539.exe
        5⤵
        
        PID:4596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39507.exe
        5⤵
        
        PID:6720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57462.exe
        5⤵
        
        PID:7720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33772.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33772.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23107.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64378.exe
        6⤵
        
        PID:6556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52261.exe
        6⤵
        
        PID:7612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20986.exe
        5⤵
        
        PID:3120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61303.exe
        5⤵
        
        PID:5536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58006.exe
        5⤵
        
        PID:5380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21675.exe
        5⤵
        
        PID:6476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51639.exe
        5⤵
        
        PID:7652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40256.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40256.exe
      4⤵
      PID:2644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5740.exe
        5⤵
        
        PID:3380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5552.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36277.exe
        5⤵
        
        PID:5880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51605.exe
        5⤵
        
        PID:7060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6354.exe
        5⤵
        
        PID:6572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32452.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32452.exe
      4⤵
      PID:3332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10604.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10604.exe
      4⤵
      PID:2464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12168.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12168.exe
      4⤵
      PID:5484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52099.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52099.exe
      4⤵
      PID:6416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50765.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50765.exe
      4⤵
      PID:7188
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33369.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33369.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27110.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27110.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:1784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6897.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22734.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22491.exe
        7⤵
        
        PID:2796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5727.exe
        8⤵
        
        PID:2560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-399.exe
        9⤵
        
        PID:7784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2320.exe
        8⤵
        
        PID:3868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33815.exe
        8⤵
        
        PID:5776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12344.exe
        8⤵
        
        PID:5720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13456.exe
        8⤵
        
        PID:7692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13568.exe
        7⤵
        
        PID:2868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9029.exe
        8⤵
        
        PID:6104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63108.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22414.exe
        8⤵
        
        PID:7988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34913.exe
        7⤵
        
        PID:3496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40270.exe
        7⤵
        
        PID:5116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38504.exe
        7⤵
        
        PID:5324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57700.exe
        7⤵
        
        PID:6448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3585.exe
        6⤵
        
        PID:1128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41102.exe
        7⤵
        
        PID:3196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45956.exe
        7⤵
        
        PID:4580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15126.exe
        7⤵
        
        PID:5236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52748.exe
        7⤵
        
        PID:5628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38211.exe
        7⤵
        
        PID:7124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1325.exe
        7⤵
        
        PID:7512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8158.exe
        6⤵
        
        PID:3352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14679.exe
        6⤵
        
        PID:4636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29539.exe
        6⤵
        
        PID:4724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53785.exe
        6⤵
        
        PID:5664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22897.exe
        6⤵
        
        PID:7028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31644.exe
        6⤵
        
        PID:7936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36500.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12386.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39936.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41372.exe
        8⤵
        
        PID:6896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13808.exe
        8⤵
        
        PID:7584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2320.exe
        7⤵
        
        PID:3884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33335.exe
        7⤵
        
        PID:4460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47169.exe
        7⤵
        
        PID:5528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8698.exe
        7⤵
        
        PID:6304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18564.exe
        7⤵
        
        PID:7192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1513.exe
        6⤵
        
        PID:1044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1802.exe
        7⤵
        
        PID:6392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5255.exe
        7⤵
        
        PID:8164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34721.exe
        6⤵
        
        PID:3124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40270.exe
        6⤵
        
        PID:1656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38504.exe
        6⤵
        
        PID:5552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57700.exe
        6⤵
        
        PID:6468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35630.exe
        6⤵
        
        PID:7380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56910.exe
        5⤵
        Suspicious use of SetWindowsHookEx
        
        PID:1768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40247.exe
        6⤵
        
        PID:1260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26238.exe
        7⤵
        
        PID:3596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61755.exe
        7⤵
        
        PID:4116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19527.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10589.exe
        7⤵
        
        PID:6332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9877.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48331.exe
        7⤵
        
        PID:7956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65412.exe
        6⤵
        
        PID:4068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35606.exe
        6⤵
        
        PID:4332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-700.exe
        6⤵
        
        PID:5584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21842.exe
        6⤵
        
        PID:7008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31988.exe
        6⤵
        
        PID:8012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13863.exe
        5⤵
        
        PID:1924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45093.exe
        6⤵
        
        PID:3800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55074.exe
        6⤵
        
        PID:4956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32339.exe
        6⤵
        
        PID:4660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38977.exe
        6⤵
        
        PID:6760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61928.exe
        6⤵
        
        PID:7744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60888.exe
        5⤵
        
        PID:3324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16270.exe
        5⤵
        
        PID:4372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25680.exe
        5⤵
        
        PID:5712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56880.exe
        5⤵
        
        PID:6152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10194.exe
        5⤵
        
        PID:6540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23238.exe
        5⤵
        
        PID:7980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52569.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52569.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57108.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15002.exe
        6⤵
        
        PID:1404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47666.exe
        7⤵
        
        PID:1720
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1404 -s 216
        7⤵
        Program crash
        
        PID:3860
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1444 -s 236
        6⤵
        Program crash
        
        PID:640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20575.exe
        5⤵
        
        PID:2992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4281.exe
        6⤵
        
        PID:3448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21870.exe
        6⤵
        
        PID:4444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27949.exe
        6⤵
        
        PID:5832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21009.exe
        6⤵
        
        PID:6168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36529.exe
        6⤵
        
        PID:6516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28838.exe
        6⤵
        
        PID:7984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57328.exe
        5⤵
        
        PID:3652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9137.exe
        5⤵
        
        PID:4888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29539.exe
        5⤵
        
        PID:1920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39507.exe
        5⤵
        
        PID:6704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57462.exe
        5⤵
        
        PID:7728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-900.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-900.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48570.exe
        5⤵
        
        PID:1004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29250.exe
        6⤵
        
        PID:3760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55074.exe
        6⤵
        
        PID:4932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32339.exe
        6⤵
        
        PID:4564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38977.exe
        6⤵
        
        PID:6768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25274.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63688.exe
        5⤵
        
        PID:3192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25518.exe
        5⤵
        
        PID:1576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48357.exe
        5⤵
        
        PID:5140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46300.exe
        5⤵
        
        PID:6912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57462.exe
        5⤵
        
        PID:7664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22828.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22828.exe
      4⤵
      PID:2752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46033.exe
        5⤵
        
        PID:3012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13671.exe
        6⤵
        
        PID:5060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5792.exe
        6⤵
        
        PID:5988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4724.exe
        6⤵
        
        PID:6360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33810.exe
        6⤵
        
        PID:7388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16351.exe
        6⤵
        
        PID:7704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54235.exe
        5⤵
        
        PID:4028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34404.exe
        5⤵
        
        PID:5084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47169.exe
        5⤵
        
        PID:5504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8698.exe
        5⤵
        
        PID:6312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64366.exe
        5⤵
        
        PID:8064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34243.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34243.exe
      4⤵
      PID:2664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42880.exe
        5⤵
        
        PID:5160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63300.exe
        5⤵
        
        PID:6408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37900.exe
        5⤵
        
        PID:7216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62257.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62257.exe
      4⤵
      PID:3812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32135.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32135.exe
      4⤵
      PID:3848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17503.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17503.exe
      4⤵
      PID:5432
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47899.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47899.exe
      4⤵
      PID:7000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12964.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12964.exe
      4⤵
      PID:7328
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34684.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34684.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6897.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6897.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39666.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2452
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2452 -s 148
        6⤵
        Program crash
        
        PID:316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55651.exe
        5⤵
        
        PID:1604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-472.exe
        5⤵
        
        PID:4856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10866.exe
        5⤵
        
        PID:4588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5313.exe
        5⤵
        
        PID:6136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1367.exe
        5⤵
        
        PID:6628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22277.exe
        5⤵
        
        PID:7476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36500.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36500.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1987.exe
        5⤵
        
        PID:2876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5715.exe
        6⤵
        
        PID:3164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62977.exe
        6⤵
        
        PID:4540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15818.exe
        6⤵
        
        PID:4128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16727.exe
        6⤵
        
        PID:6008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50926.exe
        6⤵
        
        PID:6340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25675.exe
        6⤵
        
        PID:7400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61464.exe
        6⤵
        
        PID:7240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63688.exe
        5⤵
        
        PID:3160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14000.exe
        5⤵
        
        PID:4504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39034.exe
        5⤵
        
        PID:5496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53234.exe
        5⤵
        
        PID:6300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54565.exe
        5⤵
        
        PID:8132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39982.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39982.exe
      4⤵
      PID:1996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4281.exe
        5⤵
        
        PID:3416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21870.exe
        5⤵
        
        PID:4416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18130.exe
        5⤵
        
        PID:5636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19109.exe
        5⤵
        
        PID:7072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14922.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10810.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10810.exe
      4⤵
      PID:4060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16270.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16270.exe
      4⤵
      PID:4260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25680.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25680.exe
      4⤵
      PID:5704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56880.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56880.exe
      4⤵
      PID:6056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25269.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25269.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16405.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16405.exe
      4⤵
      PID:7220
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6632.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6632.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12178.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12178.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40247.exe
        5⤵
        
        PID:1660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4281.exe
        6⤵
        
        PID:3472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21870.exe
        6⤵
        
        PID:4436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27949.exe
        6⤵
        
        PID:5760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21009.exe
        6⤵
        
        PID:6176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29831.exe
        6⤵
        
        PID:7920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49953.exe
        5⤵
        
        PID:3292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35606.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33815.exe
        5⤵
        
        PID:5848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53228.exe
        5⤵
        
        PID:6248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31988.exe
        5⤵
        
        PID:7996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21371.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21371.exe
      4⤵
      PID:2660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19741.exe
        5⤵
        
        PID:4032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37137.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16139.exe
        5⤵
        
        PID:5440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49730.exe
        5⤵
        
        PID:6808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25274.exe
        5⤵
        
        PID:7540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4016.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4016.exe
      4⤵
      PID:3128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32805.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32805.exe
      4⤵
      PID:4356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8614.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8614.exe
      4⤵
      PID:5696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12874.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12874.exe
      4⤵
      PID:5872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30604.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30604.exe
      4⤵
      PID:6512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19038.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19038.exe
      4⤵
      PID:784
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17233.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17233.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18718.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18718.exe
      4⤵
      PID:956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11070.exe
        5⤵
        
        PID:1300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3272.exe
        5⤵
        
        PID:4872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18111.exe
        5⤵
        
        PID:5256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23989.exe
        5⤵
        
        PID:6032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21675.exe
        5⤵
        
        PID:6460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53943.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9212.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9212.exe
      4⤵
      PID:280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8819.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8819.exe
      4⤵
      PID:3492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38205.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38205.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4783.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4783.exe
      4⤵
      PID:5412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5832.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5832.exe
      4⤵
      PID:6688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39278.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39278.exe
      4⤵
      PID:7904
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31757.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31757.exe
    3⤵
    PID:2396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53168.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53168.exe
      4⤵
      PID:2336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18205.exe
        5⤵
        
        PID:3528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21870.exe
        5⤵
        
        PID:4424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16139.exe
        5⤵
        
        PID:5452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18540.exe
        5⤵
        
        PID:7108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6102.exe
        5⤵
        
        PID:7868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49953.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49953.exe
      4⤵
      PID:3256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35606.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35606.exe
      4⤵
      PID:4368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33815.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33815.exe
      4⤵
      PID:5752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7518.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7518.exe
      4⤵
      PID:5728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19994.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19994.exe
      4⤵
      PID:7040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45904.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45904.exe
      4⤵
      PID:7908
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51587.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51587.exe
    3⤵
    PID:2472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-780.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-780.exe
      4⤵
      PID:2996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5696.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5696.exe
      4⤵
      PID:5000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38205.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38205.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4783.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4783.exe
      4⤵
      PID:5604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5832.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5832.exe
      4⤵
      PID:6828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39278.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39278.exe
      4⤵
      PID:7888
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23532.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23532.exe
    3⤵
    PID:3136
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47576.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47576.exe
    3⤵
    PID:4508
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15022.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15022.exe
    3⤵
    PID:6124
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45731.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45731.exe
    3⤵
    PID:6856
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45309.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45309.exe
    3⤵
    PID:7552
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2897.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2897.exe
    3⤵
    PID:7824
- C:\Users\Admin\AppData\Local\Temp\Unicorn-63644.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-63644.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2704
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42794.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42794.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17577.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17577.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13638.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37809.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53917.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41048.exe
        8⤵
        
        PID:536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65412.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:4084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35606.exe
        9⤵
        
        PID:4308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33815.exe
        9⤵
        
        PID:5680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12344.exe
        9⤵
        
        PID:6024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35069.exe
        9⤵
        
        PID:7104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45904.exe
        9⤵
        
        PID:8004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59192.exe
        8⤵
        
        PID:3304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8814.exe
        8⤵
        
        PID:4700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38205.exe
        8⤵
        
        PID:4204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4783.exe
        8⤵
        
        PID:5464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10407.exe
        8⤵
        
        PID:7364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16735.exe
        7⤵
        
        PID:3068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33858.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34184.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:1012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64893.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1259.exe
        8⤵
        
        PID:6792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3743.exe
        8⤵
        
        PID:7604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-239.exe
        7⤵
        
        PID:3576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45048.exe
        7⤵
        
        PID:4772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48357.exe
        7⤵
        
        PID:6140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48796.exe
        7⤵
        
        PID:6848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11443.exe
        7⤵
        
        PID:7544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4297.exe
        7⤵
        
        PID:7948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40512.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53168.exe
        7⤵
        
        PID:952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60628.exe
        8⤵
        
        PID:3748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58495.exe
        8⤵
        
        PID:3220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8021.exe
        8⤵
        
        PID:5152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45770.exe
        8⤵
        
        PID:6928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61928.exe
        8⤵
        
        PID:7768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49953.exe
        7⤵
        
        PID:3284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35606.exe
        7⤵
        
        PID:4316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33815.exe
        7⤵
        
        PID:5808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57788.exe
        7⤵
        
        PID:6252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35069.exe
        7⤵
        
        PID:7044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45904.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47038.exe
        6⤵
        
        PID:3028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60628.exe
        7⤵
        
        PID:3756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41282.exe
        7⤵
        
        PID:4552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8021.exe
        7⤵
        
        PID:5184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45770.exe
        7⤵
        
        PID:6944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31393.exe
        7⤵
        
        PID:7800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4016.exe
        6⤵
        
        PID:3132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32805.exe
        6⤵
        
        PID:4252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8614.exe
        6⤵
        
        PID:5688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12874.exe
        6⤵
        
        PID:5668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20031.exe
        6⤵
        
        PID:7896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3444.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1987.exe
        6⤵
        
        PID:2684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38056.exe
        7⤵
        
        PID:3460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60616.exe
        7⤵
        
        PID:4688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32339.exe
        7⤵
        
        PID:2780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13448.exe
        7⤵
        
        PID:6100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22367.exe
        7⤵
        
        PID:6964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18564.exe
        7⤵
        
        PID:3780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35901.exe
        6⤵
        
        PID:3076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11175.exe
        6⤵
        
        PID:4520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64893.exe
        6⤵
        
        PID:5204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29234.exe
        6⤵
        
        PID:6972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48459.exe
        6⤵
        
        PID:7836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38400.exe
        5⤵
        
        PID:3052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47666.exe
        6⤵
        
        PID:2280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3272.exe
        6⤵
        
        PID:4924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18111.exe
        6⤵
        
        PID:5264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23989.exe
        6⤵
        
        PID:5388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21675.exe
        6⤵
        
        PID:6284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35988.exe
        6⤵
        
        PID:7592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31475.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6019.exe
        5⤵
        
        PID:3372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28655.exe
        5⤵
        
        PID:5168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5313.exe
        5⤵
        
        PID:6084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1367.exe
        5⤵
        
        PID:7016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41820.exe
        5⤵
        
        PID:7700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65340.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65340.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57108.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3060
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3060 -s 220
        6⤵
        Program crash
        
        PID:648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46600.exe
        5⤵
        
        PID:2388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61781.exe
        6⤵
        
        PID:2744
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2388 -s 216
        6⤵
        Program crash
        
        PID:3892
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 376 -s 240
        5⤵
        Program crash
        
        PID:2140
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2828 -s 240
      4⤵
      Loads dropped DLL
      Program crash
      PID:3036
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63248.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63248.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63524.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63524.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25038.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41982.exe
        6⤵
        
        PID:2216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40531.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60621.exe
        7⤵
        
        PID:4048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32339.exe
        7⤵
        
        PID:5096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13448.exe
        7⤵
        
        PID:1728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22367.exe
        7⤵
        
        PID:6844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22212.exe
        7⤵
        
        PID:7708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21625.exe
        6⤵
        
        PID:2096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42260.exe
        6⤵
        
        PID:3556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38205.exe
        6⤵
        
        PID:528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4783.exe
        6⤵
        
        PID:5612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5832.exe
        6⤵
        
        PID:6776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10366.exe
        6⤵
        
        PID:8020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6413.exe
        5⤵
        
        PID:1552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13992.exe
        6⤵
        
        PID:3828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3272.exe
        6⤵
        
        PID:4880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38205.exe
        6⤵
        
        PID:928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4783.exe
        6⤵
        
        PID:5632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5832.exe
        6⤵
        
        PID:6908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29717.exe
        6⤵
        
        PID:8188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19927.exe
        5⤵
        
        PID:2576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57824.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12326.exe
        5⤵
        
        PID:5216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27547.exe
        5⤵
        
        PID:5888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38741.exe
        5⤵
        
        PID:6196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18707.exe
        5⤵
        
        PID:8144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17943.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17943.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10082.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24598.exe
        6⤵
        
        PID:2180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65412.exe
        7⤵
        
        PID:3092
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2180 -s 216
        7⤵
        Program crash
        
        PID:5108
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2808 -s 236
        6⤵
        Program crash
        
        PID:2896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12415.exe
        5⤵
        
        PID:2144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4281.exe
        6⤵
        
        PID:3444
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2144 -s 216
        6⤵
        Program crash
        
        PID:5100
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2972 -s 240
        5⤵
        Program crash
        
        PID:1472
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2628 -s 240
      4⤵
      Program crash
      PID:624
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2704 -s 240
    3⤵
    - Loads dropped DLL
    - Program crash
    PID:2900
- C:\Users\Admin\AppData\Local\Temp\Unicorn-47105.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-47105.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:2556
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17577.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17577.exe
    3⤵
    - Executes dropped EXE
    PID:1304
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31489.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31489.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12178.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12178.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14569.exe
        5⤵
        
        PID:2272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43796.exe
        6⤵
        
        PID:3548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64893.exe
        6⤵
        
        PID:5336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29234.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48459.exe
        6⤵
        
        PID:7844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49953.exe
        5⤵
        
        PID:3248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35606.exe
        5⤵
        
        PID:4324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33815.exe
        5⤵
        
        PID:5816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53228.exe
        5⤵
        
        PID:6232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31988.exe
        5⤵
        
        PID:8024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34116.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34116.exe
      4⤵
      PID:1392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1921.exe
        5⤵
        
        PID:3344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20669.exe
        5⤵
        
        PID:2428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41304.exe
        5⤵
        
        PID:5596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17363.exe
        5⤵
        
        PID:6384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35099.exe
        5⤵
        
        PID:7340
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19475.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19475.exe
      4⤵
      PID:4092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8983.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8983.exe
      4⤵
      PID:4184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65423.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65423.exe
      4⤵
      PID:5200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24769.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24769.exe
      4⤵
      PID:6936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52127.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52127.exe
      4⤵
      PID:7684
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20033.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20033.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56699.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56699.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61512.exe
        5⤵
        
        PID:3640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55074.exe
        5⤵
        
        PID:4916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15126.exe
        5⤵
        
        PID:5208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52748.exe
        5⤵
        
        PID:5960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38211.exe
        5⤵
        
        PID:7148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1325.exe
        5⤵
        
        PID:7456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18190.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18190.exe
      4⤵
      PID:3428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8814.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8814.exe
      4⤵
      PID:4716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3036.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3036.exe
      4⤵
      PID:5340
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23989.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23989.exe
      4⤵
      PID:5348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21675.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21675.exe
      4⤵
      PID:6484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53943.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53943.exe
      4⤵
      PID:7204
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40176.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40176.exe
    3⤵
    PID:2544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65412.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65412.exe
      4⤵
      PID:3112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35606.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35606.exe
      4⤵
      PID:4296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33815.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33815.exe
      4⤵
      PID:5792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12344.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12344.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35069.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35069.exe
      4⤵
      PID:7096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45904.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45904.exe
      4⤵
      PID:8084
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27589.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27589.exe
    3⤵
    PID:3532
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55016.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55016.exe
    3⤵
    PID:4680
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30070.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30070.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4180
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49319.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49319.exe
    3⤵
    PID:6108
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61569.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61569.exe
    3⤵
    PID:6676
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16612.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16612.exe
    3⤵
    PID:7852
- C:\Users\Admin\AppData\Local\Temp\Unicorn-26845.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-26845.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:568
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6425.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6425.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22729.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22729.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36601.exe
        5⤵
        
        PID:2368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45093.exe
        6⤵
        
        PID:3792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55074.exe
        6⤵
        
        PID:4948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32339.exe
        6⤵
        
        PID:5080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49730.exe
        6⤵
        
        PID:6800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25274.exe
        6⤵
        
        PID:7532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52041.exe
        5⤵
        
        PID:3588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39183.exe
        5⤵
        
        PID:4760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52896.exe
        5⤵
        
        PID:4516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20242.exe
        5⤵
        
        PID:5940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5832.exe
        5⤵
        
        PID:6884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49143.exe
        5⤵
        
        PID:7428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19973.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19973.exe
      4⤵
      PID:552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4281.exe
        5⤵
        
        PID:3468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21870.exe
        5⤵
        
        PID:4452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27949.exe
        5⤵
        
        PID:5824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21009.exe
        5⤵
        
        PID:6184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36529.exe
        5⤵
        
        PID:6880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28838.exe
        5⤵
        
        PID:8072
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22927.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22927.exe
      4⤵
      PID:3728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9137.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9137.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9446.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9446.exe
      4⤵
      PID:5244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27547.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27547.exe
      4⤵
      PID:5892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38741.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38741.exe
      4⤵
      PID:7164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62397.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62397.exe
      4⤵
      PID:7424
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32083.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32083.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43174.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43174.exe
      4⤵
      PID:1940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29235.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63300.exe
        5⤵
        
        PID:6400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50645.exe
        5⤵
        
        PID:8056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2320.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2320.exe
      4⤵
      PID:3876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33815.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33815.exe
      4⤵
      PID:5784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2574.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2574.exe
      4⤵
      PID:7048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16528.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16528.exe
      4⤵
      PID:8112
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39671.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39671.exe
    3⤵
    PID:1512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-566.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-566.exe
      4⤵
      PID:7224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53932.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53932.exe
      4⤵
      PID:3684
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29290.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29290.exe
    3⤵
    PID:3572
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15069.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15069.exe
    3⤵
    PID:4788
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39034.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39034.exe
    3⤵
    PID:5468
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53234.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53234.exe
    3⤵
    PID:6288
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21509.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21509.exe
    3⤵
    PID:8076
- C:\Users\Admin\AppData\Local\Temp\Unicorn-63504.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-63504.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1776
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41047.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41047.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10269.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10269.exe
      4⤵
      PID:992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23308.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37645.exe
        6⤵
        
        PID:3824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20669.exe
        6⤵
        
        PID:4140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41304.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17363.exe
        6⤵
        
        PID:6368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15364.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16055.exe
        5⤵
        
        PID:4052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40270.exe
        5⤵
        
        PID:4124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38504.exe
        5⤵
        
        PID:5428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57700.exe
        5⤵
        
        PID:6424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15894.exe
        5⤵
        
        PID:8148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20381.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20381.exe
      4⤵
      PID:2296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15653.exe
        5⤵
        
        PID:3788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19600.exe
        5⤵
        
        PID:2960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41304.exe
        5⤵
        
        PID:5532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17363.exe
        5⤵
        
        PID:6376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35099.exe
        5⤵
        
        PID:7208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13610.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13610.exe
      4⤵
      PID:3104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25518.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25518.exe
      4⤵
      PID:4200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48357.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48357.exe
      4⤵
      PID:5164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46300.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46300.exe
      4⤵
      PID:6920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57462.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57462.exe
      4⤵
      PID:7712
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22116.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22116.exe
    3⤵
    PID:2092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7474.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7474.exe
      4⤵
      PID:936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40169.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40169.exe
      4⤵
      PID:4276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29843.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29843.exe
      4⤵
      PID:5300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32655.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32655.exe
      4⤵
      PID:5296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38211.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38211.exe
      4⤵
      PID:7132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1325.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1325.exe
      4⤵
      PID:7452
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1344.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1344.exe
    3⤵
    PID:2184
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59770.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59770.exe
    3⤵
    PID:4264
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9446.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9446.exe
    3⤵
    PID:5228
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27547.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27547.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5904
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38741.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38741.exe
    3⤵
    PID:7156
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18707.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18707.exe
    3⤵
    PID:8180
- C:\Users\Admin\AppData\Local\Temp\Unicorn-34932.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-34932.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1816
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18718.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18718.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62134.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62134.exe
      4⤵
      PID:2432
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60621.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60621.exe
      4⤵
      PID:3648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32339.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32339.exe
      4⤵
      PID:1764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13448.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13448.exe
      4⤵
      PID:6072
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22367.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22367.exe
      4⤵
      PID:6836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64366.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64366.exe
      4⤵
      PID:8100
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23711.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23711.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:484
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8819.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8819.exe
    3⤵
    PID:3368
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38205.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38205.exe
    3⤵
    PID:4664
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4783.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4783.exe
    3⤵
    PID:5416
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5832.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5832.exe
    3⤵
    PID:6996
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3149.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3149.exe
    3⤵
    PID:7656
- C:\Users\Admin\AppData\Local\Temp\Unicorn-48823.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-48823.exe
  2⤵
  PID:1068
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47666.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47666.exe
    3⤵
    PID:1368
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60621.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60621.exe
    3⤵
    PID:3628
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32339.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32339.exe
    3⤵
    PID:4984
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38977.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38977.exe
    3⤵
    PID:6752
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61928.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61928.exe
    3⤵
    PID:7736
- C:\Users\Admin\AppData\Local\Temp\Unicorn-18503.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-18503.exe
  2⤵
  PID:1556
- C:\Users\Admin\AppData\Local\Temp\Unicorn-45220.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-45220.exe
  2⤵
  PID:3488
- C:\Users\Admin\AppData\Local\Temp\Unicorn-7404.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-7404.exe
  2⤵
  PID:3004
- C:\Users\Admin\AppData\Local\Temp\Unicorn-20449.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-20449.exe
  2⤵
  PID:2340
- C:\Users\Admin\AppData\Local\Temp\Unicorn-19832.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-19832.exe
  2⤵
  PID:7024
- C:\Users\Admin\AppData\Local\Temp\Unicorn-65510.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-65510.exe
  2⤵
  PID:7952

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-13610.exe

Filesize
468KB

MD5
c0ad18f0fd9c682eeca0ee25b3805e3e

SHA1
d7ac471ff8017d4500fcef97a4dfed3fc7179f59

SHA256
0ec91207ae467a8781cd66a8cee542ccdf1889752286a47a9f09a46c61347ebc

SHA512
ca31eb61b5186ea865a324aa948f6dbb3c717f164baf87a0ae6c0e906045054ee99aedcc5c750d587665942c009b0c71430227aff0788bbbbe4f7293fe474dac

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-17577.exe

Filesize
468KB

MD5
49255636b85590338c3343adce0c7b89

SHA1
262e8b0e6be072c09c5d520d7bc54a7fe1235550

SHA256
e59305266497234709d1d6c76ec37d3040bdb0af8c81f8e0d55276498d7159f1

SHA512
8b1320644971a1b51f656b7c624c10dec06414ff644fe8793c16f59c4abc8d101c1b1bc0d007ca626ba78597bc61ce5f70acc437ff6bf62638be1ca20479df0f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-26845.exe

Filesize
468KB

MD5
42a3d2554e96bb7cb37e8d25cb0cd8a3

SHA1
135ceb95e16637f9f9c3b079487fa256009db608

SHA256
557aa59c805eb5f7eaa7643f71b297380be68fe3d439109b7be26df2a2cd896d

SHA512
b9f5167fc42b3c8b7d9bdc0441f21cbb5d9a3a180274dd12c55d27b9e489316b30e675b08f4918fed244453da38e220338918f5dcd61b9f4e5f19125676ba8fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-27110.exe

Filesize
468KB

MD5
c4b46c04eacb1e349b72e937fd979b03

SHA1
699d8e73620f1eb1ab9119eeb426f36be952f6c0

SHA256
730ecabc4e37003ac0b6d84dfbe42e328ca3750e36e83a663d6763b80e1101c3

SHA512
2ef3c5acff42f1470a21974117584a36a14adf4ef7e804941e62d169179146163b87ad9f2508cc1e8a1ea184d872989458cefef37417b8006edea6ffa0c9b396

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-34684.exe

Filesize
468KB

MD5
ca73832a935decc0e0d1e5f56ed9e801

SHA1
018961a9aa769fbc73215ebde44a6c2218e3f2a0

SHA256
12df311febbfd49d33187ad1fb61063ff15ee8d47db69ee0eddb248194154c77

SHA512
39289a5bbc7ab911aa010f4cb78ed65edfcff072ebcc37420b787a0fc944743192ca13e82842c007c4653213e277c6a97fa7f7377a2f89c34e3b552db6e8f4fc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39666.exe

Filesize
468KB

MD5
0d9b088f17cbf8684a5467bc81315985

SHA1
af13f0e9e947fda830f44e8f90743ff530747878

SHA256
b56db09a2cfc2aa25640144c1cf69fde676b05ef078665a55dcc1f29143be469

SHA512
bfd539653ceffece383d04cc0db7840c6b355a5af919bf841645b1afaa79fd3abce8374eced9ff184ca934ce61320a5da4568daa08a85cd97e3e4c28d804a10b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5727.exe

Filesize
468KB

MD5
b7b2706f551857c615ec15f97871968c

SHA1
51e80c5f0ed77b092fa32951e6a514aa45db3656

SHA256
5b0a3497364c78084cf7f0ad69f88ba492e0f0b10fd15eaa52de07181f7259ad

SHA512
dfdfb96f1b94a4ab801caacf4df1d55122cdfd2dd1c9605091db9d2cd2e3f574ca23b16ba42dfa12b28adc1fd081fded4ee1431bd1a5104db2912fb50f0a0afe

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-8158.exe

Filesize
468KB

MD5
868dd41121794b4091b35403cb254269

SHA1
1a76b2a9105f62611df514c0ffd8e1dc1730db62

SHA256
1c066eca19906d6220cd213d5bc138f2cc575e90c25def3e827509c0d234ad4b

SHA512
fce1d78ecde2667a9d6d8fd38448f3e7386a14046c0062800522fb3c0c28cb46f49b910ab4d75a639bb6fd4ad0912211f6df738cc4e897f90a06bf1b09dfc2cd

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-1550.exe

Filesize
468KB

MD5
4a2c69c05b7cbab930381a3725271dd7

SHA1
832970622e30749c72bde04c55d3e9cc5df8d22e

SHA256
c054da56792869b08ad3bbf6dbe6001bffa89a65a235cb7b8200bde1b82cdc6b

SHA512
597fd795608636b46f436d19803af62d0ec00eed85fb2c7209417504928e19298e1ba92099e9299b042cdde17e00c4d2add676ec66a9db80e74aa4d568d62a6f

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-23443.exe

Filesize
468KB

MD5
0bcdad1cafd43f07a79c33faf0846af2

SHA1
5550073f729cf20934dc9e12c189692aef24d8b5

SHA256
7ef385d72119ca6f04bec64311c0e03af9a95d3615d4df3ddbb6d920bdc67cca

SHA512
d1631301ad37db21ccb41e9b8b56b148f96cb54a923315a09b806d669cf51e070f8c3ee917ea8821e1a147170237dc50ed0a1dfe7e64d36ede9f812ad00163c6

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-25700.exe

Filesize
468KB

MD5
50f7a1355a31c9c697de679180990c6a

SHA1
593fedea662636ad63db03f90d36e74757cf19f4

SHA256
c4ab3a213e0eac0d818e85db7aa96d4a3629579567ecd825aed6012ebe018b1c

SHA512
3a0b7a54c2eb1f6975d223b75cc13858f1dd864434119f91bc57a304acc6bf511b82bd626ee35abcb2dee4b2f4b8e14d0c080f9e2245cd0036e5cc927ce1f1fa

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-33369.exe

Filesize
468KB

MD5
432be243f41121d552bb35db608188c7

SHA1
901785ed5069cdebc8e348babb55e4873cdc7dba

SHA256
49fc49750f45ca52e7ddd41eced6a3abf5964dd3d498d88fe1ac07cfbcf2df08

SHA512
1cbd59427bd7ba67e3414f09e793e1400a2d755486c1cb0b60cb16a5c22b994b54ef2423c07e0a6f1bda5a199dc5a124865befb182a45e27ed958ddadd45c248

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-42794.exe

Filesize
468KB

MD5
0b3b39ff1fbb99830c64722152ba8718

SHA1
06aab31e9c008e49209c43094ca19cfe4a8822ca

SHA256
d31ab9a93ffa2fa1f3ba02aaa20b294c2beb5691c4cd443c3aae5f2a2162ea34

SHA512
553c53136183a6b0941e8938b84418973bea298dd168cad189f93515d11bea4778d6032cb2c5c34bb5054a32b8c32f8def44006bb5ba3c5e7452abdac6a184be

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-43658.exe

Filesize
468KB

MD5
53b9506b12cbef1ccac1eca00c7a0e6f

SHA1
f617219cbc8843de194d736571483b79b6b5d188

SHA256
3ec6e3e09a0c7990805aed7e08aa35a7664cecc6624dc8a6e329ab8767569d61

SHA512
7f7929cda8c36a7e59f28294ce5a6da20ce95c2b6b164e8d00cadeef4ea4461d33b42b63a1332478e9b7b5f6b2d6e22885417f372261aa6e8cba78d92581574f

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-47105.exe

Filesize
468KB

MD5
96c54394809e47a6f7a0809551b55699

SHA1
67458eb04e73fd043108cc1e70b7d7c6b8afb5d9

SHA256
af720e6885f90493ac284e65004fb4b373580119342f6e9c7a06e965266e7376

SHA512
89ddc4d27715978de28e847ec8347f718a93873aea3727ba91358e232d6031e247e249361a3f0c8ec833b9b2b05de1001a388f668bb1cc1d72d7945526d5fa09

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-57394.exe

Filesize
468KB

MD5
1bfcab8fac76bb05b5906ebc0475e4e9

SHA1
0ff8fd0d2d45feff46f217b604b95747e4fc2d3e

SHA256
66caa33dab9426142553b27750850db08cf6b8ce8fafe2fb674bce8cba9f7281

SHA512
c7f3ca815c46d7b3b5b90d1847147c7193d90bb8d4c05892d13991b0d925949a050901588a6f4e18b947587816cd3e412891e841f051ae0cf76180d2403dfc22

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-63248.exe

Filesize
468KB

MD5
821e3bd9470ee9591ad13cd2daf72dd1

SHA1
3525f9ca97243ab55c3c22289cc61f08b6f88aa0

SHA256
13b7c73c5bbc69917f794e4019a0cbdf7e6aee27011a0b9d12df19b5d3b08fa6

SHA512
dc808e2c4ff67235e07a6aaee00042ee63d2b2092c1ccdc97a441a93e6809fc6f142de98b7211447611ae0ca686af714fdfc92962875e95bd40cd36cf8faeff1

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-63524.exe

Filesize
468KB

MD5
c60bced050bb652bb3db999fecff66e7

SHA1
707027b40f4064f1cbe8a8aa81d97e8294041134

SHA256
561f36585e482c27da17586fa9fd81ae94d4ff14529df717856404e8530e72ba

SHA512
cf4dc26df37ccf42686937077e32e29f6262cad8753cb6ed274b4fe116fc894154599477538bd5c2631849c82a8ba6bc17f8241005482981de938e464c4e294c

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-63644.exe

Filesize
468KB

MD5
c3dc1b5d9d6b7921a42d764e777ad9c6

SHA1
48bc8f2254378df61c30ee7dd24e962623711f65

SHA256
84e8540abd511c930a260b1cbbaceb943ec426a7173ba24b5f8e1b2677a8d5ca

SHA512
4d5bef39756b37732e4bf46bad85a301a592bbeed93e74127e1c1c2d676b9e155564271f344cf483331b75a4ee6876c5e0ccd7fbdb1329fc29f622ceb551e40b

Download Submit
memory/324-201-0x0000000001CA0000-0x0000000001D15000-memory.dmp

Filesize
468KB

Download
memory/324-210-0x0000000001CA0000-0x0000000001D15000-memory.dmp

Filesize
468KB

Download
memory/376-404-0x0000000002450000-0x00000000024C5000-memory.dmp

Filesize
468KB

Download
memory/376-206-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/568-282-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/568-137-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/568-284-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/584-274-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/772-189-0x0000000002610000-0x0000000002685000-memory.dmp

Filesize
468KB

Download
memory/772-175-0x0000000002610000-0x0000000002685000-memory.dmp

Filesize
468KB

Download
memory/772-111-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/804-343-0x00000000025F0000-0x0000000002665000-memory.dmp

Filesize
468KB

Download
memory/852-363-0x00000000026A0000-0x0000000002715000-memory.dmp

Filesize
468KB

Download
memory/852-154-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/852-230-0x00000000026A0000-0x0000000002715000-memory.dmp

Filesize
468KB

Download
memory/852-231-0x00000000026A0000-0x0000000002715000-memory.dmp

Filesize
468KB

Download
memory/988-245-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1052-236-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1060-304-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1312-401-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/1312-403-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/1408-345-0x0000000001F40000-0x0000000001FB5000-memory.dmp

Filesize
468KB

Download
memory/1408-211-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1516-399-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1680-397-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1776-374-0x0000000002570000-0x00000000025E5000-memory.dmp

Filesize
468KB

Download
memory/1776-237-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1776-373-0x0000000002570000-0x00000000025E5000-memory.dmp

Filesize
468KB

Download
memory/1784-370-0x0000000001CB0000-0x0000000001D25000-memory.dmp

Filesize
468KB

Download
memory/1784-232-0x0000000001CB0000-0x0000000001D25000-memory.dmp

Filesize
468KB

Download
memory/1784-142-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1784-364-0x0000000001CB0000-0x0000000001D25000-memory.dmp

Filesize
468KB

Download
memory/1792-313-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1816-381-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1936-234-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2012-67-0x00000000025A0000-0x0000000002615000-memory.dmp

Filesize
468KB

Download
memory/2012-393-0x00000000025A0000-0x0000000002615000-memory.dmp

Filesize
468KB

Download
memory/2012-292-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2012-18-0x00000000025A0000-0x0000000002615000-memory.dmp

Filesize
468KB

Download
memory/2012-24-0x00000000025A0000-0x0000000002615000-memory.dmp

Filesize
468KB

Download
memory/2012-151-0x00000000025A0000-0x0000000002615000-memory.dmp

Filesize
468KB

Download
memory/2012-152-0x00000000025A0000-0x0000000002615000-memory.dmp

Filesize
468KB

Download
memory/2012-362-0x00000000025A0000-0x0000000002615000-memory.dmp

Filesize
468KB

Download
memory/2012-395-0x00000000025A0000-0x0000000002615000-memory.dmp

Filesize
468KB

Download
memory/2040-192-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2084-33-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2084-130-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2084-271-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2084-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2084-5-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2084-135-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2176-302-0x0000000003480000-0x00000000034F5000-memory.dmp

Filesize
468KB

Download
memory/2176-303-0x0000000003480000-0x00000000034F5000-memory.dmp

Filesize
468KB

Download
memory/2196-275-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2196-193-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2196-273-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2460-293-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2556-394-0x00000000024E0000-0x0000000002555000-memory.dmp

Filesize
468KB

Download
memory/2556-372-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2556-77-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2556-244-0x00000000024E0000-0x0000000002555000-memory.dmp

Filesize
468KB

Download
memory/2556-240-0x00000000024E0000-0x0000000002555000-memory.dmp

Filesize
468KB

Download
memory/2568-346-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2568-176-0x0000000000830000-0x00000000008A5000-memory.dmp

Filesize
468KB

Download
memory/2584-344-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2624-347-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2628-190-0x0000000002630000-0x00000000026A5000-memory.dmp

Filesize
468KB

Download
memory/2628-177-0x0000000003160000-0x00000000031D5000-memory.dmp

Filesize
468KB

Download
memory/2628-380-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2628-101-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2628-332-0x0000000003160000-0x00000000031D5000-memory.dmp

Filesize
468KB

Download
memory/2688-360-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2700-322-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2704-331-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2724-69-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2724-233-0x0000000000620000-0x0000000000695000-memory.dmp

Filesize
468KB

Download
memory/2724-122-0x0000000000620000-0x0000000000695000-memory.dmp

Filesize
468KB

Download
memory/2724-369-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2724-127-0x0000000000620000-0x0000000000695000-memory.dmp

Filesize
468KB

Download
memory/2828-199-0x0000000002670000-0x00000000026E5000-memory.dmp

Filesize
468KB

Download
memory/2828-353-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2828-205-0x0000000002670000-0x00000000026E5000-memory.dmp

Filesize
468KB

Download
memory/2828-60-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2888-286-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2892-312-0x0000000002740000-0x00000000027B5000-memory.dmp

Filesize
468KB

Download
memory/2892-191-0x0000000002740000-0x00000000027B5000-memory.dmp

Filesize
468KB

Download
memory/2892-308-0x0000000002740000-0x00000000027B5000-memory.dmp

Filesize
468KB

Download
memory/2892-49-0x0000000002940000-0x00000000029B5000-memory.dmp

Filesize
468KB

Download
memory/2892-318-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2892-185-0x0000000002740000-0x00000000027B5000-memory.dmp

Filesize
468KB

Download
memory/2892-26-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2952-402-0x00000000025F0000-0x0000000002665000-memory.dmp

Filesize
468KB

Download
memory/2952-400-0x00000000025F0000-0x0000000002665000-memory.dmp

Filesize
468KB

Download
memory/2952-235-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2972-333-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3064-376-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download