773d84aeea3c5e0ef4f4115361ef7fdb7954bf8d305e574fbcf63ec0d6a72c0b

Analysis

max time kernel
114s
max time network
18s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
01/10/2024, 16:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

773d84aeea3c5e0ef4f4115361ef7fdb7954bf8d305e574fbcf63ec0d6a72c0bN.exe
Size

468KB
MD5

3ef4f0623a33643f3a093232933978d0
SHA1

bf1d50a257b381bfe462296b5dc847883632d918
SHA256

773d84aeea3c5e0ef4f4115361ef7fdb7954bf8d305e574fbcf63ec0d6a72c0b
SHA512

d673c805f330893cdd835d87f1cc1f59a075b1a2269e250e290f19c1b69a6b6932798337351aef8a82ec53bac06785dcb378800a4f82b2a62a0272aadcb57ef3
SSDEEP

3072:Sq8togwx2k8I2bY9PzSyrfU/Ek7jjrplPPHFaVHS1QZGg2lNPklz:SqeoOJI2+P+yrfSVX71QUrlNP

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2560	Unicorn-33141.exe
2292	Unicorn-46052.exe
2244	Unicorn-30270.exe
2848	Unicorn-34712.exe
2820	Unicorn-50494.exe
2948	Unicorn-58662.exe
2756	Unicorn-3523.exe
2456	Unicorn-10756.exe
1660	Unicorn-21154.exe
1428	Unicorn-24161.exe
768	Unicorn-52941.exe
2024	Unicorn-52941.exe
1500	Unicorn-33075.exe
1596	Unicorn-60844.exe
1828	Unicorn-45048.exe
2508	Unicorn-4975.exe
496	Unicorn-54731.exe
704	Unicorn-8794.exe
832	Unicorn-25588.exe
1884	Unicorn-19457.exe
1776	Unicorn-37133.exe
864	Unicorn-33564.exe
2324	Unicorn-24327.exe
2080	Unicorn-29925.exe
2168	Unicorn-49791.exe
2528	Unicorn-49791.exe
1668	Unicorn-34201.exe
1520	Unicorn-47937.exe
1880	Unicorn-36776.exe
2256	Unicorn-59459.exe
2712	Unicorn-47077.exe
2780	Unicorn-8997.exe
2744	Unicorn-29345.exe
2888	Unicorn-33694.exe
2668	Unicorn-33694.exe
2500	Unicorn-29610.exe
112	Unicorn-40968.exe
2592	Unicorn-43184.exe
2004	Unicorn-10512.exe
2372	Unicorn-59158.exe
1968	Unicorn-54882.exe
2028	Unicorn-15556.exe
2340	Unicorn-27808.exe
3008	Unicorn-60118.exe
2688	Unicorn-60118.exe
2060	Unicorn-3304.exe
2108	Unicorn-34851.exe
2088	Unicorn-51950.exe
1576	Unicorn-51109.exe
468	Unicorn-38053.exe
1524	Unicorn-45244.exe
568	Unicorn-11694.exe
2216	Unicorn-34907.exe
1612	Unicorn-62941.exe
2924	Unicorn-33391.exe
1432	Unicorn-20822.exe
784	Unicorn-14892.exe
1580	Unicorn-15447.exe
2828	Unicorn-6724.exe
2908	Unicorn-36967.exe
2284	Unicorn-2256.exe
2148	Unicorn-11576.exe
484	Unicorn-11576.exe
1152	Unicorn-27150.exe

Loads dropped DLL 64 IoCs

pid	Process
1936	773d84aeea3c5e0ef4f4115361ef7fdb7954bf8d305e574fbcf63ec0d6a72c0bN.exe
1936	773d84aeea3c5e0ef4f4115361ef7fdb7954bf8d305e574fbcf63ec0d6a72c0bN.exe
2560	Unicorn-33141.exe
2560	Unicorn-33141.exe
1936	773d84aeea3c5e0ef4f4115361ef7fdb7954bf8d305e574fbcf63ec0d6a72c0bN.exe
1936	773d84aeea3c5e0ef4f4115361ef7fdb7954bf8d305e574fbcf63ec0d6a72c0bN.exe
2560	Unicorn-33141.exe
2292	Unicorn-46052.exe
2560	Unicorn-33141.exe
2292	Unicorn-46052.exe
2244	Unicorn-30270.exe
2244	Unicorn-30270.exe
1936	773d84aeea3c5e0ef4f4115361ef7fdb7954bf8d305e574fbcf63ec0d6a72c0bN.exe
1936	773d84aeea3c5e0ef4f4115361ef7fdb7954bf8d305e574fbcf63ec0d6a72c0bN.exe
2848	Unicorn-34712.exe
2848	Unicorn-34712.exe
2560	Unicorn-33141.exe
2560	Unicorn-33141.exe
2820	Unicorn-50494.exe
2820	Unicorn-50494.exe
2948	Unicorn-58662.exe
2756	Unicorn-3523.exe
2948	Unicorn-58662.exe
2756	Unicorn-3523.exe
2244	Unicorn-30270.exe
2244	Unicorn-30270.exe
1936	773d84aeea3c5e0ef4f4115361ef7fdb7954bf8d305e574fbcf63ec0d6a72c0bN.exe
1936	773d84aeea3c5e0ef4f4115361ef7fdb7954bf8d305e574fbcf63ec0d6a72c0bN.exe
2456	Unicorn-10756.exe
2456	Unicorn-10756.exe
1660	Unicorn-21154.exe
1660	Unicorn-21154.exe
2848	Unicorn-34712.exe
2560	Unicorn-33141.exe
2848	Unicorn-34712.exe
2560	Unicorn-33141.exe
2292	Unicorn-46052.exe
1428	Unicorn-24161.exe
1428	Unicorn-24161.exe
2292	Unicorn-46052.exe
2820	Unicorn-50494.exe
2820	Unicorn-50494.exe
768	Unicorn-52941.exe
768	Unicorn-52941.exe
1596	Unicorn-60844.exe
1596	Unicorn-60844.exe
2948	Unicorn-58662.exe
2948	Unicorn-58662.exe
1500	Unicorn-33075.exe
1500	Unicorn-33075.exe
2024	Unicorn-52941.exe
2024	Unicorn-52941.exe
1936	773d84aeea3c5e0ef4f4115361ef7fdb7954bf8d305e574fbcf63ec0d6a72c0bN.exe
2756	Unicorn-3523.exe
2244	Unicorn-30270.exe
2756	Unicorn-3523.exe
2244	Unicorn-30270.exe
1936	773d84aeea3c5e0ef4f4115361ef7fdb7954bf8d305e574fbcf63ec0d6a72c0bN.exe
1828	Unicorn-45048.exe
1828	Unicorn-45048.exe
2456	Unicorn-10756.exe
2456	Unicorn-10756.exe
1884	Unicorn-19457.exe
1884	Unicorn-19457.exe

Program crash 6 IoCs

pid	pid_target	Process	procid_target
3180	3224	WerFault.exe	254
3252	3240	WerFault.exe	256
3156	3268	WerFault.exe	258
3316	3284	WerFault.exe	259
3140	3232	WerFault.exe	255
3148	3256	WerFault.exe	257

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34851.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45244.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4430.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6361.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11576.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56829.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63233.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6361.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63856.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3523.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5297.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58572.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35490.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26658.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2036.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56480.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52941.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63231.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20340.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35324.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35324.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36059.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40968.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24251.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25115.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3304.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-222.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63071.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39334.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8909.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17134.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43068.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47088.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5297.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27189.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41255.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53180.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35220.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25163.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59252.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52926.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43652.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17134.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43527.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-496.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26658.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35324.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62786.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45048.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15556.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48972.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10123.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35324.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49791.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8469.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-496.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-496.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41255.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52317.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41255.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49791.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51950.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20340.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1446.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
1936	773d84aeea3c5e0ef4f4115361ef7fdb7954bf8d305e574fbcf63ec0d6a72c0bN.exe
2560	Unicorn-33141.exe
2292	Unicorn-46052.exe
2244	Unicorn-30270.exe
2848	Unicorn-34712.exe
2820	Unicorn-50494.exe
2948	Unicorn-58662.exe
2756	Unicorn-3523.exe
2456	Unicorn-10756.exe
1660	Unicorn-21154.exe
1428	Unicorn-24161.exe
2024	Unicorn-52941.exe
768	Unicorn-52941.exe
1500	Unicorn-33075.exe
1596	Unicorn-60844.exe
1828	Unicorn-45048.exe
2508	Unicorn-4975.exe
496	Unicorn-54731.exe
1884	Unicorn-19457.exe
832	Unicorn-25588.exe
704	Unicorn-8794.exe
1776	Unicorn-37133.exe
864	Unicorn-33564.exe
2324	Unicorn-24327.exe
2080	Unicorn-29925.exe
2168	Unicorn-49791.exe
2528	Unicorn-49791.exe
1880	Unicorn-36776.exe
1668	Unicorn-34201.exe
1520	Unicorn-47937.exe
2256	Unicorn-59459.exe
2712	Unicorn-47077.exe
2780	Unicorn-8997.exe
2744	Unicorn-29345.exe
2888	Unicorn-33694.exe
2668	Unicorn-33694.exe
2500	Unicorn-29610.exe
112	Unicorn-40968.exe
2592	Unicorn-43184.exe
2372	Unicorn-59158.exe
2004	Unicorn-10512.exe
1968	Unicorn-54882.exe
2340	Unicorn-27808.exe
2028	Unicorn-15556.exe
2688	Unicorn-60118.exe
3008	Unicorn-60118.exe
2060	Unicorn-3304.exe
2108	Unicorn-34851.exe
2088	Unicorn-51950.exe
468	Unicorn-38053.exe
1576	Unicorn-51109.exe
1524	Unicorn-45244.exe
568	Unicorn-11694.exe
2924	Unicorn-33391.exe
1612	Unicorn-62941.exe
2216	Unicorn-34907.exe
1432	Unicorn-20822.exe
784	Unicorn-14892.exe
1580	Unicorn-15447.exe
2828	Unicorn-6724.exe
2908	Unicorn-36967.exe
2284	Unicorn-2256.exe
484	Unicorn-11576.exe
2148	Unicorn-11576.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1936 wrote to memory of 2560	1936	773d84aeea3c5e0ef4f4115361ef7fdb7954bf8d305e574fbcf63ec0d6a72c0bN.exe	30
PID 1936 wrote to memory of 2560	1936	773d84aeea3c5e0ef4f4115361ef7fdb7954bf8d305e574fbcf63ec0d6a72c0bN.exe	30
PID 1936 wrote to memory of 2560	1936	773d84aeea3c5e0ef4f4115361ef7fdb7954bf8d305e574fbcf63ec0d6a72c0bN.exe	30
PID 1936 wrote to memory of 2560	1936	773d84aeea3c5e0ef4f4115361ef7fdb7954bf8d305e574fbcf63ec0d6a72c0bN.exe	30
PID 2560 wrote to memory of 2292	2560	Unicorn-33141.exe	31
PID 2560 wrote to memory of 2292	2560	Unicorn-33141.exe	31
PID 2560 wrote to memory of 2292	2560	Unicorn-33141.exe	31
PID 2560 wrote to memory of 2292	2560	Unicorn-33141.exe	31
PID 1936 wrote to memory of 2244	1936	773d84aeea3c5e0ef4f4115361ef7fdb7954bf8d305e574fbcf63ec0d6a72c0bN.exe	32
PID 1936 wrote to memory of 2244	1936	773d84aeea3c5e0ef4f4115361ef7fdb7954bf8d305e574fbcf63ec0d6a72c0bN.exe	32
PID 1936 wrote to memory of 2244	1936	773d84aeea3c5e0ef4f4115361ef7fdb7954bf8d305e574fbcf63ec0d6a72c0bN.exe	32
PID 1936 wrote to memory of 2244	1936	773d84aeea3c5e0ef4f4115361ef7fdb7954bf8d305e574fbcf63ec0d6a72c0bN.exe	32
PID 2560 wrote to memory of 2848	2560	Unicorn-33141.exe	33
PID 2560 wrote to memory of 2848	2560	Unicorn-33141.exe	33
PID 2560 wrote to memory of 2848	2560	Unicorn-33141.exe	33
PID 2560 wrote to memory of 2848	2560	Unicorn-33141.exe	33
PID 2292 wrote to memory of 2820	2292	Unicorn-46052.exe	34
PID 2292 wrote to memory of 2820	2292	Unicorn-46052.exe	34
PID 2292 wrote to memory of 2820	2292	Unicorn-46052.exe	34
PID 2292 wrote to memory of 2820	2292	Unicorn-46052.exe	34
PID 2244 wrote to memory of 2948	2244	Unicorn-30270.exe	35
PID 2244 wrote to memory of 2948	2244	Unicorn-30270.exe	35
PID 2244 wrote to memory of 2948	2244	Unicorn-30270.exe	35
PID 2244 wrote to memory of 2948	2244	Unicorn-30270.exe	35
PID 1936 wrote to memory of 2756	1936	773d84aeea3c5e0ef4f4115361ef7fdb7954bf8d305e574fbcf63ec0d6a72c0bN.exe	36
PID 1936 wrote to memory of 2756	1936	773d84aeea3c5e0ef4f4115361ef7fdb7954bf8d305e574fbcf63ec0d6a72c0bN.exe	36
PID 1936 wrote to memory of 2756	1936	773d84aeea3c5e0ef4f4115361ef7fdb7954bf8d305e574fbcf63ec0d6a72c0bN.exe	36
PID 1936 wrote to memory of 2756	1936	773d84aeea3c5e0ef4f4115361ef7fdb7954bf8d305e574fbcf63ec0d6a72c0bN.exe	36
PID 2848 wrote to memory of 2456	2848	Unicorn-34712.exe	38
PID 2848 wrote to memory of 2456	2848	Unicorn-34712.exe	38
PID 2848 wrote to memory of 2456	2848	Unicorn-34712.exe	38
PID 2848 wrote to memory of 2456	2848	Unicorn-34712.exe	38
PID 2560 wrote to memory of 1660	2560	Unicorn-33141.exe	39
PID 2560 wrote to memory of 1660	2560	Unicorn-33141.exe	39
PID 2560 wrote to memory of 1660	2560	Unicorn-33141.exe	39
PID 2560 wrote to memory of 1660	2560	Unicorn-33141.exe	39
PID 2820 wrote to memory of 1428	2820	Unicorn-50494.exe	40
PID 2820 wrote to memory of 1428	2820	Unicorn-50494.exe	40
PID 2820 wrote to memory of 1428	2820	Unicorn-50494.exe	40
PID 2820 wrote to memory of 1428	2820	Unicorn-50494.exe	40
PID 2948 wrote to memory of 768	2948	Unicorn-58662.exe	41
PID 2948 wrote to memory of 768	2948	Unicorn-58662.exe	41
PID 2948 wrote to memory of 768	2948	Unicorn-58662.exe	41
PID 2948 wrote to memory of 768	2948	Unicorn-58662.exe	41
PID 2756 wrote to memory of 2024	2756	Unicorn-3523.exe	42
PID 2756 wrote to memory of 2024	2756	Unicorn-3523.exe	42
PID 2756 wrote to memory of 2024	2756	Unicorn-3523.exe	42
PID 2756 wrote to memory of 2024	2756	Unicorn-3523.exe	42
PID 2244 wrote to memory of 1500	2244	Unicorn-30270.exe	43
PID 2244 wrote to memory of 1500	2244	Unicorn-30270.exe	43
PID 2244 wrote to memory of 1500	2244	Unicorn-30270.exe	43
PID 2244 wrote to memory of 1500	2244	Unicorn-30270.exe	43
PID 1936 wrote to memory of 1596	1936	773d84aeea3c5e0ef4f4115361ef7fdb7954bf8d305e574fbcf63ec0d6a72c0bN.exe	44
PID 1936 wrote to memory of 1596	1936	773d84aeea3c5e0ef4f4115361ef7fdb7954bf8d305e574fbcf63ec0d6a72c0bN.exe	44
PID 1936 wrote to memory of 1596	1936	773d84aeea3c5e0ef4f4115361ef7fdb7954bf8d305e574fbcf63ec0d6a72c0bN.exe	44
PID 1936 wrote to memory of 1596	1936	773d84aeea3c5e0ef4f4115361ef7fdb7954bf8d305e574fbcf63ec0d6a72c0bN.exe	44
PID 2456 wrote to memory of 1828	2456	Unicorn-10756.exe	45
PID 2456 wrote to memory of 1828	2456	Unicorn-10756.exe	45
PID 2456 wrote to memory of 1828	2456	Unicorn-10756.exe	45
PID 2456 wrote to memory of 1828	2456	Unicorn-10756.exe	45
PID 1660 wrote to memory of 2508	1660	Unicorn-21154.exe	46
PID 1660 wrote to memory of 2508	1660	Unicorn-21154.exe	46
PID 1660 wrote to memory of 2508	1660	Unicorn-21154.exe	46
PID 1660 wrote to memory of 2508	1660	Unicorn-21154.exe	46

C:\Users\Admin\AppData\Local\Temp\773d84aeea3c5e0ef4f4115361ef7fdb7954bf8d305e574fbcf63ec0d6a72c0bN.exe
"C:\Users\Admin\AppData\Local\Temp\773d84aeea3c5e0ef4f4115361ef7fdb7954bf8d305e574fbcf63ec0d6a72c0bN.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1936
- C:\Users\Admin\AppData\Local\Temp\Unicorn-33141.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-33141.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2560
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46052.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46052.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50494.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50494.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24161.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:1428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25588.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33694.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24405.exe
        8⤵
        
        PID:2140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25163.exe
        9⤵
        
        PID:2860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20340.exe
        9⤵
        
        PID:3336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35324.exe
        9⤵
        
        PID:4840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18424.exe
        9⤵
        
        PID:5348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5297.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23298.exe
        8⤵
        
        PID:2672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7311.exe
        8⤵
        
        PID:4616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24746.exe
        8⤵
        
        PID:5688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45720.exe
        8⤵
        
        PID:6252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52287.exe
        7⤵
        
        PID:928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28427.exe
        8⤵
        
        PID:912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31505.exe
        9⤵
        
        PID:2420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32332.exe
        9⤵
        
        PID:5500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63769.exe
        9⤵
        
        PID:6612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5379.exe
        8⤵
        
        PID:3900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25407.exe
        8⤵
        
        PID:4856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52702.exe
        8⤵
        
        PID:6112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45720.exe
        8⤵
        
        PID:6276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22488.exe
        7⤵
        
        PID:2556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29621.exe
        8⤵
        
        PID:3704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61416.exe
        8⤵
        
        PID:2408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21371.exe
        8⤵
        
        PID:5604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12457.exe
        8⤵
        
        PID:6832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17134.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63233.exe
        7⤵
        
        PID:4012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10123.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60134.exe
        7⤵
        
        PID:5180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26372.exe
        7⤵
        
        PID:6580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43184.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60393.exe
        7⤵
        
        PID:1232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35220.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:1592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26445.exe
        8⤵
        
        PID:4440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47881.exe
        8⤵
        
        PID:5172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2625.exe
        8⤵
        
        PID:5392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51727.exe
        7⤵
        
        PID:2448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47611.exe
        7⤵
        
        PID:3948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7311.exe
        7⤵
        
        PID:4604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20662.exe
        7⤵
        
        PID:5624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45720.exe
        7⤵
        
        PID:6236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45986.exe
        6⤵
        
        PID:2044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14607.exe
        7⤵
        
        PID:2012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58572.exe
        7⤵
        
        PID:3240
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3240 -s 188
        8⤵
        Program crash
        
        PID:3252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5530.exe
        7⤵
        
        PID:4484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29328.exe
        7⤵
        
        PID:2132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59433.exe
        7⤵
        
        PID:6472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24898.exe
        6⤵
        
        PID:2920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3970.exe
        6⤵
        
        PID:3216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43371.exe
        6⤵
        
        PID:4424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31738.exe
        6⤵
        
        PID:5876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23393.exe
        6⤵
        
        PID:5424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42993.exe
        6⤵
        
        PID:6764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37133.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65115.exe
        6⤵
        
        PID:1560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25163.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20340.exe
        7⤵
        
        PID:3260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35324.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18424.exe
        7⤵
        
        PID:5920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17134.exe
        6⤵
        
        PID:3472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63233.exe
        6⤵
        
        PID:3188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10123.exe
        6⤵
        
        PID:4676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36590.exe
        6⤵
        
        PID:5924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39968.exe
        6⤵
        
        PID:6540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45244.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18562.exe
        6⤵
        
        PID:1772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16003.exe
        6⤵
        
        PID:4084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-294.exe
        6⤵
        
        PID:5116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39873.exe
        6⤵
        
        PID:5944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43289.exe
        6⤵
        
        PID:6556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53792.exe
        5⤵
        
        PID:2520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26938.exe
        5⤵
        
        PID:4060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5271.exe
        5⤵
        
        PID:5008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21192.exe
        5⤵
        
        PID:5640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19457.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19457.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:1884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8997.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11576.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25163.exe
        7⤵
        
        PID:1620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9563.exe
        7⤵
        
        PID:2740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1446.exe
        7⤵
        
        PID:4600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35789.exe
        7⤵
        
        PID:5976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55541.exe
        7⤵
        
        PID:6728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5297.exe
        6⤵
        
        PID:840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63856.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31345.exe
        6⤵
        
        PID:5160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13959.exe
        6⤵
        
        PID:6004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3387.exe
        5⤵
        
        PID:548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25163.exe
        6⤵
        
        PID:2632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20340.exe
        6⤵
        
        PID:3308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35324.exe
        6⤵
        
        PID:4404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18424.exe
        6⤵
        
        PID:5364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19032.exe
        5⤵
        
        PID:3040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29164.exe
        5⤵
        
        PID:3020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64183.exe
        5⤵
        
        PID:4556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14672.exe
        5⤵
        
        PID:5892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34390.exe
        5⤵
        
        PID:6512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29345.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29345.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2256.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28811.exe
        6⤵
        
        PID:2220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25163.exe
        7⤵
        
        PID:2072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58572.exe
        7⤵
        
        PID:3224
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3224 -s 188
        8⤵
        Program crash
        
        PID:3180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1446.exe
        7⤵
        
        PID:4576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52317.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47373.exe
        7⤵
        
        PID:6636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5297.exe
        6⤵
        
        PID:780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-206.exe
        6⤵
        
        PID:4876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12391.exe
        6⤵
        
        PID:4448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41255.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53678.exe
        5⤵
        
        PID:1092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23113.exe
        6⤵
        
        PID:2844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25515.exe
        6⤵
        
        PID:3276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5530.exe
        6⤵
        
        PID:4476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29328.exe
        6⤵
        
        PID:5756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62256.exe
        6⤵
        
        PID:5368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37258.exe
        5⤵
        
        PID:1136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53476.exe
        5⤵
        
        PID:3928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2730.exe
        5⤵
        
        PID:4452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4127.exe
        5⤵
        
        PID:5656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62786.exe
        5⤵
        
        PID:6268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27150.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27150.exe
      4⤵
      Executes dropped EXE
      PID:1152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59724.exe
        5⤵
        
        PID:3048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48846.exe
        5⤵
        
        PID:3452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35324.exe
        5⤵
        
        PID:5100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59604.exe
        5⤵
        
        PID:5468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44433.exe
        5⤵
        
        PID:6524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63231.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63231.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41257.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41257.exe
      4⤵
      PID:3796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47266.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47266.exe
      4⤵
      PID:4648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59863.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59863.exe
      4⤵
      PID:5668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40120.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40120.exe
      4⤵
      PID:6184
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34712.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34712.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10756.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10756.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45048.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59459.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14892.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3491.exe
        8⤵
        
        PID:2852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18111.exe
        9⤵
        
        PID:3808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15723.exe
        9⤵
        
        PID:4348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10760.exe
        9⤵
        
        PID:5952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63071.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-496.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35324.exe
        8⤵
        
        PID:4696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7279.exe
        8⤵
        
        PID:5660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44433.exe
        8⤵
        
        PID:6456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23531.exe
        7⤵
        
        PID:2684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7352.exe
        7⤵
        
        PID:3960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6814.exe
        7⤵
        
        PID:4864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2036.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4322.exe
        7⤵
        
        PID:6772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15447.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60668.exe
        7⤵
        
        PID:2360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25115.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63071.exe
        7⤵
        
        PID:3576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-496.exe
        7⤵
        
        PID:4176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35324.exe
        7⤵
        
        PID:4632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18424.exe
        7⤵
        
        PID:6096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38202.exe
        6⤵
        
        PID:2836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22434.exe
        7⤵
        
        PID:4372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36945.exe
        7⤵
        
        PID:5196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10760.exe
        7⤵
        
        PID:5448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17134.exe
        6⤵
        
        PID:3464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63233.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10123.exe
        6⤵
        
        PID:4812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36590.exe
        6⤵
        
        PID:5912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39968.exe
        6⤵
        
        PID:6564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47077.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6724.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42957.exe
        7⤵
        
        PID:1748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37492.exe
        7⤵
        
        PID:1456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53387.exe
        7⤵
        
        PID:5080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29328.exe
        7⤵
        
        PID:5584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62256.exe
        7⤵
        
        PID:6324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31451.exe
        6⤵
        
        PID:2804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51228.exe
        6⤵
        
        PID:3116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59252.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20662.exe
        6⤵
        
        PID:5556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45720.exe
        6⤵
        
        PID:6244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36967.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14944.exe
        6⤵
        
        PID:2020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16003.exe
        6⤵
        
        PID:4076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-294.exe
        6⤵
        
        PID:4248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44149.exe
        6⤵
        
        PID:5936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61545.exe
        6⤵
        
        PID:6984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43123.exe
        5⤵
        
        PID:2412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44811.exe
        5⤵
        
        PID:3896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47647.exe
        5⤵
        
        PID:4532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31738.exe
        5⤵
        
        PID:5884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21219.exe
        5⤵
        
        PID:6688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54731.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54731.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29610.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60201.exe
        6⤵
        
        PID:1688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28811.exe
        7⤵
        
        PID:2264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25163.exe
        8⤵
        
        PID:3080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58572.exe
        8⤵
        
        PID:3256
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3256 -s 188
        9⤵
        Program crash
        
        PID:3148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5530.exe
        8⤵
        
        PID:4500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29328.exe
        8⤵
        
        PID:5760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62256.exe
        8⤵
        
        PID:6340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5297.exe
        7⤵
        
        PID:2488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37296.exe
        8⤵
        
        PID:3944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48972.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19186.exe
        8⤵
        
        PID:5436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5384.exe
        8⤵
        
        PID:5820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63856.exe
        7⤵
        
        PID:4540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31345.exe
        7⤵
        
        PID:5152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52926.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39968.exe
        7⤵
        
        PID:6300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5053.exe
        6⤵
        
        PID:1944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11269.exe
        6⤵
        
        PID:3648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6361.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26658.exe
        6⤵
        
        PID:5108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34708.exe
        6⤵
        
        PID:5264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42750.exe
        6⤵
        
        PID:6672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28275.exe
        5⤵
        
        PID:1072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59532.exe
        6⤵
        
        PID:316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3044.exe
        6⤵
        
        PID:3980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35324.exe
        6⤵
        
        PID:4392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18424.exe
        6⤵
        
        PID:5376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33941.exe
        5⤵
        
        PID:3052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-244.exe
        5⤵
        
        PID:4024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10123.exe
        5⤵
        
        PID:3672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36590.exe
        5⤵
        
        PID:5876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39968.exe
        5⤵
        
        PID:6532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40968.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40968.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43564.exe
        5⤵
        
        PID:2152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63035.exe
        6⤵
        
        PID:3820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15723.exe
        6⤵
        
        PID:4364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35461.exe
        6⤵
        
        PID:5476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12457.exe
        6⤵
        
        PID:6856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4804.exe
        5⤵
        
        PID:3100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24258.exe
        5⤵
        
        PID:3680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11395.exe
        5⤵
        
        PID:4524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20662.exe
        5⤵
        
        PID:5568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45720.exe
        5⤵
        
        PID:6152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7502.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7502.exe
      4⤵
      PID:888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33736.exe
        5⤵
        
        PID:3664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52298.exe
        5⤵
        
        PID:4112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29458.exe
        5⤵
        
        PID:4820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44725.exe
        5⤵
        
        PID:5996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60969.exe
        5⤵
        
        PID:6408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8469.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8469.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46697.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46697.exe
      4⤵
      PID:4168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27189.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27189.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15059.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15059.exe
      4⤵
      PID:5388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34633.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34633.exe
      4⤵
      PID:6392
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21154.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21154.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4975.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4975.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33694.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11576.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25163.exe
        7⤵
        
        PID:2316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20340.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35324.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56480.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52794.exe
        7⤵
        
        PID:6896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5297.exe
        6⤵
        
        PID:1392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8909.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26658.exe
        6⤵
        
        PID:5052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19524.exe
        6⤵
        
        PID:5380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61499.exe
        6⤵
        
        PID:6088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29397.exe
        5⤵
        
        PID:2120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56980.exe
        5⤵
        
        PID:3988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46495.exe
        5⤵
        
        PID:4208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39195.exe
        5⤵
        
        PID:5848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48328.exe
        5⤵
        
        PID:6848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10512.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10512.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-222.exe
        5⤵
        
        PID:1808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57600.exe
        6⤵
        
        PID:5816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58394.exe
        6⤵
        
        PID:6808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63071.exe
        5⤵
        
        PID:3600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-496.exe
        5⤵
        
        PID:4200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35324.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28050.exe
        5⤵
        
        PID:5676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61499.exe
        5⤵
        
        PID:6380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26050.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26050.exe
      4⤵
      PID:944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31892.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31892.exe
      4⤵
      PID:3092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22336.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22336.exe
      4⤵
      PID:5016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65199.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65199.exe
      4⤵
      PID:5600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35920.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35920.exe
      4⤵
      PID:5340
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8794.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8794.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60118.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60118.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-222.exe
        5⤵
        
        PID:1508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25163.exe
        6⤵
        
        PID:2504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58572.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3268
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3268 -s 188
        7⤵
        Program crash
        
        PID:3156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5530.exe
        6⤵
        
        PID:4492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29328.exe
        6⤵
        
        PID:5780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59433.exe
        6⤵
        
        PID:6460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5297.exe
        5⤵
        
        PID:1504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6770.exe
        5⤵
        
        PID:3292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11395.exe
        5⤵
        
        PID:4516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20662.exe
        5⤵
        
        PID:5536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45720.exe
        5⤵
        
        PID:6260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45894.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45894.exe
      4⤵
      PID:1824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44466.exe
        5⤵
        
        PID:5128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11269.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11269.exe
      4⤵
      PID:3656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6361.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6361.exe
      4⤵
      PID:4232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26658.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26658.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59137.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59137.exe
      4⤵
      PID:7024
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34851.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34851.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21027.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21027.exe
      4⤵
      PID:2904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63071.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63071.exe
      4⤵
      PID:3544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-496.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-496.exe
      4⤵
      PID:4128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35324.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35324.exe
      4⤵
      PID:4888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55328.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55328.exe
      4⤵
      PID:4672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30837.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30837.exe
      4⤵
      PID:6592
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4196.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4196.exe
    3⤵
    PID:2916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25163.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25163.exe
      4⤵
      PID:2832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20340.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20340.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35324.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35324.exe
      4⤵
      PID:1324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18424.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18424.exe
      4⤵
      PID:5332
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16762.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16762.exe
    3⤵
    PID:1712
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48506.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48506.exe
    3⤵
    PID:3184
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37847.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37847.exe
    3⤵
    PID:4384
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25600.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25600.exe
    3⤵
    PID:5168
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9753.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9753.exe
    3⤵
    PID:6756
- C:\Users\Admin\AppData\Local\Temp\Unicorn-30270.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-30270.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2244
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58662.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58662.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52941.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52941.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33564.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54882.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55640.exe
        7⤵
        
        PID:2104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29791.exe
        7⤵
        
        PID:3776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1446.exe
        7⤵
        
        PID:4568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29328.exe
        7⤵
        
        PID:5564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62256.exe
        7⤵
        
        PID:6348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64747.exe
        6⤵
        
        PID:2764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54711.exe
        6⤵
        
        PID:3496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26658.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35490.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15556.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63377.exe
        6⤵
        
        PID:2204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9677.exe
        6⤵
        
        PID:3076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26658.exe
        6⤵
        
        PID:5092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43068.exe
        6⤵
        
        PID:1388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4322.exe
        6⤵
        
        PID:6780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8814.exe
        5⤵
        
        PID:2676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35604.exe
        5⤵
        
        PID:4092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13638.exe
        5⤵
        
        PID:4984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65388.exe
        5⤵
        
        PID:5452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62786.exe
        5⤵
        
        PID:6292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29925.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29925.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23698.exe
        5⤵
        
        PID:2540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18212.exe
        5⤵
        
        PID:1700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62718.exe
        6⤵
        
        PID:2980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9677.exe
        6⤵
        
        PID:2720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26658.exe
        6⤵
        
        PID:4912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35490.exe
        6⤵
        
        PID:5984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59329.exe
        5⤵
        
        PID:1948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26938.exe
        5⤵
        
        PID:4052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13631.exe
        5⤵
        
        PID:5032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36014.exe
        5⤵
        
        PID:5928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26372.exe
        5⤵
        
        PID:6616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11694.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11694.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47088.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52053.exe
        5⤵
        
        PID:3744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35324.exe
        5⤵
        
        PID:4920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18424.exe
        5⤵
        
        PID:1376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59267.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59267.exe
      4⤵
      PID:2604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44811.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44811.exe
      4⤵
      PID:3832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51732.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51732.exe
      4⤵
      PID:4636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21192.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21192.exe
      4⤵
      PID:5596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41255.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41255.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6372
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33075.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33075.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49791.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49791.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59158.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48416.exe
        6⤵
        
        PID:2884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61087.exe
        7⤵
        
        PID:5188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51082.exe
        7⤵
        
        PID:6104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63769.exe
        7⤵
        
        PID:6220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63071.exe
        6⤵
        
        PID:3608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-496.exe
        6⤵
        
        PID:4252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35324.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36059.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44433.exe
        6⤵
        
        PID:6576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33750.exe
        5⤵
        
        PID:3064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25672.exe
        6⤵
        
        PID:4932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41766.exe
        6⤵
        
        PID:6120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65056.exe
        6⤵
        
        PID:6304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11269.exe
        5⤵
        
        PID:3632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6361.exe
        5⤵
        
        PID:4216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26658.exe
        5⤵
        
        PID:4360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2625.exe
        5⤵
        
        PID:5420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27808.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27808.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-222.exe
        5⤵
        
        PID:604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20315.exe
        6⤵
        
        PID:6836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63071.exe
        5⤵
        
        PID:3560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-496.exe
        5⤵
        
        PID:4152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35324.exe
        5⤵
        
        PID:4688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36059.exe
        5⤵
        
        PID:5856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44433.exe
        5⤵
        
        PID:6416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10428.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10428.exe
      4⤵
      PID:600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42106.exe
        5⤵
        
        PID:1740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16003.exe
        5⤵
        
        PID:4068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53387.exe
        5⤵
        
        PID:5072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29328.exe
        5⤵
        
        PID:5652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62256.exe
        5⤵
        
        PID:6316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58369.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58369.exe
      4⤵
      PID:2932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26938.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26938.exe
      4⤵
      PID:4036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5271.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5271.exe
      4⤵
      PID:5024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21192.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21192.exe
      4⤵
      PID:5632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41255.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41255.exe
      4⤵
      PID:6228
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47937.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47937.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51950.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51950.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25495.exe
        5⤵
        
        PID:3056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63071.exe
        5⤵
        
        PID:3616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-496.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35324.exe
        5⤵
        
        PID:1724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18424.exe
        5⤵
        
        PID:5320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25748.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25748.exe
      4⤵
      PID:628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3931.exe
        5⤵
        
        PID:5280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58394.exe
        5⤵
        
        PID:6744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11244.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11244.exe
      4⤵
      PID:3912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16741.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16741.exe
      4⤵
      PID:4848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60863.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60863.exe
      4⤵
      PID:5140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62786.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62786.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6284
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51109.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51109.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3491.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3491.exe
      4⤵
      PID:2768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55874.exe
        5⤵
        
        PID:4324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36945.exe
        5⤵
        
        PID:5216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59280.exe
        5⤵
        
        PID:6084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12457.exe
        5⤵
        
        PID:6820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63071.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63071.exe
      4⤵
      PID:3584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-496.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-496.exe
      4⤵
      PID:4192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35324.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35324.exe
      4⤵
      PID:4996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41255.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41255.exe
      4⤵
      PID:6356
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56829.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56829.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55874.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55874.exe
      4⤵
      PID:4316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36945.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36945.exe
      4⤵
      PID:5208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43625.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43625.exe
      4⤵
      PID:5956
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57471.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57471.exe
    3⤵
    PID:3624
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63763.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63763.exe
    3⤵
    PID:4104
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5658.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5658.exe
    3⤵
    PID:4968
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30144.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30144.exe
    3⤵
    PID:5292
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47193.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47193.exe
    3⤵
    PID:6724
- C:\Users\Admin\AppData\Local\Temp\Unicorn-3523.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-3523.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2756
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52941.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52941.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49791.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49791.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60118.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43388.exe
        6⤵
        
        PID:2092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33875.exe
        6⤵
        
        PID:3968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1446.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56401.exe
        6⤵
        
        PID:6136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42220.exe
        6⤵
        
        PID:6664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53180.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43527.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7311.exe
        5⤵
        
        PID:4612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47736.exe
        5⤵
        
        PID:5224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30837.exe
        5⤵
        
        PID:6624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3304.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3304.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43564.exe
        5⤵
        
        PID:1952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25163.exe
        6⤵
        
        PID:576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58572.exe
        6⤵
        
        PID:3284
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3284 -s 188
        7⤵
        Program crash
        
        PID:3316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5530.exe
        6⤵
        
        PID:4468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29328.exe
        6⤵
        
        PID:936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59433.exe
        6⤵
        
        PID:6488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5297.exe
        5⤵
        
        PID:1796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26206.exe
        5⤵
        
        PID:3352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26658.exe
        5⤵
        
        PID:4432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41255.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41710.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41710.exe
      4⤵
      PID:2536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62251.exe
        5⤵
        
        PID:1956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9174.exe
        6⤵
        
        PID:3128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15723.exe
        6⤵
        
        PID:5060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53251.exe
        6⤵
        
        PID:6012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60969.exe
        6⤵
        
        PID:6548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63071.exe
        5⤵
        
        PID:3592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-496.exe
        5⤵
        
        PID:4184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35324.exe
        5⤵
        
        PID:4928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18424.exe
        5⤵
        
        PID:5404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58094.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58094.exe
      4⤵
      PID:2548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55955.exe
        5⤵
        
        PID:5352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50034.exe
        5⤵
        
        PID:6652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8469.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8469.exe
      4⤵
      PID:3520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46697.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46697.exe
      4⤵
      PID:4160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27189.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27189.exe
      4⤵
      PID:2596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35479.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35479.exe
      4⤵
      PID:5296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42993.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42993.exe
      4⤵
      PID:6748
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34201.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34201.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62941.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62941.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48800.exe
        5⤵
        
        PID:2336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18692.exe
        6⤵
        
        PID:2236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13834.exe
        7⤵
        
        PID:3956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15723.exe
        7⤵
        
        PID:4896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62256.exe
        7⤵
        
        PID:6332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58572.exe
        6⤵
        
        PID:3232
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3232 -s 188
        7⤵
        Program crash
        
        PID:3140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62707.exe
        6⤵
        
        PID:4368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21944.exe
        6⤵
        
        PID:6020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5297.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8909.exe
        5⤵
        
        PID:4032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26658.exe
        5⤵
        
        PID:4288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43068.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61499.exe
        5⤵
        
        PID:6148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4430.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4430.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14986.exe
        5⤵
        
        PID:3244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15723.exe
        5⤵
        
        PID:4644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38860.exe
        5⤵
        
        PID:5988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4097.exe
        5⤵
        
        PID:6632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11269.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11269.exe
      4⤵
      PID:3640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6361.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6361.exe
      4⤵
      PID:4120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26658.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26658.exe
      4⤵
      PID:4948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39944.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39944.exe
      4⤵
      PID:5312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4322.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4322.exe
      4⤵
      PID:6796
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20822.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20822.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1432
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2417.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2417.exe
      4⤵
      PID:2320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39334.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39334.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22992.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22992.exe
      4⤵
      PID:5252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4833.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4833.exe
      4⤵
      PID:5204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4322.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4322.exe
      4⤵
      PID:6788
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53792.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53792.exe
    3⤵
    PID:2156
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26938.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26938.exe
    3⤵
    PID:4044
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46495.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46495.exe
    3⤵
    PID:5064
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27654.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27654.exe
    3⤵
    PID:5860
- C:\Users\Admin\AppData\Local\Temp\Unicorn-60844.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-60844.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:1596
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24327.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24327.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38053.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38053.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9350.exe
        5⤵
        
        PID:2940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63071.exe
        5⤵
        
        PID:3568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-496.exe
        5⤵
        
        PID:4136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35324.exe
        5⤵
        
        PID:4956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43652.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42897.exe
        5⤵
        
        PID:6504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25748.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25748.exe
      4⤵
      PID:2648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11269.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11269.exe
      4⤵
      PID:3528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6361.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6361.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26658.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26658.exe
      4⤵
      PID:4312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43068.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43068.exe
      4⤵
      PID:5240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61499.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61499.exe
      4⤵
      PID:6436
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34907.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34907.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-222.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-222.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19263.exe
        5⤵
        
        PID:3360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15723.exe
        5⤵
        
        PID:3204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62404.exe
        5⤵
        
        PID:4884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56038.exe
        5⤵
        
        PID:6600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63071.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63071.exe
      4⤵
      PID:3500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-496.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-496.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35324.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35324.exe
      4⤵
      PID:5000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47742.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47742.exe
      4⤵
      PID:5828
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59629.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59629.exe
    3⤵
    PID:1644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4441.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4441.exe
      4⤵
      PID:3132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17430.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17430.exe
      4⤵
      PID:3828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5530.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5530.exe
      4⤵
      PID:4508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29328.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29328.exe
      4⤵
      PID:1676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59433.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59433.exe
      4⤵
      PID:6480
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17134.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17134.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3488
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63233.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63233.exe
    3⤵
    PID:3936
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10123.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10123.exe
    3⤵
    PID:4904
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57010.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57010.exe
    3⤵
    PID:6100
- C:\Users\Admin\AppData\Local\Temp\Unicorn-36776.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-36776.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1880
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23698.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23698.exe
    3⤵
    PID:844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25163.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25163.exe
      4⤵
      PID:2988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3044.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3044.exe
      4⤵
      PID:3996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35324.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35324.exe
      4⤵
      PID:5044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59604.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59604.exe
      4⤵
      PID:5260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44433.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44433.exe
      4⤵
      PID:6468
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19032.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19032.exe
    3⤵
    PID:2056
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12635.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12635.exe
    3⤵
    PID:3300
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2730.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2730.exe
    3⤵
    PID:4460
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4127.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4127.exe
    3⤵
    PID:5576
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62786.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62786.exe
    3⤵
    PID:6160
- C:\Users\Admin\AppData\Local\Temp\Unicorn-33391.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-33391.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2924
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59594.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59594.exe
    3⤵
    PID:2464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63071.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63071.exe
      4⤵
      PID:3552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-496.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-496.exe
      4⤵
      PID:4144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35324.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35324.exe
      4⤵
      PID:4684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36059.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36059.exe
      4⤵
      PID:5844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44433.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44433.exe
      4⤵
      PID:6428
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5297.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5297.exe
    3⤵
    PID:1764
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26206.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26206.exe
    3⤵
    PID:3024
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26658.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26658.exe
    3⤵
    PID:4664
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35490.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35490.exe
    3⤵
    PID:5832
- C:\Users\Admin\AppData\Local\Temp\Unicorn-46233.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-46233.exe
  2⤵
  PID:2956
- C:\Users\Admin\AppData\Local\Temp\Unicorn-27427.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-27427.exe
  2⤵
  PID:3108
- C:\Users\Admin\AppData\Local\Temp\Unicorn-24251.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-24251.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4292
- C:\Users\Admin\AppData\Local\Temp\Unicorn-64064.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-64064.exe
  2⤵
  PID:5612
- C:\Users\Admin\AppData\Local\Temp\Unicorn-12384.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-12384.exe
  2⤵
  PID:6196

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-10756.exe

Filesize
468KB

MD5
ecd1218a50ed391d47a57a56f9115793

SHA1
c3f422e71fe817aae12e76412f8995313a292be7

SHA256
399a9c496216d7f7f79c7688ddf9320a740e8e93e6942332065f46c7c6c15b88

SHA512
1b7890a09ddf6dac4a4d83a8242eb57f891e20cef6728624bbcaff1ca3bfd677c3de14f87fb9ca70ff4e9d6cd74899e40c4d107a1e1e8c34079ea29fa1c98db4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-21154.exe

Filesize
468KB

MD5
055c2950f10169d7f99960ba6d2af026

SHA1
83b21faeaabe0bd6aaf153425d3b6ba2140ab960

SHA256
18e2ab0858660d1cece585ef9563f51dd7ec2bebf0324da8bdb6f1e6f7fb79d6

SHA512
9473c8b7a6d139a98e37ea108f7b6e8abc7702d78cfa5b5dacacd43fb1874f546fffa4b456388c79eec7aa6efe65672acc488ab6a06c797777afa7961d6e1a3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-30270.exe

Filesize
468KB

MD5
0fdc57fea9e503eb9e9e1e317a9891c9

SHA1
cd4cf59f17a05e5707ae93f43868b75cadb95c50

SHA256
901a0adf7a7936a404fff686d840d4fa72e188a2992ec5b3c6f95ee2b94853e5

SHA512
7166511ecce78e1c819da01807be70febaf3046b2749ff3daac4af1ab57c7084ae5219c78d799dfb3d60447836515b7204c9b66fdcdbe544d38e7b81cfe92a3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-33075.exe

Filesize
468KB

MD5
b2b7a6926ca83d375addcdbcc045bd3d

SHA1
f6f82db002ae98e3914df44bcad79bc7f5aafa06

SHA256
46cfe685d7864dc87c728760e46a7c3a511b698ce8909370fcd0e6209e6e54a4

SHA512
a0e7e0a1b442d79355eb943fddae9a65e44941d58cd8ba8cee8287254e18667b231db14b848554fd347c444ef086246904bf0678a5dc51750875bb3edcc14069

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-35920.exe

Filesize
468KB

MD5
a6d92cacd832b7a1c7e813eb275db889

SHA1
7eeb8f3ec71e29545583f072c898bf0914b4cbf9

SHA256
905bd4c8414875d7d31386a1411092ff24dca2b0c6cd8457d1caaea9d52bf4e4

SHA512
dc676dd9ca4810ceaa6b46e6305bfb79de15d13166691c0ebaa557bb9d52d6cf6f91917d91bd2ad2fb54f77d3279de1c3e8eb1495110de7eb31c5f5e210e220b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-50494.exe

Filesize
468KB

MD5
db216440d0cdd5d6c02605a92a7e5c62

SHA1
73db5af87ee2489728f50d6f8846e028c8d929d5

SHA256
846d96d61b3f4defa34313d30a4e9cd4640a340fb071d7f0134ceaed2fc00293

SHA512
dccc18e1ecce60c5271573a9c58dcff3195dd87cd8cae273f7b5399955e3128bf500017e5b6be1ebbc72938464690fbbb441c06e69f85f472f6365b941b9ecaa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-52941.exe

Filesize
468KB

MD5
0ce97412689d0332a1a4b9cc43c6095c

SHA1
98130986d4e672255339037c9a040021f985a75a

SHA256
745452556d3b0a7a51adda773793b13a6c9240592154c9b547e50997d7572e9e

SHA512
40c8367f431c8d720fabacbba9dc6c7b4fdd858dd5026cf4ef8d924ac06927a17213e9a9fc4356f0d8e68538422aacc85317596579727e1a1943d1eefdb33daa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-60844.exe

Filesize
468KB

MD5
23b8a04bb38d481ef91b07a817757a28

SHA1
33fcd4af50f17eac520216229fa878954242aa7a

SHA256
732b505ef0fa6aa00a2f64ecc09f04d0f24c5c207dd9673176be5c52dedb0500

SHA512
804e94b076f0d15bc3b2a97a3077fb6154d81c109562169cb7987b7289b4298d493ecdb80bff79d37c98ac3eb069bf487f514251af2efd8d610f3e24ef1d3ecf

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-24161.exe

Filesize
468KB

MD5
9a6a4c5941da2f7a0026a8ca83d8868a

SHA1
2a93f974ee54074ce29c7e5fae2a308b8d4ac40f

SHA256
432af98eb19ff5611c69ca0812fb344a3c18dce3b58a5aeef86e021942cc1fec

SHA512
bb29e4b94d7757e008dc63f1d58a29c990a9b4f1ff9b4c97a5095ccc943c4219cb94b1d8c9408f70e8596272f5e54dd08c5d32fefb5cc4e673ee0e14688558ac

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-33141.exe

Filesize
468KB

MD5
a1808bbd677a87023f5044b20cc46609

SHA1
e2c2f30313b709cc65a7cba0c3a0ac536c8c8103

SHA256
7c4818e34cb03b0fd118e68f825d32b49099274efef09cd26d9312a9a27e77cc

SHA512
6ede0c28a6c2490ea1257816beb82f28369fd393111b025dff54a928ff6bba4ad1b1a5b1fb9ec06646f6803f52b57a3ed83d0e588b91b42a72d4b5606f198782

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-34712.exe

Filesize
468KB

MD5
e19a3683495d4916ab53595764933035

SHA1
7a99a4147c7008981c6bea3fd68c39919c4a5ea4

SHA256
2ffb83f4adf613c121adfff0b85dbf70af55528be333b92dfe71ab4c31b2f72d

SHA512
c9d55e673e430bf6dc28560fa4b32e5aec3573eb971c24cf0c518bd975f0c436f632adc6af516c3d5fed22a50901a6e05a085df6acf342d5a9618256c24e0c7b

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-3523.exe

Filesize
468KB

MD5
cceb045d848a4443f984bca6015370b6

SHA1
c3314f1d6de7a49764c5b09f6b59562da5086cf7

SHA256
69703aa375ab91bcf2c9da607f99a5d223d4623ee7284f0f6e71055352cacf86

SHA512
999cf16b4e77ab6276df111275f4d5b398f83afd5d70c084b9c9153a7fcfac9e1f6a47eb0162b535ca93eee41f3ff79557f103f6ff5c2426f0552ca8ecc27a38

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-45048.exe

Filesize
468KB

MD5
c762c7e386d7be5dd0acecef94f95a71

SHA1
73550d105414abee72621cb5cf9da91d747289da

SHA256
07bf7e0370b1ab8414d3440c751d9a0a8ec07bb2edc7f4b433d9fb2eeaa83291

SHA512
a5e52b78da555690901d1b71b5302cb8dd1fd38f2992f7c68b1e814eff669b51cb247fd2f754213041a2602cc87ef2d3aa78efa37cbac500424e4fa482b227b8

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-46052.exe

Filesize
468KB

MD5
4007339990a0f4e5f7f5961cf9a01349

SHA1
99cb39d0e66fa4ed1465be54e20fa0a1d3dff457

SHA256
e69458457f502d3b6974d246b1aafedc6afb72cf8fe0b036296109e5cbf2e4cb

SHA512
8f2ea1114effb0f93debe8e375b2bb8a4aa10272b41154ec65ca5457f46de3867f021bbbaaca23b66ed1a3698699157939d7049dd55ca439dffd96c1f88732b5

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-4975.exe

Filesize
468KB

MD5
45a4ed49a493b8eb4c653e535a8cf207

SHA1
73e4d9d7d0953146aab4c127a94bbc15aecd5177

SHA256
52239bb88565429fed81a0bbd8e04fbac44fdebdf4f5e7cb2b0b8db44b8e9e58

SHA512
82284827911b4c73977450364048006ce4b95ff53549f9de5fbe31dbe092bf056193c772a33be945c3944fc40e92aa0ac312537f348f904cea1a27368e901bbe

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-54731.exe

Filesize
468KB

MD5
8337844295859e86376f2fee0b9fa7a8

SHA1
b2ead9288788e278f7c0bc059f57497ca0150bd1

SHA256
b1ad80b50ebde52f5b1f23e7bd9c00a94bbc8c471aa111527746a3dad0bf5317

SHA512
1fbc15061e72f8bd49a2ea99760a422d1959074c05a7d0d885a3feb40e8a38d48ac8349e383d825aff570f2c2c9ef9b9cee79da8b64c1874a337db17f7a0e867

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-58662.exe

Filesize
468KB

MD5
4511dbace1e9c1394e67656119e454ef

SHA1
adbfdcaf8ee5285f11eee40a6ede149d9c1fafcb

SHA256
50bf7550931e8d48dbcc030e7c9d992f866851808ec65bd2baf5a7cf9285112a

SHA512
4c83f2ba358211216b9204b3d619a12772532b9b3c6f0a2f090663f3dbaecdd15bd24ff6b8adfc374cf6ab3d9681ad21a8f75abf5a8c1ab50d60fdabe9197dec

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-8794.exe

Filesize
468KB

MD5
50b14ee5e18a5f8d274bc03436bd952c

SHA1
ae1cdc7d655e0da32c3ef9d16569a655db1ddffc

SHA256
a44a2ef0ba0e5e37cd394aaef46d8a9fa4f509e69c91efe5bc3b0ac5a219caa2

SHA512
89cef4bffef5f79d641813d41e4819f10fe0aedb1cc14bb00c2427a885f45d38c56a8acd0f84ca03bd2ab6a6c4b17894db7eba15175aae901335a24ed133e59b

Download Submit
memory/112-392-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/496-377-0x0000000000580000-0x00000000005F5000-memory.dmp

Filesize
468KB

Download
memory/496-378-0x0000000000580000-0x00000000005F5000-memory.dmp

Filesize
468KB

Download
memory/496-212-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/704-214-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/768-252-0x0000000002670000-0x00000000026E5000-memory.dmp

Filesize
468KB

Download
memory/768-253-0x0000000002670000-0x00000000026E5000-memory.dmp

Filesize
468KB

Download
memory/768-151-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/832-367-0x00000000033A0000-0x0000000003415000-memory.dmp

Filesize
468KB

Download
memory/832-229-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/832-366-0x00000000033A0000-0x0000000003415000-memory.dmp

Filesize
468KB

Download
memory/864-256-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/864-423-0x0000000002710000-0x0000000002785000-memory.dmp

Filesize
468KB

Download
memory/1428-400-0x0000000001E80000-0x0000000001EF5000-memory.dmp

Filesize
468KB

Download
memory/1428-226-0x0000000001E80000-0x0000000001EF5000-memory.dmp

Filesize
468KB

Download
memory/1428-227-0x0000000001E80000-0x0000000001EF5000-memory.dmp

Filesize
468KB

Download
memory/1428-118-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1500-274-0x0000000002860000-0x00000000028D5000-memory.dmp

Filesize
468KB

Download
memory/1500-154-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1500-278-0x0000000002860000-0x00000000028D5000-memory.dmp

Filesize
468KB

Download
memory/1520-299-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1596-158-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1596-258-0x0000000001F60000-0x0000000001FD5000-memory.dmp

Filesize
468KB

Download
memory/1596-263-0x0000000001F60000-0x0000000001FD5000-memory.dmp

Filesize
468KB

Download
memory/1660-407-0x0000000001D30000-0x0000000001DA5000-memory.dmp

Filesize
468KB

Download
memory/1660-103-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1660-188-0x0000000001D30000-0x0000000001DA5000-memory.dmp

Filesize
468KB

Download
memory/1660-182-0x0000000001D30000-0x0000000001DA5000-memory.dmp

Filesize
468KB

Download
memory/1668-294-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1776-246-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1828-328-0x0000000002570000-0x00000000025E5000-memory.dmp

Filesize
468KB

Download
memory/1828-327-0x0000000002570000-0x00000000025E5000-memory.dmp

Filesize
468KB

Download
memory/1880-304-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1884-348-0x00000000025F0000-0x0000000002665000-memory.dmp

Filesize
468KB

Download
memory/1884-230-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1884-347-0x00000000025F0000-0x0000000002665000-memory.dmp

Filesize
468KB

Download
memory/1936-303-0x00000000025D0000-0x0000000002645000-memory.dmp

Filesize
468KB

Download
memory/1936-156-0x00000000025D0000-0x0000000002645000-memory.dmp

Filesize
468KB

Download
memory/1936-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1936-155-0x00000000025D0000-0x0000000002645000-memory.dmp

Filesize
468KB

Download
memory/1936-381-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1936-10-0x00000000025D0000-0x0000000002645000-memory.dmp

Filesize
468KB

Download
memory/2004-409-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2024-281-0x0000000001DF0000-0x0000000001E65000-memory.dmp

Filesize
468KB

Download
memory/2024-280-0x0000000001DF0000-0x0000000001E65000-memory.dmp

Filesize
468KB

Download
memory/2080-270-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2168-279-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2244-298-0x00000000024E0000-0x0000000002555000-memory.dmp

Filesize
468KB

Download
memory/2244-289-0x00000000024E0000-0x0000000002555000-memory.dmp

Filesize
468KB

Download
memory/2244-152-0x00000000024E0000-0x0000000002555000-memory.dmp

Filesize
468KB

Download
memory/2244-153-0x00000000024E0000-0x0000000002555000-memory.dmp

Filesize
468KB

Download
memory/2244-35-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2256-329-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2292-225-0x0000000002890000-0x0000000002905000-memory.dmp

Filesize
468KB

Download
memory/2292-363-0x0000000002890000-0x0000000002905000-memory.dmp

Filesize
468KB

Download
memory/2292-359-0x0000000002890000-0x0000000002905000-memory.dmp

Filesize
468KB

Download
memory/2292-228-0x0000000002690000-0x0000000002705000-memory.dmp

Filesize
468KB

Download
memory/2324-268-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2456-96-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2456-338-0x0000000002570000-0x00000000025E5000-memory.dmp

Filesize
468KB

Download
memory/2456-177-0x0000000002570000-0x00000000025E5000-memory.dmp

Filesize
468KB

Download
memory/2456-172-0x0000000002570000-0x00000000025E5000-memory.dmp

Filesize
468KB

Download
memory/2456-337-0x0000000002570000-0x00000000025E5000-memory.dmp

Filesize
468KB

Download
memory/2500-382-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2508-370-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2508-189-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2508-369-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2560-408-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2560-24-0x0000000002810000-0x0000000002885000-memory.dmp

Filesize
468KB

Download
memory/2560-213-0x0000000001E00000-0x0000000001E75000-memory.dmp

Filesize
468KB

Download
memory/2560-210-0x0000000002810000-0x0000000002885000-memory.dmp

Filesize
468KB

Download
memory/2560-12-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2592-401-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2668-380-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2712-341-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2744-365-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2756-288-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2756-79-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2756-134-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2756-293-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2780-349-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2820-67-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2820-245-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2820-244-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2848-390-0x0000000000630000-0x00000000006A5000-memory.dmp

Filesize
468KB

Download
memory/2848-88-0x0000000000630000-0x00000000006A5000-memory.dmp

Filesize
468KB

Download
memory/2848-66-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2848-391-0x0000000000630000-0x00000000006A5000-memory.dmp

Filesize
468KB

Download
memory/2848-211-0x0000000000630000-0x00000000006A5000-memory.dmp

Filesize
468KB

Download
memory/2848-209-0x0000000000630000-0x00000000006A5000-memory.dmp

Filesize
468KB

Download
memory/2888-371-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2948-273-0x0000000003240000-0x00000000032B5000-memory.dmp

Filesize
468KB

Download
memory/2948-269-0x0000000003240000-0x00000000032B5000-memory.dmp

Filesize
468KB

Download
memory/2948-133-0x0000000003240000-0x00000000032B5000-memory.dmp

Filesize
468KB

Download
memory/2948-132-0x0000000003440000-0x00000000034B5000-memory.dmp

Filesize
468KB

Download
memory/2948-75-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download