db389b3df93966a3afbbefa5953a5109e42a9f912b087b9917967029911f0a45

Analysis

max time kernel
150s
max time network
125s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
30/09/2024, 03:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

db389b3df93966a3afbbefa5953a5109e42a9f912b087b9917967029911f0a45.exe
Size

468KB
MD5

8c3bed067b8eaa05b09cb20979170b38
SHA1

ec8e22ca86be8a5c404ca379ed72f499ac134f74
SHA256

db389b3df93966a3afbbefa5953a5109e42a9f912b087b9917967029911f0a45
SHA512

c83d6f3c90141f2751f4cfa9bfcda1c6147838fe427ac9b1f0c8f8e4630179b17e39c0eb8d89166e655b1777d403ba8e5fd9acca7620d7ea3602cb1b92136f8e
SSDEEP

3072:lGAeogIdId5KtbY3Pztjcf8/GCtvJGknSjHeLVhOvuX8xOPP5plS:lGxoobKtQPJjcfCDLCvuswPP5

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
3020	Unicorn-45256.exe
2548	Unicorn-61912.exe
2028	Unicorn-58394.exe
2400	Unicorn-31324.exe
3040	Unicorn-1975.exe
1708	Unicorn-49951.exe
1512	Unicorn-4279.exe
2664	Unicorn-4014.exe
2880	Unicorn-62707.exe
1248	Unicorn-46179.exe
336	Unicorn-30811.exe
1072	Unicorn-25929.exe
1924	Unicorn-45795.exe
2224	Unicorn-42073.exe
2304	Unicorn-45603.exe
1128	Unicorn-38977.exe
292	Unicorn-6651.exe
280	Unicorn-10639.exe
2452	Unicorn-63945.exe
1604	Unicorn-63789.exe
536	Unicorn-17542.exe
1696	Unicorn-3893.exe
556	Unicorn-39673.exe
1928	Unicorn-53094.exe
2324	Unicorn-19569.exe
2824	Unicorn-3125.exe
2668	Unicorn-13523.exe
1528	Unicorn-41313.exe
2576	Unicorn-29192.exe
1516	Unicorn-47967.exe
1524	Unicorn-2030.exe
1816	Unicorn-2295.exe
2940	Unicorn-39877.exe
2796	Unicorn-37224.exe
2952	Unicorn-56322.exe
2380	Unicorn-36352.exe
1224	Unicorn-41351.exe
1132	Unicorn-3997.exe
1464	Unicorn-24740.exe
3048	Unicorn-37250.exe
3004	Unicorn-42996.exe
1484	Unicorn-58683.exe
2024	Unicorn-12627.exe
1356	Unicorn-47630.exe
1732	Unicorn-43800.exe
1932	Unicorn-1444.exe
2272	Unicorn-4589.exe
668	Unicorn-64755.exe
824	Unicorn-44890.exe
3008	Unicorn-26253.exe
2732	Unicorn-48912.exe
1508	Unicorn-48912.exe
1480	Unicorn-63255.exe
1812	Unicorn-27597.exe
2912	Unicorn-33728.exe
2444	Unicorn-19622.exe
2096	Unicorn-4236.exe
2948	Unicorn-4236.exe
2976	Unicorn-56068.exe
2056	Unicorn-10396.exe
2100	Unicorn-7360.exe
2520	Unicorn-9664.exe
1916	Unicorn-29530.exe
2440	Unicorn-12617.exe

Loads dropped DLL 64 IoCs

pid	Process
2712	db389b3df93966a3afbbefa5953a5109e42a9f912b087b9917967029911f0a45.exe
2712	db389b3df93966a3afbbefa5953a5109e42a9f912b087b9917967029911f0a45.exe
2696	WerFault.exe
2696	WerFault.exe
2696	WerFault.exe
2696	WerFault.exe
2696	WerFault.exe
2712	db389b3df93966a3afbbefa5953a5109e42a9f912b087b9917967029911f0a45.exe
2712	db389b3df93966a3afbbefa5953a5109e42a9f912b087b9917967029911f0a45.exe
2712	db389b3df93966a3afbbefa5953a5109e42a9f912b087b9917967029911f0a45.exe
2548	Unicorn-61912.exe
2548	Unicorn-61912.exe
2712	db389b3df93966a3afbbefa5953a5109e42a9f912b087b9917967029911f0a45.exe
2028	Unicorn-58394.exe
2028	Unicorn-58394.exe
2400	Unicorn-31324.exe
2548	Unicorn-61912.exe
2548	Unicorn-61912.exe
2400	Unicorn-31324.exe
2712	db389b3df93966a3afbbefa5953a5109e42a9f912b087b9917967029911f0a45.exe
2712	db389b3df93966a3afbbefa5953a5109e42a9f912b087b9917967029911f0a45.exe
1708	Unicorn-49951.exe
1708	Unicorn-49951.exe
1512	Unicorn-4279.exe
1512	Unicorn-4279.exe
2548	Unicorn-61912.exe
2548	Unicorn-61912.exe
3040	Unicorn-1975.exe
2028	Unicorn-58394.exe
2028	Unicorn-58394.exe
2400	Unicorn-31324.exe
2400	Unicorn-31324.exe
2664	Unicorn-4014.exe
2664	Unicorn-4014.exe
3040	Unicorn-1975.exe
2712	db389b3df93966a3afbbefa5953a5109e42a9f912b087b9917967029911f0a45.exe
2712	db389b3df93966a3afbbefa5953a5109e42a9f912b087b9917967029911f0a45.exe
1248	Unicorn-46179.exe
1248	Unicorn-46179.exe
1512	Unicorn-4279.exe
1512	Unicorn-4279.exe
2880	Unicorn-62707.exe
2880	Unicorn-62707.exe
1708	Unicorn-49951.exe
1708	Unicorn-49951.exe
1072	Unicorn-25929.exe
2400	Unicorn-31324.exe
1072	Unicorn-25929.exe
2400	Unicorn-31324.exe
2224	Unicorn-42073.exe
2224	Unicorn-42073.exe
1128	Unicorn-38977.exe
1128	Unicorn-38977.exe
2712	db389b3df93966a3afbbefa5953a5109e42a9f912b087b9917967029911f0a45.exe
2028	Unicorn-58394.exe
1924	Unicorn-45795.exe
1924	Unicorn-45795.exe
2712	db389b3df93966a3afbbefa5953a5109e42a9f912b087b9917967029911f0a45.exe
2028	Unicorn-58394.exe
3040	Unicorn-1975.exe
3040	Unicorn-1975.exe
336	Unicorn-30811.exe
336	Unicorn-30811.exe
2664	Unicorn-4014.exe

Program crash 12 IoCs

pid	pid_target	Process	procid_target
2696	3020	WerFault.exe	30
996	2576	WerFault.exe	59
2632	2948	WerFault.exe	88
3176	2096	WerFault.exe	87
3980	1828	WerFault.exe	116
3732	2672	WerFault.exe	255
3700	2092	WerFault.exe	257
3736	3488	WerFault.exe	259
3824	3480	WerFault.exe	258
3868	1004	WerFault.exe	254
3880	3500	WerFault.exe	260
3884	2848	WerFault.exe	256

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31002.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59420.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39877.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26253.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58418.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48378.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2001.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11462.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8791.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20904.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32253.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55224.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58394.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26114.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58271.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11888.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15974.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54840.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21319.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65328.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37250.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17822.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34541.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27577.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15944.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48715.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26094.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27174.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44581.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49797.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5751.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30559.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63685.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4014.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44264.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59451.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41607.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39922.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47748.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17542.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13597.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13597.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10374.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64798.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28262.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52678.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25241.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64185.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48636.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62911.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5556.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57817.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34697.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33499.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17384.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44534.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6266.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45712.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13705.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28226.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1713.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42832.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20416.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48262.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2712	db389b3df93966a3afbbefa5953a5109e42a9f912b087b9917967029911f0a45.exe
3020	Unicorn-45256.exe
2548	Unicorn-61912.exe
2028	Unicorn-58394.exe
2400	Unicorn-31324.exe
3040	Unicorn-1975.exe
1708	Unicorn-49951.exe
1512	Unicorn-4279.exe
2664	Unicorn-4014.exe
1248	Unicorn-46179.exe
2880	Unicorn-62707.exe
1072	Unicorn-25929.exe
1128	Unicorn-38977.exe
2304	Unicorn-45603.exe
2224	Unicorn-42073.exe
336	Unicorn-30811.exe
1924	Unicorn-45795.exe
292	Unicorn-6651.exe
280	Unicorn-10639.exe
2452	Unicorn-63945.exe
1604	Unicorn-63789.exe
536	Unicorn-17542.exe
1696	Unicorn-3893.exe
556	Unicorn-39673.exe
2668	Unicorn-13523.exe
1528	Unicorn-41313.exe
1516	Unicorn-47967.exe
1524	Unicorn-2030.exe
2576	Unicorn-29192.exe
2824	Unicorn-3125.exe
1816	Unicorn-2295.exe
2324	Unicorn-19569.exe
1928	Unicorn-53094.exe
2796	Unicorn-37224.exe
2952	Unicorn-56322.exe
2940	Unicorn-39877.exe
2380	Unicorn-36352.exe
1464	Unicorn-24740.exe
1132	Unicorn-3997.exe
1224	Unicorn-41351.exe
3048	Unicorn-37250.exe
3004	Unicorn-42996.exe
1484	Unicorn-58683.exe
2024	Unicorn-12627.exe
1732	Unicorn-43800.exe
2272	Unicorn-4589.exe
1356	Unicorn-47630.exe
1932	Unicorn-1444.exe
668	Unicorn-64755.exe
824	Unicorn-44890.exe
3008	Unicorn-26253.exe
2732	Unicorn-48912.exe
1508	Unicorn-48912.exe
1480	Unicorn-63255.exe
2912	Unicorn-33728.exe
1812	Unicorn-27597.exe
2948	Unicorn-4236.exe
2100	Unicorn-7360.exe
2096	Unicorn-4236.exe
2444	Unicorn-19622.exe
2520	Unicorn-9664.exe
2056	Unicorn-10396.exe
2976	Unicorn-56068.exe
812	Unicorn-7173.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2712 wrote to memory of 3020	2712	db389b3df93966a3afbbefa5953a5109e42a9f912b087b9917967029911f0a45.exe	30
PID 2712 wrote to memory of 3020	2712	db389b3df93966a3afbbefa5953a5109e42a9f912b087b9917967029911f0a45.exe	30
PID 2712 wrote to memory of 3020	2712	db389b3df93966a3afbbefa5953a5109e42a9f912b087b9917967029911f0a45.exe	30
PID 2712 wrote to memory of 3020	2712	db389b3df93966a3afbbefa5953a5109e42a9f912b087b9917967029911f0a45.exe	30
PID 3020 wrote to memory of 2696	3020	Unicorn-45256.exe	31
PID 3020 wrote to memory of 2696	3020	Unicorn-45256.exe	31
PID 3020 wrote to memory of 2696	3020	Unicorn-45256.exe	31
PID 3020 wrote to memory of 2696	3020	Unicorn-45256.exe	31
PID 2712 wrote to memory of 2548	2712	db389b3df93966a3afbbefa5953a5109e42a9f912b087b9917967029911f0a45.exe	32
PID 2712 wrote to memory of 2548	2712	db389b3df93966a3afbbefa5953a5109e42a9f912b087b9917967029911f0a45.exe	32
PID 2712 wrote to memory of 2548	2712	db389b3df93966a3afbbefa5953a5109e42a9f912b087b9917967029911f0a45.exe	32
PID 2712 wrote to memory of 2548	2712	db389b3df93966a3afbbefa5953a5109e42a9f912b087b9917967029911f0a45.exe	32
PID 2712 wrote to memory of 2400	2712	db389b3df93966a3afbbefa5953a5109e42a9f912b087b9917967029911f0a45.exe	34
PID 2548 wrote to memory of 2028	2548	Unicorn-61912.exe	33
PID 2548 wrote to memory of 2028	2548	Unicorn-61912.exe	33
PID 2548 wrote to memory of 2028	2548	Unicorn-61912.exe	33
PID 2712 wrote to memory of 2400	2712	db389b3df93966a3afbbefa5953a5109e42a9f912b087b9917967029911f0a45.exe	34
PID 2712 wrote to memory of 2400	2712	db389b3df93966a3afbbefa5953a5109e42a9f912b087b9917967029911f0a45.exe	34
PID 2548 wrote to memory of 2028	2548	Unicorn-61912.exe	33
PID 2712 wrote to memory of 2400	2712	db389b3df93966a3afbbefa5953a5109e42a9f912b087b9917967029911f0a45.exe	34
PID 2028 wrote to memory of 3040	2028	Unicorn-58394.exe	35
PID 2028 wrote to memory of 3040	2028	Unicorn-58394.exe	35
PID 2028 wrote to memory of 3040	2028	Unicorn-58394.exe	35
PID 2028 wrote to memory of 3040	2028	Unicorn-58394.exe	35
PID 2548 wrote to memory of 1708	2548	Unicorn-61912.exe	37
PID 2548 wrote to memory of 1708	2548	Unicorn-61912.exe	37
PID 2548 wrote to memory of 1708	2548	Unicorn-61912.exe	37
PID 2548 wrote to memory of 1708	2548	Unicorn-61912.exe	37
PID 2400 wrote to memory of 1512	2400	Unicorn-31324.exe	36
PID 2400 wrote to memory of 1512	2400	Unicorn-31324.exe	36
PID 2400 wrote to memory of 1512	2400	Unicorn-31324.exe	36
PID 2400 wrote to memory of 1512	2400	Unicorn-31324.exe	36
PID 2712 wrote to memory of 2664	2712	db389b3df93966a3afbbefa5953a5109e42a9f912b087b9917967029911f0a45.exe	38
PID 2712 wrote to memory of 2664	2712	db389b3df93966a3afbbefa5953a5109e42a9f912b087b9917967029911f0a45.exe	38
PID 2712 wrote to memory of 2664	2712	db389b3df93966a3afbbefa5953a5109e42a9f912b087b9917967029911f0a45.exe	38
PID 2712 wrote to memory of 2664	2712	db389b3df93966a3afbbefa5953a5109e42a9f912b087b9917967029911f0a45.exe	38
PID 1708 wrote to memory of 2880	1708	Unicorn-49951.exe	39
PID 1708 wrote to memory of 2880	1708	Unicorn-49951.exe	39
PID 1708 wrote to memory of 2880	1708	Unicorn-49951.exe	39
PID 1708 wrote to memory of 2880	1708	Unicorn-49951.exe	39
PID 1512 wrote to memory of 1248	1512	Unicorn-4279.exe	40
PID 1512 wrote to memory of 1248	1512	Unicorn-4279.exe	40
PID 1512 wrote to memory of 1248	1512	Unicorn-4279.exe	40
PID 1512 wrote to memory of 1248	1512	Unicorn-4279.exe	40
PID 2548 wrote to memory of 336	2548	Unicorn-61912.exe	41
PID 2548 wrote to memory of 336	2548	Unicorn-61912.exe	41
PID 2548 wrote to memory of 336	2548	Unicorn-61912.exe	41
PID 2548 wrote to memory of 336	2548	Unicorn-61912.exe	41
PID 2028 wrote to memory of 2224	2028	Unicorn-58394.exe	43
PID 2028 wrote to memory of 2224	2028	Unicorn-58394.exe	43
PID 2028 wrote to memory of 2224	2028	Unicorn-58394.exe	43
PID 2028 wrote to memory of 2224	2028	Unicorn-58394.exe	43
PID 2400 wrote to memory of 1072	2400	Unicorn-31324.exe	44
PID 2400 wrote to memory of 1072	2400	Unicorn-31324.exe	44
PID 2400 wrote to memory of 1072	2400	Unicorn-31324.exe	44
PID 2400 wrote to memory of 1072	2400	Unicorn-31324.exe	44
PID 2664 wrote to memory of 2304	2664	Unicorn-4014.exe	45
PID 2664 wrote to memory of 2304	2664	Unicorn-4014.exe	45
PID 2664 wrote to memory of 2304	2664	Unicorn-4014.exe	45
PID 2664 wrote to memory of 2304	2664	Unicorn-4014.exe	45
PID 3040 wrote to memory of 1924	3040	Unicorn-1975.exe	42
PID 3040 wrote to memory of 1924	3040	Unicorn-1975.exe	42
PID 3040 wrote to memory of 1924	3040	Unicorn-1975.exe	42
PID 3040 wrote to memory of 1924	3040	Unicorn-1975.exe	42

C:\Users\Admin\AppData\Local\Temp\db389b3df93966a3afbbefa5953a5109e42a9f912b087b9917967029911f0a45.exe
"C:\Users\Admin\AppData\Local\Temp\db389b3df93966a3afbbefa5953a5109e42a9f912b087b9917967029911f0a45.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2712
- C:\Users\Admin\AppData\Local\Temp\Unicorn-45256.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-45256.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3020
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3020 -s 200
    3⤵
    - Loads dropped DLL
    - Program crash
    PID:2696
- C:\Users\Admin\AppData\Local\Temp\Unicorn-61912.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-61912.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2548
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58394.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58394.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1975.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1975.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45795.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:1924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3125.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4589.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26114.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:2488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62962.exe
        8⤵
        
        PID:3480
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3480 -s 188
        9⤵
        Program crash
        
        PID:3824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52425.exe
        8⤵
        
        PID:4684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34698.exe
        9⤵
        
        PID:4768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17384.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:5264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63832.exe
        9⤵
        
        PID:6460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12765.exe
        9⤵
        
        PID:7924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34433.exe
        8⤵
        
        PID:4180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11983.exe
        8⤵
        
        PID:5380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44496.exe
        8⤵
        
        PID:6576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4630.exe
        8⤵
        
        PID:7976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41151.exe
        7⤵
        
        PID:1796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51409.exe
        8⤵
        
        PID:4824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31308.exe
        8⤵
        
        PID:4928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-948.exe
        8⤵
        
        PID:5628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44534.exe
        8⤵
        
        PID:6356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37348.exe
        8⤵
        
        PID:7880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57745.exe
        7⤵
        
        PID:3448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19462.exe
        7⤵
        
        PID:4304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23987.exe
        7⤵
        
        PID:4804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48262.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39922.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51168.exe
        7⤵
        
        PID:8108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44890.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44370.exe
        7⤵
        
        PID:1468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62962.exe
        7⤵
        
        PID:1004
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1004 -s 188
        8⤵
        Program crash
        
        PID:3868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52425.exe
        7⤵
        
        PID:4648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6436.exe
        7⤵
        
        PID:5604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28262.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50312.exe
        7⤵
        
        PID:6984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10456.exe
        7⤵
        
        PID:7700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11462.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5556.exe
        6⤵
        
        PID:3240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10797.exe
        6⤵
        
        PID:4320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33025.exe
        6⤵
        
        PID:4736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65328.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50272.exe
        6⤵
        
        PID:6704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10110.exe
        6⤵
        
        PID:7368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41313.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64755.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17422.exe
        7⤵
        
        PID:1824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62962.exe
        7⤵
        
        PID:2092
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2092 -s 188
        8⤵
        Program crash
        
        PID:3700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52425.exe
        7⤵
        
        PID:4556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5751.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28262.exe
        7⤵
        
        PID:6068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27527.exe
        7⤵
        
        PID:6936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2661.exe
        7⤵
        
        PID:7768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4214.exe
        6⤵
        
        PID:3060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30482.exe
        6⤵
        
        PID:3580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64854.exe
        6⤵
        
        PID:5072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43138.exe
        6⤵
        
        PID:5936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63173.exe
        6⤵
        
        PID:5336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8485.exe
        6⤵
        
        PID:6496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59425.exe
        6⤵
        
        PID:7288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26253.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28844.exe
        6⤵
        
        PID:2936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49797.exe
        6⤵
        
        PID:3896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48907.exe
        6⤵
        
        PID:4484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58834.exe
        6⤵
        
        PID:5188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47592.exe
        6⤵
        
        PID:6376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6169.exe
        6⤵
        
        PID:7404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34541.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62428.exe
        5⤵
        
        PID:3336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13286.exe
        5⤵
        
        PID:4404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42774.exe
        5⤵
        
        PID:5020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10422.exe
        5⤵
        
        PID:5256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35482.exe
        5⤵
        
        PID:6224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45690.exe
        5⤵
        
        PID:7812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42073.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42073.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3893.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47630.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28844.exe
        7⤵
        
        PID:3028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49797.exe
        7⤵
        
        PID:3908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48907.exe
        7⤵
        
        PID:4716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58642.exe
        7⤵
        
        PID:5224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47176.exe
        7⤵
        
        PID:6228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30842.exe
        7⤵
        
        PID:6408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41151.exe
        6⤵
        
        PID:1996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57745.exe
        6⤵
        
        PID:3440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19462.exe
        6⤵
        
        PID:4312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23987.exe
        6⤵
        
        PID:1360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48262.exe
        6⤵
        
        PID:5680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55765.exe
        6⤵
        
        PID:6324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23571.exe
        6⤵
        
        PID:8184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1444.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45138.exe
        6⤵
        
        PID:2748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62962.exe
        6⤵
        
        PID:2672
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2672 -s 188
        7⤵
        Program crash
        
        PID:3732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52425.exe
        6⤵
        
        PID:4692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5751.exe
        6⤵
        
        PID:5588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28262.exe
        6⤵
        
        PID:6064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27527.exe
        6⤵
        
        PID:6928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2661.exe
        6⤵
        
        PID:7796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54887.exe
        5⤵
        
        PID:3032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63610.exe
        5⤵
        
        PID:3472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12224.exe
        5⤵
        
        PID:4416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47507.exe
        5⤵
        
        PID:5324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47360.exe
        5⤵
        
        PID:5916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25070.exe
        5⤵
        
        PID:7028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44577.exe
        5⤵
        
        PID:7224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13523.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13523.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33728.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31002.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36778.exe
        7⤵
        
        PID:6196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56558.exe
        7⤵
        
        PID:6856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18823.exe
        7⤵
        
        PID:7312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25208.exe
        6⤵
        
        PID:2588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56568.exe
        6⤵
        
        PID:3536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49945.exe
        6⤵
        
        PID:4992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15974.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47989.exe
        6⤵
        
        PID:6472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9586.exe
        6⤵
        
        PID:6292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8370.exe
        5⤵
        
        PID:2280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55329.exe
        6⤵
        
        PID:7620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65228.exe
        5⤵
        
        PID:3296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19462.exe
        5⤵
        
        PID:4216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23987.exe
        5⤵
        
        PID:4836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48262.exe
        5⤵
        
        PID:5564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6266.exe
        5⤵
        
        PID:6676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15445.exe
        5⤵
        
        PID:7324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19622.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19622.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28226.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62962.exe
        5⤵
        
        PID:2848
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2848 -s 188
        6⤵
        Program crash
        
        PID:3884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52425.exe
        5⤵
        
        PID:4656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21319.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47095.exe
        5⤵
        
        PID:5872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48378.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5512.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5512.exe
      4⤵
      PID:1980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45892.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45892.exe
      4⤵
      PID:3268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11327.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11327.exe
      4⤵
      PID:4232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28560.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28560.exe
      4⤵
      PID:4508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38462.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38462.exe
      4⤵
      PID:5576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49137.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49137.exe
      4⤵
      PID:6660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52111.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52111.exe
      4⤵
      PID:7316
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49951.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49951.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62707.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62707.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63945.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41351.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25228.exe
        7⤵
        
        PID:1680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52678.exe
        8⤵
        
        PID:2676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9362.exe
        9⤵
        
        PID:6680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54498.exe
        9⤵
        
        PID:6640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34256.exe
        9⤵
        
        PID:7748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51493.exe
        8⤵
        
        PID:3364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15024.exe
        8⤵
        
        PID:4428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7004.exe
        9⤵
        
        PID:6596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1032.exe
        9⤵
        
        PID:8124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1791.exe
        8⤵
        
        PID:4384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63685.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19333.exe
        8⤵
        
        PID:6328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37879.exe
        8⤵
        
        PID:7864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27633.exe
        7⤵
        
        PID:1720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65228.exe
        7⤵
        
        PID:3280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20889.exe
        7⤵
        
        PID:4444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42244.exe
        7⤵
        
        PID:1152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14887.exe
        7⤵
        
        PID:6008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64185.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41459.exe
        7⤵
        
        PID:7508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12207.exe
        6⤵
        
        PID:2868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9548.exe
        7⤵
        
        PID:3600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35306.exe
        7⤵
        
        PID:4140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64183.exe
        7⤵
        
        PID:5688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3124.exe
        7⤵
        
        PID:6848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47748.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54981.exe
        6⤵
        
        PID:1580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17025.exe
        6⤵
        
        PID:3152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49625.exe
        6⤵
        
        PID:4516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46087.exe
        6⤵
        
        PID:5552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44662.exe
        6⤵
        
        PID:5456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23830.exe
        6⤵
        
        PID:6708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55748.exe
        6⤵
        
        PID:7676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3997.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57817.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59715.exe
        7⤵
        
        PID:1756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63532.exe
        7⤵
        
        PID:3964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21798.exe
        7⤵
        
        PID:4732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9027.exe
        7⤵
        
        PID:2944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18105.exe
        7⤵
        
        PID:6780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16186.exe
        7⤵
        
        PID:6776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26984.exe
        7⤵
        
        PID:7760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16605.exe
        6⤵
        
        PID:2636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3367.exe
        6⤵
        
        PID:3812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60331.exe
        6⤵
        
        PID:4352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10011.exe
        6⤵
        
        PID:6072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59981.exe
        6⤵
        
        PID:6240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46492.exe
        6⤵
        
        PID:6748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55224.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60919.exe
        5⤵
        
        PID:2828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25402.exe
        6⤵
        
        PID:2860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11160.exe
        6⤵
        
        PID:3236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58290.exe
        6⤵
        
        PID:4616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62623.exe
        6⤵
        
        PID:5568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11727.exe
        6⤵
        
        PID:5992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44593.exe
        6⤵
        
        PID:6944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46667.exe
        6⤵
        
        PID:7808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55999.exe
        5⤵
        
        PID:2752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28048.exe
        5⤵
        
        PID:3568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1081.exe
        5⤵
        
        PID:4532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25976.exe
        5⤵
        
        PID:5316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42025.exe
        5⤵
        
        PID:5884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29270.exe
        5⤵
        
        PID:7048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16842.exe
        5⤵
        
        PID:7212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63789.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63789.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24740.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4236.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47553.exe
        7⤵
        
        PID:1828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39264.exe
        8⤵
        
        PID:1432
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1828 -s 216
        8⤵
        Program crash
        
        PID:3980
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2948 -s 236
        7⤵
        Program crash
        
        PID:2632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63658.exe
        6⤵
        
        PID:808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28844.exe
        7⤵
        
        PID:1596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49797.exe
        7⤵
        
        PID:3916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48907.exe
        7⤵
        
        PID:3664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25394.exe
        7⤵
        
        PID:5312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32912.exe
        7⤵
        
        PID:6664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65068.exe
        7⤵
        
        PID:6432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16418.exe
        7⤵
        
        PID:7576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27368.exe
        6⤵
        
        PID:2508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11888.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46242.exe
        6⤵
        
        PID:4332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44655.exe
        6⤵
        
        PID:5804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9488.exe
        6⤵
        
        PID:6964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25595.exe
        6⤵
        
        PID:6600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56068.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49214.exe
        6⤵
        
        PID:4720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31308.exe
        6⤵
        
        PID:4492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2017.exe
        6⤵
        
        PID:5808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44534.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37348.exe
        6⤵
        
        PID:7888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11109.exe
        5⤵
        
        PID:2564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36365.exe
        6⤵
        
        PID:3524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31544.exe
        6⤵
        
        PID:4792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51179.exe
        6⤵
        
        PID:5164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55465.exe
        6⤵
        
        PID:6316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13591.exe
        6⤵
        
        PID:7076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8360.exe
        5⤵
        
        PID:3128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29450.exe
        5⤵
        
        PID:4152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56775.exe
        5⤵
        
        PID:6036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41607.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48504.exe
        5⤵
        
        PID:7116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37250.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37250.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:3048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29530.exe
        5⤵
        Executes dropped EXE
        
        PID:1916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28844.exe
        6⤵
        
        PID:304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49797.exe
        6⤵
        
        PID:3944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48715.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58642.exe
        6⤵
        
        PID:5240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32253.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15784.exe
        6⤵
        
        PID:6756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16169.exe
        6⤵
        
        PID:1656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53036.exe
        5⤵
        
        PID:2336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31341.exe
        5⤵
        
        PID:3704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3702.exe
        5⤵
        
        PID:4120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25951.exe
        5⤵
        
        PID:4832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31843.exe
        5⤵
        
        PID:5172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47330.exe
        5⤵
        
        PID:6280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9311.exe
        5⤵
        
        PID:3552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7173.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7173.exe
      4⤵
      Suspicious use of SetWindowsHookEx
      PID:812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36384.exe
        5⤵
        
        PID:1084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55354.exe
        6⤵
        
        PID:6716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51577.exe
        6⤵
        
        PID:8080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27897.exe
        5⤵
        
        PID:3616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31008.exe
        5⤵
        
        PID:4968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6571.exe
        5⤵
        
        PID:6140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32253.exe
        5⤵
        
        PID:6556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15784.exe
        5⤵
        
        PID:6820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16169.exe
        5⤵
        
        PID:7452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33218.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33218.exe
      4⤵
      PID:2348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63511.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63511.exe
      4⤵
      PID:3796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57150.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57150.exe
      4⤵
      PID:4664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21243.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21243.exe
      4⤵
      PID:5116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5087.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5087.exe
      4⤵
      PID:6000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41519.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41519.exe
      4⤵
      PID:7064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12588.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12588.exe
      4⤵
      PID:7496
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30811.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30811.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29192.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29192.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4236.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58869.exe
        6⤵
        
        PID:1888
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2096 -s 216
        6⤵
        Program crash
        
        PID:3176
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2576 -s 236
        5⤵
        Program crash
        
        PID:996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7360.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7360.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13705.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42149.exe
        6⤵
        
        PID:1436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3574.exe
        6⤵
        
        PID:3780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59420.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46977.exe
        6⤵
        
        PID:5304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51826.exe
        6⤵
        
        PID:5948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51936.exe
        6⤵
        
        PID:7092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45712.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6248.exe
        5⤵
        
        PID:2076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11160.exe
        5⤵
        
        PID:3376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58290.exe
        5⤵
        
        PID:4600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63308.exe
        5⤵
        
        PID:5616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11727.exe
        5⤵
        
        PID:4908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61121.exe
        5⤵
        
        PID:6876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61083.exe
        5⤵
        
        PID:7616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6615.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6615.exe
      4⤵
      PID:2268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8038.exe
        5⤵
        
        PID:6012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40693.exe
        5⤵
        
        PID:6400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6900.exe
        5⤵
        
        PID:8028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44809.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44809.exe
      4⤵
      PID:2480
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13612.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13612.exe
      4⤵
      PID:1460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44589.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44589.exe
      4⤵
      PID:4396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28281.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28281.exe
      4⤵
      PID:5876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27174.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27174.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20260.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20260.exe
      4⤵
      PID:6636
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2030.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2030.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43028.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43028.exe
      4⤵
      PID:1380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52678.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2588.exe
        6⤵
        
        PID:6332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59727.exe
        6⤵
        
        PID:7480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51493.exe
        5⤵
        
        PID:3320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15944.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25767.exe
        5⤵
        
        PID:4944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44264.exe
        5⤵
        
        PID:5924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61562.exe
        5⤵
        
        PID:6468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48636.exe
        5⤵
        
        PID:8000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35116.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35116.exe
      4⤵
      PID:864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65228.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65228.exe
      4⤵
      PID:3424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19462.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19462.exe
      4⤵
      PID:4280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23987.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23987.exe
      4⤵
      PID:4860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48262.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48262.exe
      4⤵
      PID:5636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6266.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6266.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6692
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15445.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15445.exe
      4⤵
      PID:7384
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39233.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39233.exe
    3⤵
    PID:2464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28546.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28546.exe
      4⤵
      PID:3096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2677.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2677.exe
      4⤵
      PID:3960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49042.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49042.exe
      4⤵
      PID:4996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4511.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4511.exe
      4⤵
      PID:5732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59996.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59996.exe
      4⤵
      PID:6860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31212.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31212.exe
      4⤵
      PID:6932
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8033.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8033.exe
    3⤵
    PID:2384
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3753.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3753.exe
    3⤵
    PID:3956
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23609.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23609.exe
    3⤵
    PID:4988
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10374.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10374.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5340
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63124.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63124.exe
    3⤵
    PID:6436
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28435.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28435.exe
    3⤵
    PID:6248
- C:\Users\Admin\AppData\Local\Temp\Unicorn-31324.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-31324.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2400
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4279.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4279.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46179.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46179.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:1248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6651.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39877.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48912.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37494.exe
        8⤵
        
        PID:952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51493.exe
        8⤵
        
        PID:3312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13597.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58226.exe
        8⤵
        
        PID:4412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64798.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45308.exe
        8⤵
        
        PID:6772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36976.exe
        8⤵
        
        PID:7356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-716.exe
        7⤵
        
        PID:2104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65228.exe
        7⤵
        
        PID:3380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19462.exe
        7⤵
        
        PID:4272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23987.exe
        7⤵
        
        PID:4812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48262.exe
        7⤵
        
        PID:5560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39922.exe
        7⤵
        
        PID:6796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51168.exe
        7⤵
        
        PID:8136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63255.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33649.exe
        7⤵
        
        PID:2232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62962.exe
        7⤵
        
        PID:3488
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3488 -s 188
        8⤵
        Program crash
        
        PID:3736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52425.exe
        7⤵
        
        PID:4708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21319.exe
        7⤵
        
        PID:5736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48373.exe
        7⤵
        
        PID:6368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57250.exe
        7⤵
        
        PID:6956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9080.exe
        6⤵
        
        PID:3064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39052.exe
        7⤵
        
        PID:4764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17384.exe
        7⤵
        
        PID:5216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63832.exe
        7⤵
        
        PID:6476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12765.exe
        7⤵
        
        PID:7948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5556.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17085.exe
        6⤵
        
        PID:5008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2670.exe
        6⤵
        
        PID:4904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56519.exe
        6⤵
        
        PID:5300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34696.exe
        6⤵
        
        PID:6528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47501.exe
        6⤵
        
        PID:7964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37224.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48912.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37171.exe
        7⤵
        
        PID:3560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6681.exe
        7⤵
        
        PID:4520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45044.exe
        7⤵
        
        PID:5040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40088.exe
        7⤵
        
        PID:2288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30406.exe
        7⤵
        
        PID:5448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45815.exe
        7⤵
        
        PID:7688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-716.exe
        6⤵
        
        PID:1288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65228.exe
        6⤵
        
        PID:3432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19462.exe
        6⤵
        
        PID:4224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23987.exe
        6⤵
        
        PID:4760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63530.exe
        6⤵
        
        PID:5428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38555.exe
        6⤵
        
        PID:6804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15445.exe
        6⤵
        
        PID:7344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27597.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14442.exe
        6⤵
        
        PID:2004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51493.exe
        6⤵
        
        PID:3288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15944.exe
        6⤵
        
        PID:5088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25767.exe
        6⤵
        
        PID:5132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60985.exe
        6⤵
        
        PID:5392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61562.exe
        6⤵
        
        PID:6524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48636.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14945.exe
        5⤵
        
        PID:1424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62428.exe
        5⤵
        
        PID:3204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59799.exe
        5⤵
        
        PID:4208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50091.exe
        5⤵
        
        PID:4376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43797.exe
        5⤵
        
        PID:5476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5145.exe
        5⤵
        
        PID:6620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14310.exe
        5⤵
        
        PID:7296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10639.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10639.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56322.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32073.exe
        6⤵
        
        PID:936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39692.exe
        7⤵
        
        PID:4880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2378.exe
        7⤵
        
        PID:5904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38733.exe
        7⤵
        
        PID:5168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26875.exe
        7⤵
        
        PID:2124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65421.exe
        7⤵
        
        PID:8132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49195.exe
        6⤵
        
        PID:540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2791.exe
        6⤵
        
        PID:3924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46107.exe
        6⤵
        
        PID:4504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49777.exe
        6⤵
        
        PID:5204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32784.exe
        6⤵
        
        PID:6512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11319.exe
        6⤵
        
        PID:6284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54840.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33068.exe
        5⤵
        
        PID:2872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65130.exe
        6⤵
        
        PID:5000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31672.exe
        6⤵
        
        PID:5956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21436.exe
        6⤵
        
        PID:5796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43486.exe
        6⤵
        
        PID:6504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16023.exe
        6⤵
        
        PID:7376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58271.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17025.exe
        5⤵
        
        PID:3160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49625.exe
        5⤵
        
        PID:4564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46087.exe
        5⤵
        
        PID:5520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44662.exe
        5⤵
        
        PID:5472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23830.exe
        5⤵
        
        PID:6700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55748.exe
        5⤵
        
        PID:7584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36352.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36352.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32073.exe
        5⤵
        
        PID:2688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16250.exe
        6⤵
        
        PID:4932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12262.exe
        6⤵
        
        PID:5016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39320.exe
        6⤵
        
        PID:5396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30406.exe
        6⤵
        
        PID:5856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45623.exe
        6⤵
        
        PID:7728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41245.exe
        5⤵
        
        PID:3012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11160.exe
        5⤵
        
        PID:3200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58290.exe
        5⤵
        
        PID:4620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12654.exe
        5⤵
        
        PID:5700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30559.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65444.exe
        5⤵
        
        PID:7148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11940.exe
        5⤵
        
        PID:8052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23116.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23116.exe
      4⤵
      PID:2492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28844.exe
        5⤵
        
        PID:3044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49797.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49566.exe
        5⤵
        
        PID:4872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52669.exe
        5⤵
        
        PID:5488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24827.exe
        5⤵
        
        PID:6812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2001.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56320.exe
        5⤵
        
        PID:7844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28029.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28029.exe
      4⤵
      PID:2960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9495.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9495.exe
      4⤵
      PID:3640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22905.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22905.exe
      4⤵
      PID:2596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56775.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56775.exe
      4⤵
      PID:6044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1512.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1512.exe
      4⤵
      PID:6164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3256.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3256.exe
      4⤵
      PID:6632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31689.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31689.exe
      4⤵
      PID:6616
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25929.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25929.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1072
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17542.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17542.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12627.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37688.exe
        6⤵
        
        PID:520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34471.exe
        7⤵
        
        PID:4972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64064.exe
        7⤵
        
        PID:4948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33454.exe
        7⤵
        
        PID:5432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39072.exe
        7⤵
        
        PID:7136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62159.exe
        7⤵
        
        PID:7720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31593.exe
        6⤵
        
        PID:1016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11160.exe
        6⤵
        
        PID:2300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16380.exe
        6⤵
        
        PID:4392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31325.exe
        6⤵
        
        PID:5348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61901.exe
        6⤵
        
        PID:6308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38791.exe
        6⤵
        
        PID:6272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55224.exe
        6⤵
        
        PID:7188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17822.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37388.exe
        6⤵
        
        PID:4776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1719.exe
        6⤵
        
        PID:5716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49895.exe
        6⤵
        
        PID:5792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8042.exe
        6⤵
        
        PID:6212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32940.exe
        6⤵
        
        PID:7912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45329.exe
        5⤵
        
        PID:2260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17025.exe
        5⤵
        
        PID:3168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7715.exe
        5⤵
        
        PID:4388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44743.exe
        5⤵
        
        PID:5860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47625.exe
        5⤵
        
        PID:5404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43913.exe
        5⤵
        
        PID:7164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6605.exe
        5⤵
        
        PID:7984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43800.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43800.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58175.exe
        5⤵
        
        PID:2516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39072.exe
        6⤵
        
        PID:1572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16823.exe
        6⤵
        
        PID:3764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46603.exe
        6⤵
        
        PID:4184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20904.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59451.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50958.exe
        6⤵
        
        PID:6840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16553.exe
        6⤵
        
        PID:7268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8360.exe
        5⤵
        
        PID:1228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11160.exe
        5⤵
        
        PID:3276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58290.exe
        5⤵
        
        PID:4592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62623.exe
        5⤵
        
        PID:5580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11727.exe
        5⤵
        
        PID:5900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61121.exe
        5⤵
        
        PID:6904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61083.exe
        5⤵
        
        PID:7636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52730.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52730.exe
      4⤵
      PID:1644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12401.exe
        5⤵
        
        PID:3084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27790.exe
        5⤵
        
        PID:4748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50909.exe
        5⤵
        
        PID:5080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31422.exe
        5⤵
        
        PID:6132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12279.exe
        5⤵
        
        PID:6352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55224.exe
        5⤵
        
        PID:7244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27577.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27577.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8360.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8360.exe
      4⤵
      PID:3136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25347.exe
        5⤵
        
        PID:5412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8609.exe
        5⤵
        
        PID:5832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54206.exe
        5⤵
        
        PID:7020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45337.exe
        5⤵
        
        PID:7252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33089.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33089.exe
      4⤵
      PID:4608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13184.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13184.exe
      4⤵
      PID:5708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26094.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26094.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38578.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38578.exe
      4⤵
      PID:7128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10805.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10805.exe
      4⤵
      PID:7936
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39673.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39673.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42996.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42996.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32073.exe
        5⤵
        
        PID:1748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34697.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51493.exe
        6⤵
        
        PID:3216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13597.exe
        6⤵
        
        PID:4192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59679.exe
        6⤵
        
        PID:4920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16557.exe
        6⤵
        
        PID:5268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14779.exe
        6⤵
        
        PID:6396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15356.exe
        6⤵
        
        PID:6204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63264.exe
        5⤵
        
        PID:2908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65228.exe
        5⤵
        
        PID:3416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19462.exe
        5⤵
        
        PID:4264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23987.exe
        5⤵
        
        PID:4864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48262.exe
        5⤵
        
        PID:5640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62374.exe
        5⤵
        
        PID:6760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15445.exe
        5⤵
        
        PID:7336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41423.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41423.exe
      4⤵
      PID:2428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61132.exe
        5⤵
        
        PID:2800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49797.exe
        5⤵
        
        PID:3904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54907.exe
        5⤵
        
        PID:4148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61383.exe
        5⤵
        
        PID:5784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43460.exe
        5⤵
        
        PID:6884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48278.exe
        5⤵
        
        PID:7100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28579.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28579.exe
      4⤵
      PID:1068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44588.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44588.exe
      4⤵
      PID:3856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29571.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29571.exe
      4⤵
      PID:4456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51960.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51960.exe
      4⤵
      PID:5156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11253.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11253.exe
      4⤵
      PID:6548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5984.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5984.exe
      4⤵
      PID:6420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59041.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59041.exe
      4⤵
      PID:7488
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58683.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58683.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56264.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56264.exe
      4⤵
      PID:856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17113.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17113.exe
      4⤵
      PID:3608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20416.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20416.exe
      4⤵
      PID:4540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50909.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50909.exe
      4⤵
      PID:5044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31422.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31422.exe
      4⤵
      PID:6080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3586.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3586.exe
      4⤵
      PID:6388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11504.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11504.exe
      4⤵
      PID:7420
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15548.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15548.exe
    3⤵
    PID:2172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8563.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8563.exe
      4⤵
      PID:7084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21903.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21903.exe
      4⤵
      PID:6360
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35944.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35944.exe
    3⤵
    PID:1760
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14142.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14142.exe
    3⤵
    PID:3116
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25241.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25241.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3120
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35047.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35047.exe
    3⤵
    PID:5668
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37860.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37860.exe
    3⤵
    PID:6896
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63413.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63413.exe
    3⤵
    PID:6924
- C:\Users\Admin\AppData\Local\Temp\Unicorn-4014.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-4014.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2664
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45603.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45603.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2295.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2295.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58860.exe
        5⤵
        
        PID:1632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36659.exe
        6⤵
        
        PID:2628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35006.exe
        6⤵
        
        PID:3520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18652.exe
        6⤵
        
        PID:5084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51273.exe
        6⤵
        
        PID:5964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18636.exe
        6⤵
        
        PID:5820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18285.exe
        6⤵
        
        PID:6584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16553.exe
        6⤵
        
        PID:7352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7976.exe
        5⤵
        
        PID:904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11160.exe
        5⤵
        
        PID:3188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58290.exe
        5⤵
        
        PID:4548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62623.exe
        5⤵
        
        PID:5540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27596.exe
        5⤵
        
        PID:5788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45361.exe
        5⤵
        
        PID:6736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61083.exe
        5⤵
        
        PID:7592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22082.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22082.exe
      4⤵
      PID:1676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33499.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57825.exe
        5⤵
        
        PID:3872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49042.exe
        5⤵
        
        PID:4116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33168.exe
        5⤵
        
        PID:5932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30700.exe
        5⤵
        
        PID:6948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7266.exe
        5⤵
        
        PID:7456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7871.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7871.exe
      4⤵
      PID:2760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17025.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17025.exe
      4⤵
      PID:3460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49625.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49625.exe
      4⤵
      PID:4576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61656.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61656.exe
      4⤵
      PID:5744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47625.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47625.exe
      4⤵
      PID:5944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43913.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43913.exe
      4⤵
      PID:7152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6605.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6605.exe
      4⤵
      PID:7944
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47967.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47967.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7438.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7438.exe
      4⤵
      PID:2420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34806.exe
        5⤵
        
        PID:1592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51493.exe
        5⤵
        
        PID:3348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13597.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40952.exe
        5⤵
        
        PID:5176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30782.exe
        5⤵
        
        PID:5460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45584.exe
        5⤵
        
        PID:6972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30471.exe
        5⤵
        
        PID:6276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16559.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16559.exe
      4⤵
      PID:2252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65228.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65228.exe
      4⤵
      PID:3304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20889.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20889.exe
      4⤵
      PID:4436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42244.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42244.exe
      4⤵
      PID:4188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14887.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14887.exe
      4⤵
      PID:5152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30937.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30937.exe
      4⤵
      PID:7056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41350.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41350.exe
      4⤵
      PID:7648
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52045.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52045.exe
    3⤵
    PID:2072
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50369.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50369.exe
      4⤵
      PID:2852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62962.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62962.exe
      4⤵
      PID:3500
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3500 -s 188
        5⤵
        Program crash
        
        PID:3880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52425.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52425.exe
      4⤵
      PID:4700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21319.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21319.exe
      4⤵
      PID:5752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12969.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12969.exe
      4⤵
      PID:5124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48378.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48378.exe
      4⤵
      PID:7108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33471.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33471.exe
      4⤵
      PID:8040
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27961.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27961.exe
    3⤵
    PID:744
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8360.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8360.exe
    3⤵
    PID:3144
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33089.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33089.exe
    3⤵
    PID:4640
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63153.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63153.exe
    3⤵
    PID:5528
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23131.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23131.exe
    3⤵
    PID:5764
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18495.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18495.exe
    3⤵
    PID:6740
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59949.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59949.exe
    3⤵
    PID:7604
- C:\Users\Admin\AppData\Local\Temp\Unicorn-38977.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-38977.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:1128
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53094.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53094.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10396.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10396.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19918.exe
        5⤵
        
        PID:1892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44581.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42832.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34698.exe
        7⤵
        
        PID:4464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17384.exe
        7⤵
        
        PID:5244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63832.exe
        7⤵
        
        PID:6456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12765.exe
        7⤵
        
        PID:8016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58610.exe
        6⤵
        
        PID:4964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32509.exe
        6⤵
        
        PID:5368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14587.exe
        6⤵
        
        PID:6484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31117.exe
        6⤵
        
        PID:6724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51493.exe
        5⤵
        
        PID:3328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13597.exe
        5⤵
        
        PID:4200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58226.exe
        5⤵
        
        PID:4348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44264.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54271.exe
        5⤵
        
        PID:6500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48636.exe
        5⤵
        
        PID:7992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62911.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62911.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65228.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65228.exe
      4⤵
      PID:3260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19462.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19462.exe
      4⤵
      PID:4240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13254.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13254.exe
      4⤵
      PID:5248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20074.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20074.exe
      4⤵
      PID:5836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30405.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30405.exe
      4⤵
      PID:7000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40377.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40377.exe
      4⤵
      PID:7196
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9664.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9664.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56264.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56264.exe
      4⤵
      PID:2084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17113.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17113.exe
      4⤵
      PID:3584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20416.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20416.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50909.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50909.exe
      4⤵
      PID:5112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31422.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31422.exe
      4⤵
      PID:5988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13871.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13871.exe
      4⤵
      PID:6180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62881.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62881.exe
      4⤵
      PID:7660
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50134.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50134.exe
    3⤵
    PID:2728
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29978.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29978.exe
    3⤵
    PID:3508
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17808.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17808.exe
    3⤵
    PID:4496
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25708.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25708.exe
    3⤵
    PID:4984
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31953.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31953.exe
    3⤵
    PID:4688
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9406.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9406.exe
    3⤵
    PID:6156
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36015.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36015.exe
    3⤵
    PID:7668
- C:\Users\Admin\AppData\Local\Temp\Unicorn-19569.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-19569.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2324
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12617.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12617.exe
    3⤵
    - Executes dropped EXE
    PID:2440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8887.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8887.exe
      4⤵
      PID:4356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50920.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50920.exe
      4⤵
      PID:5776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49895.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49895.exe
      4⤵
      PID:5812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8042.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8042.exe
      4⤵
      PID:7160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32940.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32940.exe
      4⤵
      PID:7920
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39387.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39387.exe
    3⤵
    PID:2228
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29888.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29888.exe
    3⤵
    PID:3748
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42042.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42042.exe
    3⤵
    PID:4632
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42244.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42244.exe
    3⤵
    PID:4372
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47943.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47943.exe
    3⤵
    PID:6032
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30937.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30937.exe
    3⤵
    PID:6172
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41350.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41350.exe
    3⤵
    PID:7640
- C:\Users\Admin\AppData\Local\Temp\Unicorn-64575.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-64575.exe
  2⤵
  PID:880
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14442.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14442.exe
    3⤵
    PID:1208
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51493.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51493.exe
    3⤵
    PID:3400
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13597.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13597.exe
    3⤵
    PID:4296
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58418.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58418.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5056
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14912.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14912.exe
    3⤵
    PID:5408
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30923.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30923.exe
    3⤵
    PID:6448
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15164.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15164.exe
    3⤵
    PID:6612
- C:\Users\Admin\AppData\Local\Temp\Unicorn-26333.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-26333.exe
  2⤵
  PID:2136
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57119.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57119.exe
    3⤵
    PID:6916
- C:\Users\Admin\AppData\Local\Temp\Unicorn-1713.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-1713.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3592
- C:\Users\Admin\AppData\Local\Temp\Unicorn-44681.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-44681.exe
  2⤵
  PID:4580
- C:\Users\Admin\AppData\Local\Temp\Unicorn-8791.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-8791.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5064
- C:\Users\Admin\AppData\Local\Temp\Unicorn-29354.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-29354.exe
  2⤵
  PID:5484
- C:\Users\Admin\AppData\Local\Temp\Unicorn-48734.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-48734.exe
  2⤵
  PID:6296
- C:\Users\Admin\AppData\Local\Temp\Unicorn-9613.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-9613.exe
  2⤵
  PID:7872

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-1975.exe

Filesize
468KB

MD5
3df82163e7e40eb0ec073485bec03f1e

SHA1
74c0c7afde4f21215cbdf10287fd7ffe8f39195a

SHA256
b0e160a34a6a0c07840babe0bbefc47ca5c7f09e36581cc4e537da92c7a000bf

SHA512
4a85886fac8edfcd7381736c09d5c117b335c3c455aafb5748b5c30168ee51b0c769d13c8e5db2ef2714a3e8f22a528a98447f2d4e9d08ddf2010b8008067497

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-27790.exe

Filesize
468KB

MD5
396ec69a130fe4fe4af8517911db9e4b

SHA1
e7c3a7f083e628c2be8f10eb081d7f4c4b7941d2

SHA256
243ff7d0340bda7d5fc33fd1421bfae166920000e41670ef731b0d29d6ba1f21

SHA512
546adb5712f0d52ee987dd7697c34994881670ea50b14d8678588efe7095e6becf187c69304e8ce49b4c7a3af3d777cca7de9c8031c33c7d0fb2ef3ad3326507

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-3367.exe

Filesize
468KB

MD5
bde7f251bb9858d03a0df294a8159474

SHA1
d5c7d924ff246437b1b8e247c4bc659684191d69

SHA256
99477edab5d22e7ad03ce8637bd09262c6569fecba3433cc3c7428f6b540678c

SHA512
6bb4feb231c4e8dce2d8707e35c8b051a11ea03209c013e52a5bb926f33775248bfdf9ac0e6e025f8c3af8f75d6cc6f9db9a8490170a09cbbd88628d5511ff5f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-37879.exe

Filesize
468KB

MD5
074a6b8dabb76635cd6c1406b1a5700f

SHA1
03beeee4bb1b4d16fa9883978364cf17e64dcbc2

SHA256
97a52c470c8142ab58bcc0c80c1802dfe0e8b8c0164d29806b84e25aac52330f

SHA512
043cf624eb53db636b21183f12ae5d48804d1512626c07b7e34a094fe6a69320e4455db089b218f53b2585cf0d0380abe14e48982c4b1cde12ec0b8fea04b0b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-38977.exe

Filesize
468KB

MD5
245f49f10ff1cbf73f2f5a2a7eccbb5e

SHA1
6e2d8c535fba057e56ef554952d635966d730b5a

SHA256
9fea8f6111d290ce26312a5c0d93c631ed454e7517dd195d0fc5c30d27823344

SHA512
2d8f4e1c8cd27027b766dc5c1daedc9642b60bde51e9ff577d5aa17abaa6f30d6dd4c2cc54a011d3d43010b1ad7bd2cb0ebe710e17f19dffa53a5c555cce4b36

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-4014.exe

Filesize
468KB

MD5
6f8b3a64932dd5ed1faabc8b3d1c815d

SHA1
061891240b452318436913233fcb7d04779eceda

SHA256
e631098cce10f32823db612f0727d756ea792adf90e585f4782ffa3b261d0a72

SHA512
718e2e2c917c91daf50b37c1fd67a08a6a563bbf162f4e71e7a9250b31704b27f9b9b17cceededf774d473fe0c83e46aa7875469604303b1264f87089762e5ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-42073.exe

Filesize
468KB

MD5
39ccfc355299196a2174e4b89809856b

SHA1
ef5b4a74c35a48f6715fa4e9c6952b8bd00c0d85

SHA256
3a20a5c89a2d9572bdd560bd1ed96e6c53ba0393a2eccd33e3c275605ffe2763

SHA512
3e5669ef45792e189f5690ad620f7294260e0768a1db4e6e5aa4ddf12921bfc627be9fe70aedad304891b8bc0c83345bd76df1ac4e10765a15b948dfe71d3bba

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-4214.exe

Filesize
468KB

MD5
cabd5af3790bae4ccc98a170d7482f38

SHA1
449af5fac6a554cd38b55b15c54fa13b5cae56b8

SHA256
7c7008b848e7dbaa20413e0a64af28a7f9af7b170cbd83a89c4f2c99fd335232

SHA512
48a8ab96f7da6a96cbc18ce6ac8741307fecfa6c1a96678559e94e9e5d93fc7ddba53ac7691b06f854c694287c1a9a96be4e8b26c61c5cb199a551e53dde3aea

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-45603.exe

Filesize
468KB

MD5
372a17d77766e78c21beb72dfaf582fb

SHA1
06a1db304d942e14a0eee7e34eff0ffdb2a2a8ad

SHA256
5d3eb2cd7d9649b7e9609b7f484fdf5979c1844b6a52e81c6c1ef4f1dddc57e1

SHA512
0663a817a179b883b212d546442bd4c477df44eb85a47de268083a5de4956dba9021cfb5e53a11822502f94028c1a3b93e3dd05efc80deccb3ab1efcca6d1cc1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-45795.exe

Filesize
468KB

MD5
5988d3f2a408387459c270750d4f4d86

SHA1
ce37701738ba8a092b273cea723882f4b924facf

SHA256
729c25dfb39d684da5392b79ff1d4bd50f65cd9b5dc865a7827e3d0c925b9d6d

SHA512
753ca6f793db87d3b5eb6ca02d09ede212fa22236fdf9b357f594ae1060ed3cced9b4b05c2984d6f5eaf573cb3c8036d012139fa2f18c54642b1e0c1bd0c5524

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-49951.exe

Filesize
468KB

MD5
f89be8702a8f8b90fffe8723eced12cd

SHA1
843ec8c2dcd8a0ca50922b1a8ca7af3bf31309ae

SHA256
776f9da09e26e22282800f550e59f438b8f366598791378cac5fa625c0c1130a

SHA512
22e063b7c418f5809873d45b3f9de07d002d63503628022e655599e6df28f0dae801c2f5f22d280906ca4c70e44856adc6ced3959e6553fbc9dac140a8ca3350

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-58394.exe

Filesize
468KB

MD5
9cddcc43cd330ebf4deb16b5a75deb51

SHA1
a6abd823810e82338389c465034e91a414a5d6b3

SHA256
f530030010fc32b89412a478566c522d09c35d32f423fce87dd62dddfbba47ed

SHA512
527ff4d420acf14e7ee71e33cb9899a6d9db6c344fcffa70491a3c3c94d4ea02734e85130a899346046e5493056e9fb544c5e348bd6023dbaf1ea798c7562f2e

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-25929.exe

Filesize
468KB

MD5
deb4449a065a2063c910b0a264354f82

SHA1
e4e2e3379a7bc5e7809132f680265353229558a0

SHA256
3e41a7913444267ec7bf9b5300c2405e8ba46748db54e20a693aaa93e45e3da5

SHA512
a884e32742e6d2a9edc606d722735f00de3169f0b1e5906615e6abca2a809808dea513fa7bdff0ad63907277b31ce43089c40519e17100a2592abc956e60ccb7

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-30811.exe

Filesize
468KB

MD5
e3fa9b14bca0700c254ac20e72ba3881

SHA1
58af45b9c4d7a1d19b96ae03d90c641824c82333

SHA256
f1ac7c7cedf05dab8044a18b0b700415f51e02716b24543112f61bfce2c2c66b

SHA512
8fec6b1b90eb8d61b50a6d5d601672d60fb8f692a0f0e079b128c25e9ec32b23f296c144ffbf62660006efbbbec6bbb3dab9cadbc0e257834a328f61dc6899e6

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-31324.exe

Filesize
468KB

MD5
cfa35fd281a0cac2de199417f50a70a9

SHA1
1a85c6a639c12b8e5aa8ba4d983d316f8292ba4c

SHA256
87c45a8598c93b00bf11986153ea2b3597b961ef6572c5eac4297b12f20bee04

SHA512
b53144e4d07de5bcf2401b64c131b13bc6315955c88cd3f9d1ff50daaa1b56e534df8e4f2f9c4bb2362813f5c3e1dada20b221243f2a1c2cba0b7424f4f2ec82

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-4279.exe

Filesize
468KB

MD5
17f287a2ab6551a47218d819b2476dc5

SHA1
b21196112e65a54c9337a174283798f91ecfad6a

SHA256
a9755312aca8d8b67830dd14dcda17d5137c42e679428089b822952b99d0f9d2

SHA512
364c1bcda81254b84f216a4a4af69a437b985a8bc38d2b3b1b0d04d2e3a9a52773db87124eee14543ed8028022f2550dbf30693e32656123f6089f2004600bc2

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-45256.exe

Filesize
468KB

MD5
d400a6c1b6b7a3e8f872989fe012b066

SHA1
b04285d22cb3c2809323523333022b2dbd0fbe54

SHA256
0d2b0612e2be35d923ec49376af78654ed6d11f726c940cdc5982354c81edfcf

SHA512
e8ad63915b38e9a41785a5d0471b7de9abb5c5b3e6a87f730e662801d65537842c18c922c3c604eb9688a17848b9b8dfd812f4f2ff540a8c3a77dbe3fbcc0ddc

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-46179.exe

Filesize
468KB

MD5
0b0302c01c296eeb09e788d30255eded

SHA1
f08e420d87247aec195cc72df6491f246e41c24a

SHA256
35a6bf5e5fb174e0a3bf0709350b4a3e0c4b2045769b233efeedb18417cba1d2

SHA512
09d17570cb8cade6787a04aa6a8d811c3ad347f85d6baa78d54de1c2328643c8442da2a1ea7f73f0a38f443785bf4152158d80cb2cc8549a650f86ae123bdf54

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-61912.exe

Filesize
468KB

MD5
c45dbfd79f3b65c3c8887bd417a04d0e

SHA1
ea3b263d10f589481d081586b6b616567499366c

SHA256
2892d8d9d752beb9187e2811f876b6c6675886c0b82719c1c174370f1bc638e3

SHA512
67dfa3ceb34b02dec58d2905710f761ca5e382abc5c3901a234dd56299e21d718fa6cae0d2a69ec2f74164690866ad00a3962fbbec212dcdd8c37a6fd9f7829d

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-62707.exe

Filesize
468KB

MD5
336e2bc471979fc9a1864ca12c8edd7d

SHA1
d1029e0d1999d1e43efa24d87153ec32f8f4b2b0

SHA256
957dcbb8d21585e05a405752060d17d76ac428420bde3ed7de26984cb6c7858f

SHA512
d9e526f92446bee3ae1fad7ae97f96497d12b5b274378bc817f3d2ba2d33efb320ab48ef6d8f53a7605d02b06c67f839098ea283f91d206ae58010e1db1ba2fd

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-6651.exe

Filesize
468KB

MD5
9ea5883480105c7643bf0a65dd170a19

SHA1
804ecbd2825476d3a2d7320c060a22b8c33ababa

SHA256
912ce75631f99779f0f686345d9427b0eb38f1cef8b3e0af5428dbc189fa8a54

SHA512
69c341f1710da938f4c279197195e6ec079e7d697a76d5681ddca350d2799834247dbcd31827c5abb075549d5bfcd42ac4fed600ca8a74b095513896354bbb44

Download Submit
memory/280-398-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/280-396-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/280-231-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/292-379-0x0000000002870000-0x00000000028E5000-memory.dmp

Filesize
468KB

Download
memory/292-378-0x0000000002870000-0x00000000028E5000-memory.dmp

Filesize
468KB

Download
memory/292-220-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/336-141-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/336-330-0x00000000025B0000-0x0000000002625000-memory.dmp

Filesize
468KB

Download
memory/536-269-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/556-278-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1072-268-0x0000000002800000-0x0000000002875000-memory.dmp

Filesize
468KB

Download
memory/1072-164-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1072-271-0x0000000002800000-0x0000000002875000-memory.dmp

Filesize
468KB

Download
memory/1128-198-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1128-291-0x0000000001EE0000-0x0000000001F55000-memory.dmp

Filesize
468KB

Download
memory/1128-289-0x0000000001EE0000-0x0000000001F55000-memory.dmp

Filesize
468KB

Download
memory/1248-126-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1248-386-0x0000000002920000-0x0000000002995000-memory.dmp

Filesize
468KB

Download
memory/1248-385-0x0000000002920000-0x0000000002995000-memory.dmp

Filesize
468KB

Download
memory/1248-218-0x0000000003450000-0x00000000034C5000-memory.dmp

Filesize
468KB

Download
memory/1248-217-0x0000000003450000-0x00000000034C5000-memory.dmp

Filesize
468KB

Download
memory/1512-229-0x0000000002840000-0x00000000028B5000-memory.dmp

Filesize
468KB

Download
memory/1512-124-0x0000000003370000-0x00000000033E5000-memory.dmp

Filesize
468KB

Download
memory/1512-407-0x0000000003370000-0x00000000033E5000-memory.dmp

Filesize
468KB

Download
memory/1512-227-0x0000000002840000-0x00000000028B5000-memory.dmp

Filesize
468KB

Download
memory/1512-125-0x0000000003370000-0x00000000033E5000-memory.dmp

Filesize
468KB

Download
memory/1516-352-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1524-360-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1528-322-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1604-248-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1696-277-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1708-251-0x0000000002470000-0x00000000024E5000-memory.dmp

Filesize
468KB

Download
memory/1708-247-0x0000000002470000-0x00000000024E5000-memory.dmp

Filesize
468KB

Download
memory/1708-112-0x0000000002470000-0x00000000024E5000-memory.dmp

Filesize
468KB

Download
memory/1708-93-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1816-358-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1924-310-0x00000000007C0000-0x0000000000835000-memory.dmp

Filesize
468KB

Download
memory/1928-292-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2028-64-0x0000000001D90000-0x0000000001E05000-memory.dmp

Filesize
468KB

Download
memory/2028-50-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2028-308-0x0000000001D90000-0x0000000001E05000-memory.dmp

Filesize
468KB

Download
memory/2028-150-0x0000000001D90000-0x0000000001E05000-memory.dmp

Filesize
468KB

Download
memory/2224-274-0x00000000023A0000-0x0000000002415000-memory.dmp

Filesize
468KB

Download
memory/2224-276-0x00000000023A0000-0x0000000002415000-memory.dmp

Filesize
468KB

Download
memory/2224-185-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2304-186-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2304-361-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2304-344-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2324-311-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2380-408-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2400-157-0x00000000025C0000-0x0000000002635000-memory.dmp

Filesize
468KB

Download
memory/2400-162-0x00000000025C0000-0x0000000002635000-memory.dmp

Filesize
468KB

Download
memory/2400-272-0x00000000025C0000-0x0000000002635000-memory.dmp

Filesize
468KB

Download
memory/2400-270-0x00000000025C0000-0x0000000002635000-memory.dmp

Filesize
468KB

Download
memory/2400-51-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2400-83-0x00000000025C0000-0x0000000002635000-memory.dmp

Filesize
468KB

Download
memory/2452-418-0x0000000002560000-0x00000000025D5000-memory.dmp

Filesize
468KB

Download
memory/2452-241-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2548-134-0x0000000002540000-0x00000000025B5000-memory.dmp

Filesize
468KB

Download
memory/2548-417-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2548-339-0x0000000002540000-0x00000000025B5000-memory.dmp

Filesize
468KB

Download
memory/2548-31-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2548-133-0x0000000002540000-0x00000000025B5000-memory.dmp

Filesize
468KB

Download
memory/2548-359-0x0000000002540000-0x00000000025B5000-memory.dmp

Filesize
468KB

Download
memory/2576-333-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2664-351-0x00000000028D0000-0x0000000002945000-memory.dmp

Filesize
468KB

Download
memory/2664-338-0x00000000028D0000-0x0000000002945000-memory.dmp

Filesize
468KB

Download
memory/2664-94-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2664-172-0x00000000028D0000-0x0000000002945000-memory.dmp

Filesize
468KB

Download
memory/2664-171-0x00000000028D0000-0x0000000002945000-memory.dmp

Filesize
468KB

Download
memory/2668-314-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2712-307-0x00000000028D0000-0x0000000002945000-memory.dmp

Filesize
468KB

Download
memory/2712-399-0x0000000003400000-0x0000000003475000-memory.dmp

Filesize
468KB

Download
memory/2712-27-0x0000000003400000-0x0000000003475000-memory.dmp

Filesize
468KB

Download
memory/2712-321-0x00000000028D0000-0x0000000002945000-memory.dmp

Filesize
468KB

Download
memory/2712-12-0x00000000028D0000-0x0000000002945000-memory.dmp

Filesize
468KB

Download
memory/2712-195-0x00000000028D0000-0x0000000002945000-memory.dmp

Filesize
468KB

Download
memory/2712-320-0x0000000003400000-0x0000000003475000-memory.dmp

Filesize
468KB

Download
memory/2712-196-0x00000000028D0000-0x0000000002945000-memory.dmp

Filesize
468KB

Download
memory/2712-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2712-5-0x0000000003400000-0x0000000003475000-memory.dmp

Filesize
468KB

Download
memory/2712-296-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2712-28-0x0000000003400000-0x0000000003475000-memory.dmp

Filesize
468KB

Download
memory/2712-294-0x00000000028D0000-0x0000000002945000-memory.dmp

Filesize
468KB

Download
memory/2796-387-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2824-312-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2880-116-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2880-239-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2880-237-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2940-380-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2952-397-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3020-324-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3040-179-0x00000000028A0000-0x0000000002915000-memory.dmp

Filesize
468KB

Download
memory/3040-66-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3040-145-0x00000000033D0000-0x0000000003445000-memory.dmp

Filesize
468KB

Download
memory/3040-319-0x00000000028A0000-0x0000000002915000-memory.dmp

Filesize
468KB

Download