c049ac9d9b7b6f13bcd00b7275ff2d430a85a40255c2de52565b458736d636eb

Analysis

max time kernel
120s
max time network
16s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
01-10-2024 01:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c049ac9d9b7b6f13bcd00b7275ff2d430a85a40255c2de52565b458736d636ebN.exe
Size

468KB
MD5

ca38d7f6bae401f671aef8de25b8a570
SHA1

b9ad8e21f161ac197cbb6562f0d3f2a3c0c55ffd
SHA256

c049ac9d9b7b6f13bcd00b7275ff2d430a85a40255c2de52565b458736d636eb
SHA512

d294ff1417d85ac2cdb37134c73635e4dab82d221c0fdfb86bfcb6b57900363325275a97c3749910439afc7c6fec88fee11a3a42e74f047c60ee1e8a69303830
SSDEEP

3072:BqobogCdj08U2bYBPz59ff8/5CK3XXpInmHevVpLGk038188tilx:BqIoh5U2iP19ffA5SzGk6E88t

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2520	Unicorn-62420.exe
2708	Unicorn-21814.exe
2580	Unicorn-17215.exe
2884	Unicorn-8386.exe
2636	Unicorn-4970.exe
2612	Unicorn-11100.exe
2640	Unicorn-6310.exe
1576	Unicorn-15553.exe
2648	Unicorn-30109.exe
1696	Unicorn-2803.exe
2504	Unicorn-13114.exe
2900	Unicorn-48247.exe
1860	Unicorn-65460.exe
804	Unicorn-59330.exe
2000	Unicorn-22824.exe
1772	Unicorn-32604.exe
540	Unicorn-30527.exe
1560	Unicorn-9656.exe
2244	Unicorn-51300.exe
1936	Unicorn-58006.exe
2088	Unicorn-53439.exe
2060	Unicorn-39288.exe
1912	Unicorn-24133.exe
880	Unicorn-14804.exe
2468	Unicorn-30264.exe
632	Unicorn-10398.exe
2120	Unicorn-22127.exe
1524	Unicorn-30793.exe
3004	Unicorn-11192.exe
2416	Unicorn-31058.exe
2628	Unicorn-41603.exe
2736	Unicorn-20009.exe
2620	Unicorn-42589.exe
2348	Unicorn-52494.exe
1744	Unicorn-62464.exe
2016	Unicorn-60196.exe
1120	Unicorn-14524.exe
2008	Unicorn-62417.exe
1224	Unicorn-62682.exe
2184	Unicorn-42624.exe
2576	Unicorn-58301.exe
1808	Unicorn-44566.exe
1748	Unicorn-64431.exe
2260	Unicorn-64431.exe
2228	Unicorn-10741.exe
1000	Unicorn-18220.exe
608	Unicorn-20166.exe
1588	Unicorn-20166.exe
792	Unicorn-57965.exe
916	Unicorn-54679.exe
1716	Unicorn-35343.exe
2116	Unicorn-13061.exe
3040	Unicorn-13061.exe
1960	Unicorn-16273.exe
828	Unicorn-30584.exe
1680	Unicorn-53928.exe
2980	Unicorn-53928.exe
1260	Unicorn-64681.exe
2756	Unicorn-40747.exe
2216	Unicorn-20881.exe
2904	Unicorn-8577.exe
2464	Unicorn-804.exe
2264	Unicorn-29480.exe
340	Unicorn-25911.exe

Loads dropped DLL 64 IoCs

pid	Process
2888	c049ac9d9b7b6f13bcd00b7275ff2d430a85a40255c2de52565b458736d636ebN.exe
2888	c049ac9d9b7b6f13bcd00b7275ff2d430a85a40255c2de52565b458736d636ebN.exe
2520	Unicorn-62420.exe
2888	c049ac9d9b7b6f13bcd00b7275ff2d430a85a40255c2de52565b458736d636ebN.exe
2520	Unicorn-62420.exe
2888	c049ac9d9b7b6f13bcd00b7275ff2d430a85a40255c2de52565b458736d636ebN.exe
2580	Unicorn-17215.exe
2580	Unicorn-17215.exe
2888	c049ac9d9b7b6f13bcd00b7275ff2d430a85a40255c2de52565b458736d636ebN.exe
2888	c049ac9d9b7b6f13bcd00b7275ff2d430a85a40255c2de52565b458736d636ebN.exe
2708	Unicorn-21814.exe
2520	Unicorn-62420.exe
2708	Unicorn-21814.exe
2520	Unicorn-62420.exe
2884	Unicorn-8386.exe
2884	Unicorn-8386.exe
2580	Unicorn-17215.exe
2580	Unicorn-17215.exe
2612	Unicorn-11100.exe
2612	Unicorn-11100.exe
2708	Unicorn-21814.exe
2708	Unicorn-21814.exe
2640	Unicorn-6310.exe
2640	Unicorn-6310.exe
2520	Unicorn-62420.exe
2636	Unicorn-4970.exe
2520	Unicorn-62420.exe
2636	Unicorn-4970.exe
2888	c049ac9d9b7b6f13bcd00b7275ff2d430a85a40255c2de52565b458736d636ebN.exe
2888	c049ac9d9b7b6f13bcd00b7275ff2d430a85a40255c2de52565b458736d636ebN.exe
1576	Unicorn-15553.exe
1576	Unicorn-15553.exe
2884	Unicorn-8386.exe
2884	Unicorn-8386.exe
2648	Unicorn-30109.exe
2648	Unicorn-30109.exe
2580	Unicorn-17215.exe
2580	Unicorn-17215.exe
1696	Unicorn-2803.exe
1696	Unicorn-2803.exe
2612	Unicorn-11100.exe
2612	Unicorn-11100.exe
2900	Unicorn-48247.exe
2900	Unicorn-48247.exe
804	Unicorn-59330.exe
2708	Unicorn-21814.exe
2640	Unicorn-6310.exe
804	Unicorn-59330.exe
2708	Unicorn-21814.exe
2640	Unicorn-6310.exe
1860	Unicorn-65460.exe
1860	Unicorn-65460.exe
2888	c049ac9d9b7b6f13bcd00b7275ff2d430a85a40255c2de52565b458736d636ebN.exe
2636	Unicorn-4970.exe
2520	Unicorn-62420.exe
2888	c049ac9d9b7b6f13bcd00b7275ff2d430a85a40255c2de52565b458736d636ebN.exe
2636	Unicorn-4970.exe
2520	Unicorn-62420.exe
2000	Unicorn-22824.exe
2000	Unicorn-22824.exe
1772	Unicorn-32604.exe
1772	Unicorn-32604.exe
1576	Unicorn-15553.exe
1576	Unicorn-15553.exe

Program crash 5 IoCs

pid	pid_target	Process	procid_target
2036	2904	WerFault.exe	91
6008	4316	WerFault.exe	348
6028	4240	WerFault.exe	338
4824	4484	WerFault.exe	360
5308	4444	WerFault.exe	357

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8577.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35518.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40333.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49668.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64681.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48806.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48806.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31654.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55455.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44944.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-647.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59006.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39304.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41175.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44368.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13053.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28701.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48659.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25343.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13053.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55896.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18019.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18993.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19743.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19167.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41719.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53330.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18019.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42986.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19167.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11192.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35702.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51368.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25186.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11269.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53040.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36809.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4970.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33084.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45029.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2074.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14702.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19743.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61320.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54333.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35702.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19167.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13061.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3225.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24175.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44805.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59741.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39994.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51944.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36794.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2074.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62420.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54679.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59842.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2869.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55455.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8946.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-458.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16133.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2888	c049ac9d9b7b6f13bcd00b7275ff2d430a85a40255c2de52565b458736d636ebN.exe
2520	Unicorn-62420.exe
2708	Unicorn-21814.exe
2580	Unicorn-17215.exe
2884	Unicorn-8386.exe
2636	Unicorn-4970.exe
2612	Unicorn-11100.exe
2640	Unicorn-6310.exe
1576	Unicorn-15553.exe
2648	Unicorn-30109.exe
1696	Unicorn-2803.exe
2504	Unicorn-13114.exe
2900	Unicorn-48247.exe
804	Unicorn-59330.exe
1860	Unicorn-65460.exe
2000	Unicorn-22824.exe
1772	Unicorn-32604.exe
540	Unicorn-30527.exe
1560	Unicorn-9656.exe
2244	Unicorn-51300.exe
1936	Unicorn-58006.exe
2088	Unicorn-53439.exe
2060	Unicorn-39288.exe
2468	Unicorn-30264.exe
632	Unicorn-10398.exe
1912	Unicorn-24133.exe
2120	Unicorn-22127.exe
1524	Unicorn-30793.exe
880	Unicorn-14804.exe
2416	Unicorn-31058.exe
3004	Unicorn-11192.exe
2628	Unicorn-41603.exe
2736	Unicorn-20009.exe
2348	Unicorn-52494.exe
2620	Unicorn-42589.exe
2008	Unicorn-62417.exe
1224	Unicorn-62682.exe
1744	Unicorn-62464.exe
2184	Unicorn-42624.exe
2016	Unicorn-60196.exe
1120	Unicorn-14524.exe
2576	Unicorn-58301.exe
1748	Unicorn-64431.exe
1808	Unicorn-44566.exe
2260	Unicorn-64431.exe
2228	Unicorn-10741.exe
1000	Unicorn-18220.exe
608	Unicorn-20166.exe
1588	Unicorn-20166.exe
792	Unicorn-57965.exe
916	Unicorn-54679.exe
3040	Unicorn-13061.exe
2116	Unicorn-13061.exe
1716	Unicorn-35343.exe
1960	Unicorn-16273.exe
828	Unicorn-30584.exe
1680	Unicorn-53928.exe
2980	Unicorn-53928.exe
1260	Unicorn-64681.exe
2756	Unicorn-40747.exe
2216	Unicorn-20881.exe
2904	Unicorn-8577.exe
2464	Unicorn-804.exe
2264	Unicorn-29480.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2888 wrote to memory of 2520	2888	c049ac9d9b7b6f13bcd00b7275ff2d430a85a40255c2de52565b458736d636ebN.exe	30
PID 2888 wrote to memory of 2520	2888	c049ac9d9b7b6f13bcd00b7275ff2d430a85a40255c2de52565b458736d636ebN.exe	30
PID 2888 wrote to memory of 2520	2888	c049ac9d9b7b6f13bcd00b7275ff2d430a85a40255c2de52565b458736d636ebN.exe	30
PID 2888 wrote to memory of 2520	2888	c049ac9d9b7b6f13bcd00b7275ff2d430a85a40255c2de52565b458736d636ebN.exe	30
PID 2888 wrote to memory of 2580	2888	c049ac9d9b7b6f13bcd00b7275ff2d430a85a40255c2de52565b458736d636ebN.exe	32
PID 2888 wrote to memory of 2580	2888	c049ac9d9b7b6f13bcd00b7275ff2d430a85a40255c2de52565b458736d636ebN.exe	32
PID 2888 wrote to memory of 2580	2888	c049ac9d9b7b6f13bcd00b7275ff2d430a85a40255c2de52565b458736d636ebN.exe	32
PID 2888 wrote to memory of 2580	2888	c049ac9d9b7b6f13bcd00b7275ff2d430a85a40255c2de52565b458736d636ebN.exe	32
PID 2520 wrote to memory of 2708	2520	Unicorn-62420.exe	31
PID 2520 wrote to memory of 2708	2520	Unicorn-62420.exe	31
PID 2520 wrote to memory of 2708	2520	Unicorn-62420.exe	31
PID 2520 wrote to memory of 2708	2520	Unicorn-62420.exe	31
PID 2888 wrote to memory of 2636	2888	c049ac9d9b7b6f13bcd00b7275ff2d430a85a40255c2de52565b458736d636ebN.exe	35
PID 2888 wrote to memory of 2636	2888	c049ac9d9b7b6f13bcd00b7275ff2d430a85a40255c2de52565b458736d636ebN.exe	35
PID 2888 wrote to memory of 2636	2888	c049ac9d9b7b6f13bcd00b7275ff2d430a85a40255c2de52565b458736d636ebN.exe	35
PID 2888 wrote to memory of 2636	2888	c049ac9d9b7b6f13bcd00b7275ff2d430a85a40255c2de52565b458736d636ebN.exe	35
PID 2580 wrote to memory of 2884	2580	Unicorn-17215.exe	34
PID 2580 wrote to memory of 2884	2580	Unicorn-17215.exe	34
PID 2580 wrote to memory of 2884	2580	Unicorn-17215.exe	34
PID 2580 wrote to memory of 2884	2580	Unicorn-17215.exe	34
PID 2708 wrote to memory of 2612	2708	Unicorn-21814.exe	36
PID 2708 wrote to memory of 2612	2708	Unicorn-21814.exe	36
PID 2708 wrote to memory of 2612	2708	Unicorn-21814.exe	36
PID 2708 wrote to memory of 2612	2708	Unicorn-21814.exe	36
PID 2520 wrote to memory of 2640	2520	Unicorn-62420.exe	37
PID 2520 wrote to memory of 2640	2520	Unicorn-62420.exe	37
PID 2520 wrote to memory of 2640	2520	Unicorn-62420.exe	37
PID 2520 wrote to memory of 2640	2520	Unicorn-62420.exe	37
PID 2884 wrote to memory of 1576	2884	Unicorn-8386.exe	38
PID 2884 wrote to memory of 1576	2884	Unicorn-8386.exe	38
PID 2884 wrote to memory of 1576	2884	Unicorn-8386.exe	38
PID 2884 wrote to memory of 1576	2884	Unicorn-8386.exe	38
PID 2580 wrote to memory of 2648	2580	Unicorn-17215.exe	39
PID 2580 wrote to memory of 2648	2580	Unicorn-17215.exe	39
PID 2580 wrote to memory of 2648	2580	Unicorn-17215.exe	39
PID 2580 wrote to memory of 2648	2580	Unicorn-17215.exe	39
PID 2612 wrote to memory of 1696	2612	Unicorn-11100.exe	40
PID 2612 wrote to memory of 1696	2612	Unicorn-11100.exe	40
PID 2612 wrote to memory of 1696	2612	Unicorn-11100.exe	40
PID 2612 wrote to memory of 1696	2612	Unicorn-11100.exe	40
PID 2708 wrote to memory of 2504	2708	Unicorn-21814.exe	41
PID 2708 wrote to memory of 2504	2708	Unicorn-21814.exe	41
PID 2708 wrote to memory of 2504	2708	Unicorn-21814.exe	41
PID 2708 wrote to memory of 2504	2708	Unicorn-21814.exe	41
PID 2640 wrote to memory of 2900	2640	Unicorn-6310.exe	42
PID 2640 wrote to memory of 2900	2640	Unicorn-6310.exe	42
PID 2640 wrote to memory of 2900	2640	Unicorn-6310.exe	42
PID 2640 wrote to memory of 2900	2640	Unicorn-6310.exe	42
PID 2520 wrote to memory of 804	2520	Unicorn-62420.exe	43
PID 2520 wrote to memory of 804	2520	Unicorn-62420.exe	43
PID 2520 wrote to memory of 804	2520	Unicorn-62420.exe	43
PID 2520 wrote to memory of 804	2520	Unicorn-62420.exe	43
PID 2636 wrote to memory of 1860	2636	Unicorn-4970.exe	44
PID 2636 wrote to memory of 1860	2636	Unicorn-4970.exe	44
PID 2636 wrote to memory of 1860	2636	Unicorn-4970.exe	44
PID 2636 wrote to memory of 1860	2636	Unicorn-4970.exe	44
PID 2888 wrote to memory of 2000	2888	c049ac9d9b7b6f13bcd00b7275ff2d430a85a40255c2de52565b458736d636ebN.exe	45
PID 2888 wrote to memory of 2000	2888	c049ac9d9b7b6f13bcd00b7275ff2d430a85a40255c2de52565b458736d636ebN.exe	45
PID 2888 wrote to memory of 2000	2888	c049ac9d9b7b6f13bcd00b7275ff2d430a85a40255c2de52565b458736d636ebN.exe	45
PID 2888 wrote to memory of 2000	2888	c049ac9d9b7b6f13bcd00b7275ff2d430a85a40255c2de52565b458736d636ebN.exe	45
PID 1576 wrote to memory of 1772	1576	Unicorn-15553.exe	46
PID 1576 wrote to memory of 1772	1576	Unicorn-15553.exe	46
PID 1576 wrote to memory of 1772	1576	Unicorn-15553.exe	46
PID 1576 wrote to memory of 1772	1576	Unicorn-15553.exe	46

C:\Users\Admin\AppData\Local\Temp\c049ac9d9b7b6f13bcd00b7275ff2d430a85a40255c2de52565b458736d636ebN.exe
"C:\Users\Admin\AppData\Local\Temp\c049ac9d9b7b6f13bcd00b7275ff2d430a85a40255c2de52565b458736d636ebN.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2888
- C:\Users\Admin\AppData\Local\Temp\Unicorn-62420.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-62420.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2520
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21814.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21814.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11100.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11100.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2803.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:1696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58006.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62682.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9255.exe
        8⤵
        
        PID:2180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13350.exe
        9⤵
        
        PID:1244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10892.exe
        10⤵
        
        PID:4040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41719.exe
        10⤵
        
        PID:4484
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4484 -s 188
        11⤵
        Program crash
        
        PID:4824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39109.exe
        10⤵
        
        PID:5660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44944.exe
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:6628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39304.exe
        9⤵
        
        PID:3240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10769.exe
        9⤵
        
        PID:3532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61320.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:4404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53330.exe
        9⤵
        
        PID:5300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19743.exe
        9⤵
        
        PID:6708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2395.exe
        8⤵
        
        PID:1584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13053.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:2988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48806.exe
        9⤵
        
        PID:3852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55455.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:4464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44974.exe
        9⤵
        
        PID:5604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36278.exe
        9⤵
        
        PID:6800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6923.exe
        8⤵
        
        PID:2824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2869.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52655.exe
        8⤵
        
        PID:4492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51076.exe
        8⤵
        
        PID:5852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36809.exe
        8⤵
        
        PID:6552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33084.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59006.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41719.exe
        8⤵
        
        PID:4444
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4444 -s 188
        9⤵
        Program crash
        
        PID:5308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39109.exe
        8⤵
        
        PID:5588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44944.exe
        8⤵
        
        PID:6592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5055.exe
        7⤵
        
        PID:2836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2869.exe
        7⤵
        
        PID:3732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52655.exe
        7⤵
        
        PID:4372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13411.exe
        7⤵
        
        PID:4844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55468.exe
        7⤵
        
        PID:6720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42624.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59842.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16299.exe
        7⤵
        
        PID:3388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12770.exe
        7⤵
        
        PID:4656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40524.exe
        7⤵
        
        PID:5532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14702.exe
        7⤵
        
        PID:6132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35518.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13053.exe
        7⤵
        
        PID:2804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48806.exe
        7⤵
        
        PID:3792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55455.exe
        7⤵
        
        PID:4348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44974.exe
        7⤵
        
        PID:5652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36278.exe
        7⤵
        
        PID:6732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12788.exe
        6⤵
        
        PID:2776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59741.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49981.exe
        6⤵
        
        PID:2052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18993.exe
        6⤵
        
        PID:5892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54333.exe
        6⤵
        
        PID:6052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53439.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64431.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59141.exe
        7⤵
        
        PID:784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13350.exe
        8⤵
        
        PID:1440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55364.exe
        8⤵
        
        PID:2872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49951.exe
        8⤵
        
        PID:3576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41175.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50065.exe
        8⤵
        
        PID:5220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55468.exe
        8⤵
        
        PID:6376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59022.exe
        7⤵
        
        PID:624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44805.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21574.exe
        8⤵
        
        PID:4900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37355.exe
        8⤵
        
        PID:5380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44368.exe
        8⤵
        
        PID:5756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53040.exe
        7⤵
        
        PID:3304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16634.exe
        7⤵
        
        PID:3552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52655.exe
        7⤵
        
        PID:4400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19773.exe
        7⤵
        
        PID:5668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36809.exe
        7⤵
        
        PID:6600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41553.exe
        6⤵
        
        PID:1276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59170.exe
        7⤵
        
        PID:3340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37335.exe
        7⤵
        
        PID:4180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9096.exe
        7⤵
        
        PID:4812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29116.exe
        7⤵
        
        PID:5504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35702.exe
        7⤵
        
        PID:5016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5055.exe
        6⤵
        
        PID:2728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2869.exe
        6⤵
        
        PID:3776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52655.exe
        6⤵
        
        PID:4500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36794.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36809.exe
        6⤵
        
        PID:6520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58301.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52950.exe
        6⤵
        
        PID:1896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59170.exe
        7⤵
        
        PID:3332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48711.exe
        7⤵
        
        PID:4168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9096.exe
        7⤵
        
        PID:5048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29116.exe
        7⤵
        
        PID:5500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35702.exe
        7⤵
        
        PID:2936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53040.exe
        6⤵
        
        PID:3288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28701.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55298.exe
        6⤵
        
        PID:4860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40524.exe
        6⤵
        
        PID:5868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15278.exe
        6⤵
        
        PID:6784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9644.exe
        5⤵
        
        PID:980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51083.exe
        6⤵
        
        PID:4428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50722.exe
        6⤵
        
        PID:4800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42986.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44944.exe
        6⤵
        
        PID:6576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33941.exe
        5⤵
        
        PID:1964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43205.exe
        5⤵
        
        PID:3716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53185.exe
        5⤵
        
        PID:5112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-617.exe
        5⤵
        
        PID:5728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54333.exe
        5⤵
        
        PID:6044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13114.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13114.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44566.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41238.exe
        6⤵
        
        PID:1944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45029.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43192.exe
        7⤵
        
        PID:4508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19842.exe
        7⤵
        
        PID:4720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44368.exe
        7⤵
        
        PID:5984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21470.exe
        6⤵
        
        PID:2540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62541.exe
        6⤵
        
        PID:3632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61320.exe
        6⤵
        
        PID:5080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29946.exe
        6⤵
        
        PID:5148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19167.exe
        6⤵
        
        PID:6368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35518.exe
        5⤵
        
        PID:2400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1275.exe
        6⤵
        
        PID:6060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58905.exe
        5⤵
        
        PID:3272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7969.exe
        5⤵
        
        PID:3540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36119.exe
        5⤵
        
        PID:4424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36839.exe
        5⤵
        
        PID:5644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15278.exe
        5⤵
        
        PID:6416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24133.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24133.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40747.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23091.exe
        6⤵
        
        PID:2644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4184.exe
        7⤵
        
        PID:2952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2274.exe
        7⤵
        
        PID:4048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32865.exe
        7⤵
        
        PID:4952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39994.exe
        7⤵
        
        PID:5552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19167.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25922.exe
        6⤵
        
        PID:2532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23049.exe
        6⤵
        
        PID:3152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61320.exe
        6⤵
        
        PID:4212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36308.exe
        6⤵
        
        PID:5676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19743.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62301.exe
        5⤵
        
        PID:2752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9028.exe
        5⤵
        
        PID:3464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18959.exe
        5⤵
        
        PID:4552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8460.exe
        5⤵
        
        PID:4936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55468.exe
        5⤵
        
        PID:6432
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8577.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8577.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2904
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2904 -s 236
        5⤵
        Program crash
        
        PID:2036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53993.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53993.exe
      4⤵
      PID:2296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3714.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3714.exe
      4⤵
      PID:3384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53185.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53185.exe
      4⤵
      PID:4536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46610.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46610.exe
      4⤵
      PID:5784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9943.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9943.exe
      4⤵
      PID:6664
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6310.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6310.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48247.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48247.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39288.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64431.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58233.exe
        7⤵
        
        PID:1600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48570.exe
        8⤵
        
        PID:4776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15389.exe
        8⤵
        
        PID:6104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39079.exe
        8⤵
        
        PID:6724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28865.exe
        7⤵
        
        PID:2812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29868.exe
        7⤵
        
        PID:3608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61320.exe
        7⤵
        
        PID:5064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34554.exe
        7⤵
        
        PID:5424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19167.exe
        7⤵
        
        PID:6328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8040.exe
        6⤵
        
        PID:732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7013.exe
        7⤵
        
        PID:3036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48806.exe
        7⤵
        
        PID:3784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55455.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43220.exe
        7⤵
        
        PID:5416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35702.exe
        7⤵
        
        PID:5196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58905.exe
        6⤵
        
        PID:3176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12166.exe
        6⤵
        
        PID:3320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5954.exe
        6⤵
        
        PID:4992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18993.exe
        6⤵
        
        PID:5880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54333.exe
        6⤵
        
        PID:5980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10741.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-458.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9314.exe
        6⤵
        
        PID:2616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55455.exe
        6⤵
        
        PID:4304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61995.exe
        6⤵
        
        PID:5284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59934.exe
        6⤵
        
        PID:6100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15651.exe
        5⤵
        
        PID:844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28915.exe
        5⤵
        
        PID:3172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52655.exe
        5⤵
        
        PID:4380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5082.exe
        5⤵
        
        PID:5708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55468.exe
        5⤵
        
        PID:6528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10398.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10398.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13061.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13053.exe
        6⤵
        
        PID:2712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31501.exe
        6⤵
        
        PID:4076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14089.exe
        6⤵
        
        PID:4236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39994.exe
        6⤵
        
        PID:5776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19743.exe
        6⤵
        
        PID:6636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9477.exe
        5⤵
        
        PID:2556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62541.exe
        5⤵
        
        PID:3752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61320.exe
        5⤵
        
        PID:4188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2074.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19743.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30584.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30584.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43473.exe
        5⤵
        
        PID:1016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20948.exe
        5⤵
        
        PID:3504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1194.exe
        5⤵
        
        PID:4728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61995.exe
        5⤵
        
        PID:5276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35702.exe
        5⤵
        
        PID:6136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54137.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54137.exe
      4⤵
      PID:2940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20249.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20249.exe
      4⤵
      PID:3404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36119.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36119.exe
      4⤵
      PID:4564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54239.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54239.exe
      4⤵
      PID:5164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54333.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54333.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6112
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59330.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59330.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30264.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30264.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53928.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25186.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62793.exe
        6⤵
        
        PID:4528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17042.exe
        6⤵
        
        PID:4756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19167.exe
        6⤵
        
        PID:2084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51724.exe
        5⤵
        
        PID:1776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23049.exe
        5⤵
        
        PID:3144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61320.exe
        5⤵
        
        PID:4356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2074.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19167.exe
        5⤵
        
        PID:2760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20881.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20881.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13053.exe
        5⤵
        
        PID:1704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48806.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55455.exe
        5⤵
        
        PID:4220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38612.exe
        5⤵
        
        PID:5156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35702.exe
        5⤵
        
        PID:6248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6923.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6923.exe
      4⤵
      PID:1976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28701.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28701.exe
      4⤵
      PID:4104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55298.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55298.exe
      4⤵
      PID:944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40524.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40524.exe
      4⤵
      PID:5864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15278.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15278.exe
      4⤵
      PID:6584
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30793.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30793.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53928.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53928.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41648.exe
        5⤵
        
        PID:2420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1746.exe
        6⤵
        
        PID:3744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41719.exe
        6⤵
        
        PID:4316
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4316 -s 188
        7⤵
        Program crash
        
        PID:6008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56130.exe
        6⤵
        
        PID:5252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44944.exe
        6⤵
        
        PID:6620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39304.exe
        5⤵
        
        PID:3264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10769.exe
        5⤵
        
        PID:3684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61320.exe
        5⤵
        
        PID:4548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36308.exe
        5⤵
        
        PID:5540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11462.exe
        5⤵
        
        PID:6404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21782.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21782.exe
      4⤵
      PID:2828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44971.exe
        5⤵
        
        PID:3896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32105.exe
        5⤵
        
        PID:2192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48659.exe
        5⤵
        
        PID:5872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35702.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53040.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53040.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16634.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16634.exe
      4⤵
      PID:3496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52655.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52655.exe
      4⤵
      PID:4412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19773.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19773.exe
      4⤵
      PID:5612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55468.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55468.exe
      4⤵
      PID:6536
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64681.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64681.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13053.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13053.exe
      4⤵
      PID:780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48806.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48806.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49668.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49668.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39994.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39994.exe
      4⤵
      PID:5692
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19167.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19167.exe
      4⤵
      PID:6312
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53125.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53125.exe
    3⤵
    PID:2688
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60271.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60271.exe
    3⤵
    PID:3724
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31654.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31654.exe
    3⤵
    PID:4204
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8219.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8219.exe
    3⤵
    PID:5372
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13567.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13567.exe
    3⤵
    PID:6196
- C:\Users\Admin\AppData\Local\Temp\Unicorn-17215.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-17215.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2580
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8386.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8386.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15553.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15553.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32604.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:1772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41603.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-804.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41648.exe
        8⤵
        
        PID:2744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54324.exe
        9⤵
        
        PID:1948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24363.exe
        9⤵
        
        PID:3800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35310.exe
        9⤵
        
        PID:4908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43220.exe
        9⤵
        
        PID:5456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35702.exe
        9⤵
        
        PID:6232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55896.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:2732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34683.exe
        8⤵
        
        PID:3520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48305.exe
        8⤵
        
        PID:4760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34554.exe
        8⤵
        
        PID:5448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19167.exe
        8⤵
        
        PID:6272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3225.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34728.exe
        8⤵
        
        PID:4612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29058.exe
        8⤵
        
        PID:5840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19597.exe
        8⤵
        
        PID:6396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53040.exe
        7⤵
        
        PID:3216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28701.exe
        7⤵
        
        PID:4120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55298.exe
        7⤵
        
        PID:4848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40524.exe
        7⤵
        
        PID:5812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14702.exe
        7⤵
        
        PID:6068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29480.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41648.exe
        7⤵
        
        PID:2928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16464.exe
        8⤵
        
        PID:3596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28535.exe
        8⤵
        
        PID:4772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48659.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35702.exe
        8⤵
        
        PID:6216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39304.exe
        7⤵
        
        PID:3280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37367.exe
        7⤵
        
        PID:4144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6296.exe
        7⤵
        
        PID:4788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23458.exe
        7⤵
        
        PID:5940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36809.exe
        7⤵
        
        PID:6508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53883.exe
        6⤵
        
        PID:2784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42182.exe
        7⤵
        
        PID:2932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48806.exe
        7⤵
        
        PID:3816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55455.exe
        7⤵
        
        PID:4260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38420.exe
        7⤵
        
        PID:5124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35702.exe
        7⤵
        
        PID:5484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58905.exe
        6⤵
        
        PID:3208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12166.exe
        6⤵
        
        PID:3980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24729.exe
        6⤵
        
        PID:4972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18993.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54333.exe
        6⤵
        
        PID:6264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20009.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25911.exe
        6⤵
        Executes dropped EXE
        
        PID:340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56723.exe
        7⤵
        
        PID:3016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43434.exe
        8⤵
        
        PID:5956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25343.exe
        8⤵
        
        PID:6656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39304.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37367.exe
        7⤵
        
        PID:4128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6296.exe
        7⤵
        
        PID:4784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3915.exe
        7⤵
        
        PID:5512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36233.exe
        7⤵
        
        PID:6204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59022.exe
        6⤵
        
        PID:2596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59170.exe
        7⤵
        
        PID:3324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48711.exe
        7⤵
        
        PID:4160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20917.exe
        7⤵
        
        PID:4988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25777.exe
        7⤵
        
        PID:5548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53040.exe
        6⤵
        
        PID:3164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28701.exe
        6⤵
        
        PID:4136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12782.exe
        6⤵
        
        PID:2852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4777.exe
        6⤵
        
        PID:5492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39874.exe
        5⤵
        
        PID:884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13053.exe
        6⤵
        
        PID:2040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48806.exe
        6⤵
        
        PID:3840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55455.exe
        6⤵
        
        PID:4324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61995.exe
        6⤵
        
        PID:5292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36278.exe
        6⤵
        
        PID:6480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12788.exe
        5⤵
        
        PID:320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59741.exe
        5⤵
        
        PID:3656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36119.exe
        5⤵
        
        PID:4228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35085.exe
        5⤵
        
        PID:5400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14702.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30527.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30527.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42589.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2961.exe
        6⤵
        
        PID:380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8352.exe
        7⤵
        
        PID:3996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41719.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4240
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4240 -s 188
        8⤵
        Program crash
        
        PID:6028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37355.exe
        7⤵
        
        PID:5340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44368.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39304.exe
        6⤵
        
        PID:3256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10769.exe
        6⤵
        
        PID:3512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61320.exe
        6⤵
        
        PID:4296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53330.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19743.exe
        6⤵
        
        PID:6688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10913.exe
        5⤵
        
        PID:1160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49070.exe
        5⤵
        
        PID:3676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32509.exe
        5⤵
        
        PID:4924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38341.exe
        5⤵
        
        PID:1308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36809.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52494.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52494.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62039.exe
        5⤵
        
        PID:1232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60199.exe
        6⤵
        
        PID:1256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62793.exe
        6⤵
        
        PID:4520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7608.exe
        6⤵
        
        PID:4836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19167.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58725.exe
        5⤵
        
        PID:1640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29868.exe
        5⤵
        
        PID:3548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61320.exe
        5⤵
        
        PID:5056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29946.exe
        5⤵
        
        PID:5172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19167.exe
        5⤵
        
        PID:6296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10526.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10526.exe
      4⤵
      PID:2104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59170.exe
        5⤵
        
        PID:3348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37335.exe
        5⤵
        
        PID:4192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9096.exe
        5⤵
        
        PID:4944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48659.exe
        5⤵
        
        PID:5920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36278.exe
        5⤵
        
        PID:6680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33173.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33173.exe
      4⤵
      PID:1752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10533.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10533.exe
      4⤵
      PID:3560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53185.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53185.exe
      4⤵
      PID:5104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8946.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8946.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9367.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9367.exe
      4⤵
      PID:6180
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30109.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30109.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9656.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9656.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62464.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9909.exe
        6⤵
        
        PID:1084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63336.exe
        7⤵
        
        PID:3924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28535.exe
        7⤵
        
        PID:4748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48659.exe
        7⤵
        
        PID:5924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35702.exe
        7⤵
        
        PID:6240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23006.exe
        6⤵
        
        PID:2536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62541.exe
        6⤵
        
        PID:3880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61320.exe
        6⤵
        
        PID:4448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53330.exe
        6⤵
        
        PID:5264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19743.exe
        6⤵
        
        PID:6760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36831.exe
        5⤵
        
        PID:1656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48563.exe
        6⤵
        
        PID:4920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29058.exe
        6⤵
        
        PID:5836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39079.exe
        6⤵
        
        PID:6744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-647.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2869.exe
        5⤵
        
        PID:3700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52655.exe
        5⤵
        
        PID:4388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5082.exe
        5⤵
        
        PID:5716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55468.exe
        5⤵
        
        PID:6440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60196.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60196.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40050.exe
        5⤵
        
        PID:2548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13053.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31501.exe
        6⤵
        
        PID:4060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14089.exe
        6⤵
        
        PID:4980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39994.exe
        6⤵
        
        PID:5572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19167.exe
        6⤵
        
        PID:6304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40333.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62541.exe
        5⤵
        
        PID:3848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61320.exe
        5⤵
        
        PID:5088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34554.exe
        5⤵
        
        PID:5388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19167.exe
        5⤵
        
        PID:6352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35083.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35083.exe
      4⤵
      PID:2500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20420.exe
        5⤵
        
        PID:6884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55816.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55816.exe
      4⤵
      PID:3564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23448.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23448.exe
      4⤵
      PID:4672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21065.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21065.exe
      4⤵
      PID:2972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36809.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36809.exe
      4⤵
      PID:6776
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51300.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51300.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14524.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14524.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13350.exe
        5⤵
        
        PID:2212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11185.exe
        6⤵
        
        PID:2780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48806.exe
        6⤵
        
        PID:3708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49668.exe
        6⤵
        
        PID:4708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39994.exe
        6⤵
        
        PID:5628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19167.exe
        6⤵
        
        PID:6336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56857.exe
        5⤵
        
        PID:1904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62541.exe
        5⤵
        
        PID:3876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61320.exe
        5⤵
        
        PID:4340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36308.exe
        5⤵
        
        PID:5564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19743.exe
        5⤵
        
        PID:6808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24429.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24429.exe
      4⤵
      PID:2948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43460.exe
        5⤵
        
        PID:4700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25343.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53040.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53040.exe
      4⤵
      PID:3232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28701.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28701.exe
      4⤵
      PID:4068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55298.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55298.exe
      4⤵
      PID:924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40524.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40524.exe
      4⤵
      PID:5820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14702.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14702.exe
      4⤵
      PID:6084
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62417.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62417.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52950.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52950.exe
      4⤵
      PID:2012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59505.exe
        5⤵
        
        PID:4332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60898.exe
        5⤵
        
        PID:4932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42794.exe
        5⤵
        
        PID:5948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44944.exe
        5⤵
        
        PID:6612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53040.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53040.exe
      4⤵
      PID:3224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18004.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18004.exe
      4⤵
      PID:3936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52655.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52655.exe
      4⤵
      PID:3604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18019.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18019.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55468.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55468.exe
      4⤵
      PID:6172
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24694.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24694.exe
    3⤵
    PID:2488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26645.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26645.exe
      4⤵
      PID:2072
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48806.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48806.exe
      4⤵
      PID:3916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55455.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55455.exe
      4⤵
      PID:4248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30283.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30283.exe
      4⤵
      PID:5760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35702.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35702.exe
      4⤵
      PID:6256
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1179.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1179.exe
    3⤵
    PID:3052
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60271.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60271.exe
    3⤵
    PID:3736
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31654.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31654.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4156
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44464.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44464.exe
    3⤵
    PID:5228
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51368.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51368.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6152
- C:\Users\Admin\AppData\Local\Temp\Unicorn-4970.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-4970.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2636
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-65460.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-65460.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14804.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14804.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13061.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24673.exe
        6⤵
        
        PID:2424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48806.exe
        6⤵
        
        PID:3908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34401.exe
        6⤵
        
        PID:4740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39994.exe
        6⤵
        
        PID:5636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19167.exe
        6⤵
        
        PID:6128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9477.exe
        5⤵
        
        PID:2536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27097.exe
        5⤵
        
        PID:2372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35734.exe
        5⤵
        
        PID:3644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9200.exe
        5⤵
        
        PID:4792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40524.exe
        5⤵
        
        PID:5772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14702.exe
        5⤵
        
        PID:5556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16273.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16273.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31237.exe
        5⤵
        
        PID:1612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2274.exe
        5⤵
        
        PID:4088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32865.exe
        5⤵
        
        PID:4964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39994.exe
        5⤵
        
        PID:5748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19167.exe
        5⤵
        
        PID:6344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39798.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39798.exe
      4⤵
      PID:2764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28915.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28915.exe
      4⤵
      PID:3184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52655.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52655.exe
      4⤵
      PID:4360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18019.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18019.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55468.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55468.exe
      4⤵
      PID:6608
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11192.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11192.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:3004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20166.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20166.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13350.exe
        5⤵
        
        PID:2092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37156.exe
        6⤵
        
        PID:4724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25343.exe
        6⤵
        
        PID:6448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39304.exe
        5⤵
        
        PID:3200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10769.exe
        5⤵
        
        PID:3492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61320.exe
        5⤵
        
        PID:5096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21617.exe
        5⤵
        
        PID:5736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19167.exe
        5⤵
        
        PID:6320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59022.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59022.exe
      4⤵
      PID:1988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13053.exe
        5⤵
        
        PID:900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48806.exe
        5⤵
        
        PID:3832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55455.exe
        5⤵
        
        PID:4284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61995.exe
        5⤵
        
        PID:5244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36278.exe
        5⤵
        
        PID:6488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6923.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6923.exe
      4⤵
      PID:1764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28701.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28701.exe
      4⤵
      PID:4072
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12782.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12782.exe
      4⤵
      PID:4984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4777.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4777.exe
      4⤵
      PID:5472
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54679.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54679.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14843.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14843.exe
      4⤵
      PID:1500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9314.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9314.exe
      4⤵
      PID:3360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55455.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55455.exe
      4⤵
      PID:4480
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10739.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10739.exe
      4⤵
      PID:5844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36278.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36278.exe
      4⤵
      PID:6768
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29078.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29078.exe
    3⤵
    PID:2964
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59741.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59741.exe
    3⤵
    PID:3664
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36119.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36119.exe
    3⤵
    PID:4496
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36839.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36839.exe
    3⤵
    PID:5596
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15278.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15278.exe
    3⤵
    PID:6568
- C:\Users\Admin\AppData\Local\Temp\Unicorn-22824.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-22824.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:2000
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31058.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31058.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18220.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18220.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58751.exe
        5⤵
        
        PID:2336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2274.exe
        5⤵
        
        PID:4064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14089.exe
        5⤵
        
        PID:5036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39994.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19167.exe
        5⤵
        
        PID:6360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39653.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39653.exe
      4⤵
      PID:1880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23049.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23049.exe
      4⤵
      PID:4092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61320.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61320.exe
      4⤵
      PID:5072
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34554.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34554.exe
      4⤵
      PID:5432
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19167.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19167.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5996
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57965.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57965.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44295.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44295.exe
      4⤵
      PID:2280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13053.exe
        5⤵
        
        PID:372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16133.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55455.exe
        5⤵
        
        PID:4276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43220.exe
        5⤵
        
        PID:5328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35702.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58725.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58725.exe
      4⤵
      PID:1972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62541.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62541.exe
      4⤵
      PID:3892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61320.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61320.exe
      4⤵
      PID:4288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36308.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36308.exe
      4⤵
      PID:5620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19743.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19743.exe
      4⤵
      PID:6544
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20889.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20889.exe
    3⤵
    PID:2892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-876.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-876.exe
      4⤵
      PID:6900
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50362.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50362.exe
    3⤵
    PID:3448
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34226.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34226.exe
    3⤵
    PID:4632
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8268.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8268.exe
    3⤵
    PID:4816
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36809.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36809.exe
    3⤵
    PID:6560
- C:\Users\Admin\AppData\Local\Temp\Unicorn-22127.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-22127.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2120
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20166.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20166.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2193.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2193.exe
      4⤵
      PID:376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22072.exe
        5⤵
        
        PID:5008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60771.exe
        5⤵
        
        PID:6088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39079.exe
        5⤵
        
        PID:6792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39304.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39304.exe
      4⤵
      PID:3248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10769.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10769.exe
      4⤵
      PID:3696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61320.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61320.exe
      4⤵
      PID:4368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36308.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36308.exe
      4⤵
      PID:5576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19743.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19743.exe
      4⤵
      PID:6700
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7154.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7154.exe
    3⤵
    PID:2976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60200.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60200.exe
      4⤵
      PID:5408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24767.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24767.exe
      4⤵
      PID:6164
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24175.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24175.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3760
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41175.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41175.exe
    3⤵
    PID:4876
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53330.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53330.exe
    3⤵
    PID:5236
- C:\Users\Admin\AppData\Local\Temp\Unicorn-35343.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-35343.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1716
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62923.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62923.exe
    3⤵
    PID:876
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32509.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32509.exe
    3⤵
    PID:4892
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5082.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5082.exe
    3⤵
    PID:5700
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55468.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55468.exe
    3⤵
    PID:6020
- C:\Users\Admin\AppData\Local\Temp\Unicorn-11269.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-11269.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3008
- C:\Users\Admin\AppData\Local\Temp\Unicorn-64786.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-64786.exe
  2⤵
  PID:3372
- C:\Users\Admin\AppData\Local\Temp\Unicorn-26319.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-26319.exe
  2⤵
  PID:4576
- C:\Users\Admin\AppData\Local\Temp\Unicorn-45475.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-45475.exe
  2⤵
  PID:5828
- C:\Users\Admin\AppData\Local\Temp\Unicorn-51944.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-51944.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6424

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-11100.exe

Filesize
468KB

MD5
40d393d058c8d25fa9bf69c1cb2eea2d

SHA1
b43abd895096904c206763f8b605cf1970e8deb4

SHA256
5aa3e8f37323f5df9d2d7dd37399e96e1ff308011967cb844f55b9b2a16ba67f

SHA512
6b9e1d6a17560074313975794cfcdf7cc98f8a4604fca68a5d2d7218eff3358892490f1f124d38ff3ffc088597cf4080878e5ad59414c51e47c61c0a9cbc5c4c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-15553.exe

Filesize
468KB

MD5
6845177932d15e6c080ccb8ba1cc2767

SHA1
c86b4e3d0edb6266f70f854721a6758f0668d739

SHA256
65b56b2e8f680579baaa43df955c4f46f2bf697350277b5c46460593d5938c57

SHA512
37f1e6fb93e3a8b7764d08c9936d52844abf13fb760f0e5dd0ddb49c5c9b67c2b8269849ad96b6f0eeb42f5565a11de8575912ac5973d66edb2bf306ac39c5f3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-30109.exe

Filesize
468KB

MD5
b536e30e24d9c5d196122b24bdce57b2

SHA1
c11ac856d7ff82a665dfbad5cbfec438facb32cf

SHA256
9e6903b9844941e19e75b5a8c808965c0e0463da5b8b8208ba8b0fca111abdc3

SHA512
932df78eb99feae7878a88da8f60ac0931ece681bdb057dcfe051a8f030df2da21549d30d7717cc1f56dafec2dbc5a387c0635e2e3808e8b1154b4510557a429

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-32604.exe

Filesize
468KB

MD5
5d00fdf12bec1568ea6d56aa3a8f9ca9

SHA1
396949bf402b4f0c1bf9dca46d6d07d95cf3b278

SHA256
5b9ef6a7d531cb676f7007ad4336442080efc4bdb85e1a24e9572bdea05e7e58

SHA512
d2c15038bfc27c5f57f7d6f684c1fb7794b2ad8c095dd5659e4f6644fe2e824ede10af5796f7ca3eebe5511ff794f575b81beaeda18ce73344c011b802ab021e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39653.exe

Filesize
468KB

MD5
6279c8759bd24569ab2df40f8f306a03

SHA1
5113da3468384b6d72503c44034c0d545e9f6c4f

SHA256
2f17dbda3e21c530414e711505a11773413c126a404697f53c2b3b242ad61c27

SHA512
3300d1e17aa065517f8e8951c22d804f6565911e62a873d1f6f1500c45d8b37fd41903c85f6953758de5d8757d811d45012583700ca637fc1bd7d940a479c8ba

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-48247.exe

Filesize
468KB

MD5
2a66b464e51666d7f1f270d4078b54fb

SHA1
ae67508d030e616765d729596868c989fe26b6a8

SHA256
672815c403e4f47856ae96cb83580d22db3aad631897cacb59fb0279a8b2b774

SHA512
319f54fea903326cbe17a60c3e308de892f8cbd2d27b95133abf73c4829b2263d6a005f567e1fb8b187bde4c9023f9be30bb3037aed98fc0b554ae7c05f30960

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-55364.exe

Filesize
468KB

MD5
31ca8c5af28661c48cde213e479c068e

SHA1
0391497e356b5f7bd796e677c97fd9cb8d992189

SHA256
df7003ceee872521587ed7d436b2e6240e61e8d39ec6771d226b58eee9eb5faf

SHA512
58c3bb9d615fdfc98b9e7640a5a069a9211be9bd36a75cb44b12e02c80447dabd3a05ffd9751bd2db8804fe12e75da269489cff1f36007ec221338d3c3c25631

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-65460.exe

Filesize
468KB

MD5
3dc23ac36b844c68c69721341c11b16a

SHA1
68aacdc9db3e7145325d4f943b85317691c54d59

SHA256
9af2a7b32d9b2e94fc77138c63c6f4a18e2d2f4c6d389f929de5dbeea77f3902

SHA512
e760a653a8c2bc18f49cbbf0bb7e4862162b7e93f3e29f37adbc4710066e67a2f9fda2d7123ecc0504036af75c7446441255eaa08291e81e78ccdbb74b8d2bee

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-13114.exe

Filesize
468KB

MD5
f357b5a1efb0e8f1d9bd4f1e2c5b0a24

SHA1
a5caf62adad9f5bb50a379b03e04d6cac6b9a7df

SHA256
b1a3e6d3db3f4d8682f7e67cf367781d348557b49b5c52b9ef092db63e3338be

SHA512
b72c850e8deef9833f4ef3a9bb668382d25e7c6330d3848c749783d68488713427905eac653798fa3c6fa85dac88444c96e3843bbb9ae471c32fe10093044590

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-17215.exe

Filesize
468KB

MD5
5fd526c698511dfe3e988c66a952d38e

SHA1
fbb9885e9c5fc4524d6b7cdaed2c8ea148e5f67a

SHA256
e3b26bbb19362f026a7b47b82ef6d0c89f651fb65195782b7080fe2330a5e3ea

SHA512
743bd920e0d932e8e4b95d3d24469dbf498285e85e82146234d98562a0d7fb063beb0e3554e7cfbdf2c360235a52d3991731feb0b389f23d92cab976f62168b8

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-21814.exe

Filesize
468KB

MD5
e6c003c2a882712df34a44175d38bf23

SHA1
47d6abf894f9fa8a2a2519c54faa8ec0968e7ba6

SHA256
3f24c4a17e3aa29a5c63c26c9a6981f5834e8fedce108e4119f153e49bd0ed2b

SHA512
e2da362b3a2bcc8ce467da4f598e6c5feb130ac679e5ee12386019a1fc3be620e1f9118de1d0cf0581f9189676d43adc05e1eec380cc43b60b2f763dce83f7dd

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-22824.exe

Filesize
468KB

MD5
6a9ee427c266f574e18a454a022ebdd0

SHA1
6e5ead2228e656440ce934cc1ba6de91a43544a7

SHA256
00568a97219dbe47523e3d0713c578abef336c98a7e193454e1b5133e3752452

SHA512
ff6facdab543c6623e5fdfa504a1d1ced8034ed991c89b0fc721b60a9a2755ba4c8e7d92f1de6e575558ebee70f326bf2773201d4273ddcb203ec69ca00fdaae

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-2803.exe

Filesize
468KB

MD5
14d9d2eeba4fb8a149be07074e3a8ecb

SHA1
d18d4e01290d591dcbb25e6a4000cd42b1a6e86b

SHA256
138374eb0c9bd707b267b67ef3433c37882ed0372061ce7ebe2d404f9160bf9f

SHA512
77d8c704103e41a37892d9184f074a60e558f434e2b171205090345fedff7c736fd74f676975ac55ed66cfca9299221c8336abec1bf38ed2b27f0b8dcd411463

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-30527.exe

Filesize
468KB

MD5
bd77c7dd63e923d1ff2eb23447f3acdb

SHA1
5509e00d51266fafb41e7fd120f694ea8d99c74d

SHA256
7e27f5950f190dfb3ce8a7c614863b736018bed09363011af16111ab0a5adaef

SHA512
ed7cdc1d9a49d98ed86d99006ea889261577931c61a9b25492150798e3c7326b604379081a3a615c57ba3697b9a57b0c51642c8297a0b6e214536e448565fc1f

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-4970.exe

Filesize
468KB

MD5
d2e552432a1197da7ee9746b7d5d587e

SHA1
7c3f92ea423b0e379e12c126a2e3bb3be88fd7dd

SHA256
49733c54e3b0d0577070ffe3627034cd1ef400257cf11aabc48eeffd3f556820

SHA512
e1821dc33bb7133a024acba7726198b7ee90f912a018fe66963b9140be94d69316f118148bf6f60bcb89f4fe1a307c57db6ca096e191bbaa41c92baf57f9267c

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-51300.exe

Filesize
468KB

MD5
bdf09999039b51e14b30f4291c4a7b94

SHA1
892f1b3efd4cc7c1f9b1a4be3aa328587f7b3835

SHA256
000575592e10fe77e9b8d69767cad910f3ec54008b54fd75f5c95831f94418ff

SHA512
86e692de4f861ec28f94c4e89138a67a56de1ca1535add09943d3034ed165c2518ce70d75049f9e9cbc5e8ede41b91fceb265ef5b6b71f9995d0bc4081b0feea

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-59330.exe

Filesize
468KB

MD5
f01c88405e333435b487a5410d2f970b

SHA1
23a98af1103c8df359b5fef97a655e91f2ec5278

SHA256
f86b02a1be4ea19337febfe116250c1cbf1ef3ad23557e686c1220228bec537b

SHA512
3f0cd6258341fa7f55fd8d1de806886e87bdbc5e42744f51831f2406620a0a41adee1e8c6a50b4eaada162c3d80ca6d6e9c95030240fdad9d7c9b3001acecb77

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-62420.exe

Filesize
468KB

MD5
ba13ca5e7245ccd0b3ebbd0de882cec6

SHA1
111ebea493ef5a09493a43d029ea760dbbf81034

SHA256
189c778ffe264bd1919813825ab56f634271376d8e6540bb9eb574ab7b149364

SHA512
adb48d31376b5afe2bfdc6bcead167de94605ac1387365619fb7449dd4cad5bfab3f07efed94d350c7aad112102816d624f9731017705ce2f337a3c7daf695c7

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-6310.exe

Filesize
468KB

MD5
7eb25300dc101f57935630c5b767c141

SHA1
be57c81bbb2e29f981dbcaf18868fb80fb1c5e59

SHA256
8471d867c7d34275a1740030538ca0111c4b98659ce6342ace8baeb6e7177961

SHA512
0e3f6386f531f709534f0afb4e4f12b655a912451106718caca95ef212286bebb0dd89abaa5bfbbbdac8c25fe002cb515ecf942b482c67724149e3a65495917c

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-8386.exe

Filesize
468KB

MD5
a806361204f12e354aacb7f247a62e27

SHA1
74542065d08c4399e4484b7044a47091b7f966fb

SHA256
65287a2f91dfb2f7dad64738ace75240f043eb6a7f5c43548d6b82bbde61e71c

SHA512
be1dad1349c4b497c4d04a24204586badb65e3262d8b125a5a283579de73558a1ae1391f02fd24edf02da2bcf2e1af2f8bbeacf164fe1a26b7e234b82bc9b179

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-9656.exe

Filesize
468KB

MD5
f1489576dce77a016ecb4a633a744013

SHA1
9b604314e2d8d8ff76dbfd7d0c4b10c5e9d54a48

SHA256
096dba91ed224bcc2c54c12bf937bb570bdbfa4b401f142bbebe1b4840f517b0

SHA512
2d3d4d18938889793bf9cb4cb883eae50516c74a85aef59d1e49219b4540cfbeca29bd02a483a01e30fdef8e4fe3ff259d83f168a8651c26f1e7606f590ec789

Download Submit
memory/540-371-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/540-372-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/540-209-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/632-297-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/804-288-0x0000000003790000-0x0000000003805000-memory.dmp

Filesize
468KB

Download
memory/804-167-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/880-295-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1120-420-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1224-425-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1524-329-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1560-223-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1560-388-0x0000000000370000-0x00000000003E5000-memory.dmp

Filesize
468KB

Download
memory/1560-390-0x0000000000370000-0x00000000003E5000-memory.dmp

Filesize
468KB

Download
memory/1576-196-0x0000000002710000-0x0000000002785000-memory.dmp

Filesize
468KB

Download
memory/1576-361-0x0000000002710000-0x0000000002785000-memory.dmp

Filesize
468KB

Download
memory/1576-95-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1576-198-0x0000000002710000-0x0000000002785000-memory.dmp

Filesize
468KB

Download
memory/1696-241-0x0000000001C40000-0x0000000001CB5000-memory.dmp

Filesize
468KB

Download
memory/1696-237-0x0000000001C40000-0x0000000001CB5000-memory.dmp

Filesize
468KB

Download
memory/1696-130-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1696-429-0x0000000001C40000-0x0000000001CB5000-memory.dmp

Filesize
468KB

Download
memory/1696-428-0x0000000001C40000-0x0000000001CB5000-memory.dmp

Filesize
468KB

Download
memory/1744-389-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1772-353-0x00000000026F0000-0x0000000002765000-memory.dmp

Filesize
468KB

Download
memory/1772-351-0x00000000026F0000-0x0000000002765000-memory.dmp

Filesize
468KB

Download
memory/1772-201-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1860-165-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1860-293-0x0000000000380000-0x00000000003F5000-memory.dmp

Filesize
468KB

Download
memory/1912-294-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1936-424-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/1936-242-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2000-326-0x0000000002440000-0x00000000024B5000-memory.dmp

Filesize
468KB

Download
memory/2000-181-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2000-324-0x0000000002440000-0x00000000024B5000-memory.dmp

Filesize
468KB

Download
memory/2008-427-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2016-405-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2060-265-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2088-254-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2120-323-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2244-232-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2244-397-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2348-381-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2416-331-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2468-296-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2520-327-0x0000000001CA0000-0x0000000001D15000-memory.dmp

Filesize
468KB

Download
memory/2520-395-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2520-17-0x0000000001CA0000-0x0000000001D15000-memory.dmp

Filesize
468KB

Download
memory/2520-321-0x0000000001CA0000-0x0000000001D15000-memory.dmp

Filesize
468KB

Download
memory/2520-162-0x0000000001CA0000-0x0000000001D15000-memory.dmp

Filesize
468KB

Download
memory/2520-66-0x0000000001CA0000-0x0000000001D15000-memory.dmp

Filesize
468KB

Download
memory/2520-160-0x0000000001CA0000-0x0000000001D15000-memory.dmp

Filesize
468KB

Download
memory/2520-32-0x0000000001CA0000-0x0000000001D15000-memory.dmp

Filesize
468KB

Download
memory/2580-43-0x0000000002570000-0x00000000025E5000-memory.dmp

Filesize
468KB

Download
memory/2580-426-0x0000000002570000-0x00000000025E5000-memory.dmp

Filesize
468KB

Download
memory/2580-231-0x0000000002570000-0x00000000025E5000-memory.dmp

Filesize
468KB

Download
memory/2580-230-0x0000000002570000-0x00000000025E5000-memory.dmp

Filesize
468KB

Download
memory/2612-252-0x0000000002590000-0x0000000002605000-memory.dmp

Filesize
468KB

Download
memory/2612-253-0x0000000002590000-0x0000000002605000-memory.dmp

Filesize
468KB

Download
memory/2612-125-0x0000000002590000-0x0000000002605000-memory.dmp

Filesize
468KB

Download
memory/2620-373-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2628-354-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2636-163-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2636-319-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2636-320-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2636-161-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2636-58-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2640-290-0x00000000038C0000-0x0000000003935000-memory.dmp

Filesize
468KB

Download
memory/2640-137-0x00000000038C0000-0x0000000003935000-memory.dmp

Filesize
468KB

Download
memory/2640-138-0x00000000038C0000-0x0000000003935000-memory.dmp

Filesize
468KB

Download
memory/2640-292-0x00000000038C0000-0x0000000003935000-memory.dmp

Filesize
468KB

Download
memory/2648-222-0x00000000025A0000-0x0000000002615000-memory.dmp

Filesize
468KB

Download
memory/2648-221-0x00000000025A0000-0x0000000002615000-memory.dmp

Filesize
468KB

Download
memory/2648-107-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2648-401-0x00000000025A0000-0x0000000002615000-memory.dmp

Filesize
468KB

Download
memory/2708-63-0x00000000026C0000-0x0000000002735000-memory.dmp

Filesize
468KB

Download
memory/2708-418-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2708-120-0x00000000026C0000-0x0000000002735000-memory.dmp

Filesize
468KB

Download
memory/2708-291-0x00000000026C0000-0x0000000002735000-memory.dmp

Filesize
468KB

Download
memory/2708-289-0x00000000026C0000-0x0000000002735000-memory.dmp

Filesize
468KB

Download
memory/2736-362-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2884-380-0x0000000002370000-0x00000000023E5000-memory.dmp

Filesize
468KB

Download
memory/2884-206-0x0000000002370000-0x00000000023E5000-memory.dmp

Filesize
468KB

Download
memory/2884-94-0x0000000002370000-0x00000000023E5000-memory.dmp

Filesize
468KB

Download
memory/2884-379-0x0000000002370000-0x00000000023E5000-memory.dmp

Filesize
468KB

Download
memory/2884-93-0x0000000002370000-0x00000000023E5000-memory.dmp

Filesize
468KB

Download
memory/2888-328-0x0000000002670000-0x00000000026E5000-memory.dmp

Filesize
468KB

Download
memory/2888-180-0x0000000002670000-0x00000000026E5000-memory.dmp

Filesize
468KB

Download
memory/2888-318-0x0000000002670000-0x00000000026E5000-memory.dmp

Filesize
468KB

Download
memory/2888-370-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2888-22-0x0000000002670000-0x00000000026E5000-memory.dmp

Filesize
468KB

Download
memory/2888-6-0x0000000002670000-0x00000000026E5000-memory.dmp

Filesize
468KB

Download
memory/2888-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2900-263-0x00000000029F0000-0x0000000002A65000-memory.dmp

Filesize
468KB

Download
memory/2900-140-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2900-264-0x00000000029F0000-0x0000000002A65000-memory.dmp

Filesize
468KB

Download
memory/3004-330-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download