e7fe8d246ff55f22d6250ec1ec9554a59bc98d3350388a3621b51b3477c89379

Analysis

max time kernel
119s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
01/10/2024, 18:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e7fe8d246ff55f22d6250ec1ec9554a59bc98d3350388a3621b51b3477c89379N.exe
Size

468KB
MD5

d549684c1c5cf3dcf60081a891af5180
SHA1

4c53aa3382dee03da03eb148b8e403ba1d2b10ab
SHA256

e7fe8d246ff55f22d6250ec1ec9554a59bc98d3350388a3621b51b3477c89379
SHA512

e7bf1806fa1c3240722cb40f2e846f3dd632f89f767397fa914b77ba16cad024c46dff179de6cdf9d7fe98596899163ec50190036a2bf9a98c0e4fbd7994c0cd
SSDEEP

3072:WqoCogLdjkSU2bYkPz56ff5EChjWNpzOmHeMVUArj9NXfENMplB:WqNoonU23P16ffs7sqrjnvENM

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2748	Unicorn-33879.exe
2152	Unicorn-41637.exe
2928	Unicorn-17687.exe
2584	Unicorn-18615.exe
2568	Unicorn-32914.exe
3068	Unicorn-4880.exe
3020	Unicorn-20505.exe
2540	Unicorn-11782.exe
1632	Unicorn-7698.exe
676	Unicorn-22534.exe
276	Unicorn-36270.exe
2640	Unicorn-42400.exe
604	Unicorn-16561.exe
1732	Unicorn-57065.exe
2004	Unicorn-42767.exe
2404	Unicorn-58025.exe
1320	Unicorn-37029.exe
928	Unicorn-41859.exe
784	Unicorn-29053.exe
592	Unicorn-9187.exe
1712	Unicorn-29053.exe
1884	Unicorn-464.exe
2064	Unicorn-4548.exe
2428	Unicorn-4283.exe
1968	Unicorn-36650.exe
2452	Unicorn-63955.exe
2996	Unicorn-10207.exe
1684	Unicorn-15381.exe
2792	Unicorn-28594.exe
2704	Unicorn-12812.exe
2588	Unicorn-36954.exe
2820	Unicorn-36689.exe
1724	Unicorn-49185.exe
1384	Unicorn-28210.exe
2876	Unicorn-16704.exe
2240	Unicorn-62034.exe
644	Unicorn-44913.exe
1264	Unicorn-33638.exe
860	Unicorn-41537.exe
2348	Unicorn-50467.exe
2388	Unicorn-6511.exe
2864	Unicorn-12641.exe
2256	Unicorn-58827.exe
2224	Unicorn-43045.exe
272	Unicorn-14457.exe
2072	Unicorn-34323.exe
2400	Unicorn-34323.exe
1544	Unicorn-34321.exe
2508	Unicorn-63606.exe
2972	Unicorn-47535.exe
1588	Unicorn-47535.exe
1232	Unicorn-564.exe
816	Unicorn-40113.exe
1956	Unicorn-59979.exe
1008	Unicorn-2589.exe
1636	Unicorn-7270.exe
3056	Unicorn-24353.exe
2804	Unicorn-56663.exe
2328	Unicorn-60726.exe
3008	Unicorn-27499.exe
2888	Unicorn-48111.exe
2088	Unicorn-24161.exe
112	Unicorn-41210.exe
856	Unicorn-54416.exe

Loads dropped DLL 64 IoCs

pid	Process
1388	e7fe8d246ff55f22d6250ec1ec9554a59bc98d3350388a3621b51b3477c89379N.exe
1388	e7fe8d246ff55f22d6250ec1ec9554a59bc98d3350388a3621b51b3477c89379N.exe
1388	e7fe8d246ff55f22d6250ec1ec9554a59bc98d3350388a3621b51b3477c89379N.exe
2748	Unicorn-33879.exe
1388	e7fe8d246ff55f22d6250ec1ec9554a59bc98d3350388a3621b51b3477c89379N.exe
2748	Unicorn-33879.exe
1388	e7fe8d246ff55f22d6250ec1ec9554a59bc98d3350388a3621b51b3477c89379N.exe
2928	Unicorn-17687.exe
1388	e7fe8d246ff55f22d6250ec1ec9554a59bc98d3350388a3621b51b3477c89379N.exe
2748	Unicorn-33879.exe
2928	Unicorn-17687.exe
2748	Unicorn-33879.exe
2152	Unicorn-41637.exe
2152	Unicorn-41637.exe
2568	Unicorn-32914.exe
2568	Unicorn-32914.exe
3068	Unicorn-4880.exe
3068	Unicorn-4880.exe
2928	Unicorn-17687.exe
2928	Unicorn-17687.exe
2748	Unicorn-33879.exe
2748	Unicorn-33879.exe
2584	Unicorn-18615.exe
2584	Unicorn-18615.exe
1388	e7fe8d246ff55f22d6250ec1ec9554a59bc98d3350388a3621b51b3477c89379N.exe
1388	e7fe8d246ff55f22d6250ec1ec9554a59bc98d3350388a3621b51b3477c89379N.exe
3020	Unicorn-20505.exe
3020	Unicorn-20505.exe
2152	Unicorn-41637.exe
2152	Unicorn-41637.exe
1632	Unicorn-7698.exe
1632	Unicorn-7698.exe
2540	Unicorn-11782.exe
2540	Unicorn-11782.exe
3068	Unicorn-4880.exe
3068	Unicorn-4880.exe
2568	Unicorn-32914.exe
676	Unicorn-22534.exe
276	Unicorn-36270.exe
2568	Unicorn-32914.exe
676	Unicorn-22534.exe
276	Unicorn-36270.exe
2640	Unicorn-42400.exe
2640	Unicorn-42400.exe
2748	Unicorn-33879.exe
604	Unicorn-16561.exe
2928	Unicorn-17687.exe
2748	Unicorn-33879.exe
604	Unicorn-16561.exe
2928	Unicorn-17687.exe
1388	e7fe8d246ff55f22d6250ec1ec9554a59bc98d3350388a3621b51b3477c89379N.exe
1388	e7fe8d246ff55f22d6250ec1ec9554a59bc98d3350388a3621b51b3477c89379N.exe
2584	Unicorn-18615.exe
2584	Unicorn-18615.exe
1732	Unicorn-57065.exe
1732	Unicorn-57065.exe
2004	Unicorn-42767.exe
3020	Unicorn-20505.exe
2004	Unicorn-42767.exe
3020	Unicorn-20505.exe
2404	Unicorn-58025.exe
2404	Unicorn-58025.exe
2152	Unicorn-41637.exe
2152	Unicorn-41637.exe

Program crash 3 IoCs

pid	pid_target	Process	procid_target
2316	2284	WerFault.exe	117
3256	2664	WerFault.exe	135
3228	2984	WerFault.exe	147

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62833.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60524.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51464.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10160.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58897.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58897.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52791.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41883.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54813.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24743.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3594.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15998.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38826.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33611.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44385.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27514.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28670.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28147.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18328.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4108.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41637.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54235.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28147.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57643.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40530.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56097.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28795.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64666.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34323.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27499.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62387.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49185.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52791.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50720.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24743.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24213.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10508.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60326.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49995.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52040.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11782.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14457.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25657.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-768.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62813.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32303.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22320.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33628.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50759.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8211.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58047.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44913.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57788.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63290.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28795.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17944.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48656.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12279.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39055.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16876.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3309.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35334.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20505.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63518.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
1388	e7fe8d246ff55f22d6250ec1ec9554a59bc98d3350388a3621b51b3477c89379N.exe
2748	Unicorn-33879.exe
2928	Unicorn-17687.exe
2152	Unicorn-41637.exe
2568	Unicorn-32914.exe
3068	Unicorn-4880.exe
2584	Unicorn-18615.exe
3020	Unicorn-20505.exe
2540	Unicorn-11782.exe
1632	Unicorn-7698.exe
604	Unicorn-16561.exe
676	Unicorn-22534.exe
2640	Unicorn-42400.exe
276	Unicorn-36270.exe
1732	Unicorn-57065.exe
2004	Unicorn-42767.exe
2404	Unicorn-58025.exe
1320	Unicorn-37029.exe
928	Unicorn-41859.exe
592	Unicorn-9187.exe
1712	Unicorn-29053.exe
1884	Unicorn-464.exe
784	Unicorn-29053.exe
2064	Unicorn-4548.exe
2428	Unicorn-4283.exe
1968	Unicorn-36650.exe
2452	Unicorn-63955.exe
2996	Unicorn-10207.exe
1684	Unicorn-15381.exe
2792	Unicorn-28594.exe
2820	Unicorn-36689.exe
2588	Unicorn-36954.exe
1724	Unicorn-49185.exe
2704	Unicorn-12812.exe
1384	Unicorn-28210.exe
2876	Unicorn-16704.exe
2240	Unicorn-62034.exe
644	Unicorn-44913.exe
1264	Unicorn-33638.exe
860	Unicorn-41537.exe
2348	Unicorn-50467.exe
2388	Unicorn-6511.exe
272	Unicorn-14457.exe
2072	Unicorn-34323.exe
2224	Unicorn-43045.exe
2400	Unicorn-34323.exe
2256	Unicorn-58827.exe
2864	Unicorn-12641.exe
2508	Unicorn-63606.exe
1544	Unicorn-34321.exe
2972	Unicorn-47535.exe
1588	Unicorn-47535.exe
1232	Unicorn-564.exe
1956	Unicorn-59979.exe
816	Unicorn-40113.exe
1008	Unicorn-2589.exe
3056	Unicorn-24353.exe
2804	Unicorn-56663.exe
1636	Unicorn-7270.exe
2328	Unicorn-60726.exe
3008	Unicorn-27499.exe
2088	Unicorn-24161.exe
2888	Unicorn-48111.exe
112	Unicorn-41210.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1388 wrote to memory of 2748	1388	e7fe8d246ff55f22d6250ec1ec9554a59bc98d3350388a3621b51b3477c89379N.exe	31
PID 1388 wrote to memory of 2748	1388	e7fe8d246ff55f22d6250ec1ec9554a59bc98d3350388a3621b51b3477c89379N.exe	31
PID 1388 wrote to memory of 2748	1388	e7fe8d246ff55f22d6250ec1ec9554a59bc98d3350388a3621b51b3477c89379N.exe	31
PID 1388 wrote to memory of 2748	1388	e7fe8d246ff55f22d6250ec1ec9554a59bc98d3350388a3621b51b3477c89379N.exe	31
PID 1388 wrote to memory of 2928	1388	e7fe8d246ff55f22d6250ec1ec9554a59bc98d3350388a3621b51b3477c89379N.exe	33
PID 1388 wrote to memory of 2928	1388	e7fe8d246ff55f22d6250ec1ec9554a59bc98d3350388a3621b51b3477c89379N.exe	33
PID 1388 wrote to memory of 2928	1388	e7fe8d246ff55f22d6250ec1ec9554a59bc98d3350388a3621b51b3477c89379N.exe	33
PID 1388 wrote to memory of 2928	1388	e7fe8d246ff55f22d6250ec1ec9554a59bc98d3350388a3621b51b3477c89379N.exe	33
PID 2748 wrote to memory of 2152	2748	Unicorn-33879.exe	32
PID 2748 wrote to memory of 2152	2748	Unicorn-33879.exe	32
PID 2748 wrote to memory of 2152	2748	Unicorn-33879.exe	32
PID 2748 wrote to memory of 2152	2748	Unicorn-33879.exe	32
PID 1388 wrote to memory of 2584	1388	e7fe8d246ff55f22d6250ec1ec9554a59bc98d3350388a3621b51b3477c89379N.exe	34
PID 1388 wrote to memory of 2584	1388	e7fe8d246ff55f22d6250ec1ec9554a59bc98d3350388a3621b51b3477c89379N.exe	34
PID 1388 wrote to memory of 2584	1388	e7fe8d246ff55f22d6250ec1ec9554a59bc98d3350388a3621b51b3477c89379N.exe	34
PID 1388 wrote to memory of 2584	1388	e7fe8d246ff55f22d6250ec1ec9554a59bc98d3350388a3621b51b3477c89379N.exe	34
PID 2928 wrote to memory of 2568	2928	Unicorn-17687.exe	35
PID 2928 wrote to memory of 2568	2928	Unicorn-17687.exe	35
PID 2928 wrote to memory of 2568	2928	Unicorn-17687.exe	35
PID 2928 wrote to memory of 2568	2928	Unicorn-17687.exe	35
PID 2748 wrote to memory of 3068	2748	Unicorn-33879.exe	36
PID 2748 wrote to memory of 3068	2748	Unicorn-33879.exe	36
PID 2748 wrote to memory of 3068	2748	Unicorn-33879.exe	36
PID 2748 wrote to memory of 3068	2748	Unicorn-33879.exe	36
PID 2152 wrote to memory of 3020	2152	Unicorn-41637.exe	37
PID 2152 wrote to memory of 3020	2152	Unicorn-41637.exe	37
PID 2152 wrote to memory of 3020	2152	Unicorn-41637.exe	37
PID 2152 wrote to memory of 3020	2152	Unicorn-41637.exe	37
PID 2568 wrote to memory of 2540	2568	Unicorn-32914.exe	38
PID 2568 wrote to memory of 2540	2568	Unicorn-32914.exe	38
PID 2568 wrote to memory of 2540	2568	Unicorn-32914.exe	38
PID 2568 wrote to memory of 2540	2568	Unicorn-32914.exe	38
PID 3068 wrote to memory of 1632	3068	Unicorn-4880.exe	39
PID 3068 wrote to memory of 1632	3068	Unicorn-4880.exe	39
PID 3068 wrote to memory of 1632	3068	Unicorn-4880.exe	39
PID 3068 wrote to memory of 1632	3068	Unicorn-4880.exe	39
PID 2928 wrote to memory of 676	2928	Unicorn-17687.exe	40
PID 2928 wrote to memory of 676	2928	Unicorn-17687.exe	40
PID 2928 wrote to memory of 676	2928	Unicorn-17687.exe	40
PID 2928 wrote to memory of 676	2928	Unicorn-17687.exe	40
PID 2748 wrote to memory of 276	2748	Unicorn-33879.exe	41
PID 2748 wrote to memory of 276	2748	Unicorn-33879.exe	41
PID 2748 wrote to memory of 276	2748	Unicorn-33879.exe	41
PID 2748 wrote to memory of 276	2748	Unicorn-33879.exe	41
PID 2584 wrote to memory of 2640	2584	Unicorn-18615.exe	42
PID 2584 wrote to memory of 2640	2584	Unicorn-18615.exe	42
PID 2584 wrote to memory of 2640	2584	Unicorn-18615.exe	42
PID 2584 wrote to memory of 2640	2584	Unicorn-18615.exe	42
PID 1388 wrote to memory of 604	1388	e7fe8d246ff55f22d6250ec1ec9554a59bc98d3350388a3621b51b3477c89379N.exe	43
PID 1388 wrote to memory of 604	1388	e7fe8d246ff55f22d6250ec1ec9554a59bc98d3350388a3621b51b3477c89379N.exe	43
PID 1388 wrote to memory of 604	1388	e7fe8d246ff55f22d6250ec1ec9554a59bc98d3350388a3621b51b3477c89379N.exe	43
PID 1388 wrote to memory of 604	1388	e7fe8d246ff55f22d6250ec1ec9554a59bc98d3350388a3621b51b3477c89379N.exe	43
PID 3020 wrote to memory of 1732	3020	Unicorn-20505.exe	44
PID 3020 wrote to memory of 1732	3020	Unicorn-20505.exe	44
PID 3020 wrote to memory of 1732	3020	Unicorn-20505.exe	44
PID 3020 wrote to memory of 1732	3020	Unicorn-20505.exe	44
PID 2152 wrote to memory of 2004	2152	Unicorn-41637.exe	45
PID 2152 wrote to memory of 2004	2152	Unicorn-41637.exe	45
PID 2152 wrote to memory of 2004	2152	Unicorn-41637.exe	45
PID 2152 wrote to memory of 2004	2152	Unicorn-41637.exe	45
PID 1632 wrote to memory of 2404	1632	Unicorn-7698.exe	46
PID 1632 wrote to memory of 2404	1632	Unicorn-7698.exe	46
PID 1632 wrote to memory of 2404	1632	Unicorn-7698.exe	46
PID 1632 wrote to memory of 2404	1632	Unicorn-7698.exe	46

C:\Users\Admin\AppData\Local\Temp\e7fe8d246ff55f22d6250ec1ec9554a59bc98d3350388a3621b51b3477c89379N.exe
"C:\Users\Admin\AppData\Local\Temp\e7fe8d246ff55f22d6250ec1ec9554a59bc98d3350388a3621b51b3477c89379N.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1388
- C:\Users\Admin\AppData\Local\Temp\Unicorn-33879.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-33879.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2748
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41637.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41637.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20505.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20505.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57065.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:1732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15381.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7270.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48817.exe
        8⤵
        
        PID:556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21407.exe
        9⤵
        
        PID:3292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28147.exe
        9⤵
        
        PID:4332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62981.exe
        9⤵
        
        PID:5164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32879.exe
        9⤵
        
        PID:6068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51090.exe
        8⤵
        
        PID:3488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41883.exe
        8⤵
        
        PID:4160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64762.exe
        8⤵
        
        PID:5312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-216.exe
        8⤵
        
        PID:6556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59076.exe
        7⤵
        
        PID:2260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54235.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28147.exe
        8⤵
        
        PID:4484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54813.exe
        8⤵
        
        PID:5816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32303.exe
        8⤵
        
        PID:6340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4058.exe
        7⤵
        
        PID:3156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8211.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43645.exe
        7⤵
        
        PID:2460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24743.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24353.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23545.exe
        7⤵
        
        PID:2628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14909.exe
        8⤵
        
        PID:624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28147.exe
        8⤵
        
        PID:4468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58897.exe
        8⤵
        
        PID:5488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32303.exe
        8⤵
        
        PID:6332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44053.exe
        7⤵
        
        PID:376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15070.exe
        7⤵
        
        PID:5096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24154.exe
        7⤵
        
        PID:5892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21173.exe
        7⤵
        
        PID:6596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46195.exe
        6⤵
        
        PID:2700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58516.exe
        7⤵
        
        PID:1948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57643.exe
        7⤵
        
        PID:4496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3309.exe
        7⤵
        
        PID:5220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20129.exe
        7⤵
        
        PID:5876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14587.exe
        6⤵
        
        PID:2600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49991.exe
        6⤵
        
        PID:3452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39561.exe
        6⤵
        
        PID:5436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61288.exe
        6⤵
        
        PID:6528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12812.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36024.exe
        6⤵
        
        PID:1928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63918.exe
        7⤵
        
        PID:1664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28147.exe
        7⤵
        
        PID:4340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28437.exe
        7⤵
        
        PID:6140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4108.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41644.exe
        6⤵
        
        PID:2620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47748.exe
        6⤵
        
        PID:4216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64265.exe
        6⤵
        
        PID:2288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7678.exe
        6⤵
        
        PID:6104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54939.exe
        5⤵
        
        PID:2776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35330.exe
        6⤵
        
        PID:2752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28147.exe
        6⤵
        
        PID:4436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58897.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28795.exe
        6⤵
        
        PID:5740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63653.exe
        5⤵
        
        PID:2504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39083.exe
        5⤵
        
        PID:3340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35989.exe
        5⤵
        
        PID:6000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27655.exe
        5⤵
        
        PID:7072
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42767.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42767.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28594.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56663.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25657.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53887.exe
        8⤵
        
        PID:3136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28147.exe
        8⤵
        
        PID:4396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58897.exe
        8⤵
        
        PID:5392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28795.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34753.exe
        7⤵
        
        PID:3532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41883.exe
        7⤵
        
        PID:4108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64762.exe
        7⤵
        
        PID:5292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-216.exe
        7⤵
        
        PID:6572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59076.exe
        6⤵
        
        PID:1560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49419.exe
        7⤵
        
        PID:3348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28147.exe
        7⤵
        
        PID:4388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58897.exe
        7⤵
        
        PID:5480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56807.exe
        7⤵
        
        PID:6240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48489.exe
        6⤵
        
        PID:3544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47748.exe
        6⤵
        
        PID:4288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56097.exe
        6⤵
        
        PID:5504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31606.exe
        6⤵
        
        PID:6216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60726.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6684.exe
        6⤵
        
        PID:2200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43139.exe
        6⤵
        
        PID:3900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1528.exe
        6⤵
        
        PID:4280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32303.exe
        6⤵
        
        PID:6368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26210.exe
        5⤵
        
        PID:1612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62740.exe
        5⤵
        
        PID:3268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2812.exe
        5⤵
        
        PID:2016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7678.exe
        5⤵
        
        PID:6064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36689.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36689.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48111.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11920.exe
        6⤵
        
        PID:2396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43139.exe
        6⤵
        
        PID:3904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54813.exe
        6⤵
        
        PID:5808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32303.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28427.exe
        5⤵
        
        PID:1224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52791.exe
        5⤵
        
        PID:3724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3309.exe
        5⤵
        
        PID:5228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-216.exe
        5⤵
        
        PID:6564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41210.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41210.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14852.exe
        5⤵
        
        PID:2368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64488.exe
        5⤵
        
        PID:3088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3309.exe
        5⤵
        
        PID:3096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24213.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54924.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54924.exe
      4⤵
      PID:2840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50521.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50521.exe
      4⤵
      PID:3756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35096.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35096.exe
      4⤵
      PID:5384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59330.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59330.exe
      4⤵
      PID:4536
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4880.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4880.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7698.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7698.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58025.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:2404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36954.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27499.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10773.exe
        8⤵
        
        PID:3012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27514.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:2176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18328.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:4196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24664.exe
        9⤵
        
        PID:5288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35334.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:7080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52735.exe
        8⤵
        
        PID:1980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11011.exe
        8⤵
        
        PID:4912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3309.exe
        8⤵
        
        PID:5188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53519.exe
        8⤵
        
        PID:7164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25993.exe
        7⤵
        
        PID:1900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4323.exe
        8⤵
        
        PID:3304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58729.exe
        8⤵
        
        PID:4988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58897.exe
        8⤵
        
        PID:5568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28795.exe
        8⤵
        
        PID:5756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63730.exe
        7⤵
        
        PID:3236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16876.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60181.exe
        7⤵
        
        PID:1756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7678.exe
        7⤵
        
        PID:5640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24161.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-768.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63555.exe
        8⤵
        
        PID:3908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28147.exe
        8⤵
        
        PID:4452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1528.exe
        8⤵
        
        PID:4100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32303.exe
        8⤵
        
        PID:6424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34369.exe
        7⤵
        
        PID:3716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41883.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3309.exe
        7⤵
        
        PID:5172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24213.exe
        7⤵
        
        PID:6044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29531.exe
        6⤵
        
        PID:2724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38667.exe
        7⤵
        
        PID:4036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31655.exe
        7⤵
        
        PID:4568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58897.exe
        7⤵
        
        PID:5452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28795.exe
        7⤵
        
        PID:5720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63290.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39083.exe
        6⤵
        
        PID:4056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43645.exe
        6⤵
        
        PID:2056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24743.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49185.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12807.exe
        6⤵
        
        PID:1556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14852.exe
        7⤵
        
        PID:1464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39055.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28437.exe
        7⤵
        
        PID:6128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52040.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60524.exe
        6⤵
        
        PID:2892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56875.exe
        6⤵
        
        PID:3484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3309.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24213.exe
        6⤵
        
        PID:5364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35458.exe
        5⤵
        
        PID:2304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10508.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2664
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2664 -s 200
        6⤵
        Program crash
        
        PID:3256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22637.exe
        5⤵
        
        PID:4088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57213.exe
        5⤵
        
        PID:4852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60711.exe
        5⤵
        
        PID:2308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3213.exe
        5⤵
        
        PID:5160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41859.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41859.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62034.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54416.exe
        6⤵
        Executes dropped EXE
        
        PID:856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14852.exe
        7⤵
        
        PID:2884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39055.exe
        7⤵
        
        PID:3888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58897.exe
        7⤵
        
        PID:5552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56807.exe
        7⤵
        
        PID:6264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12095.exe
        6⤵
        
        PID:872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47748.exe
        6⤵
        
        PID:4236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60181.exe
        6⤵
        
        PID:5252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3594.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13362.exe
        5⤵
        
        PID:1120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37136.exe
        6⤵
        
        PID:1912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9739.exe
        7⤵
        
        PID:5644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45562.exe
        7⤵
        
        PID:6352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8438.exe
        6⤵
        
        PID:3812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58897.exe
        6⤵
        
        PID:5340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32303.exe
        6⤵
        
        PID:6376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36242.exe
        5⤵
        
        PID:3060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40291.exe
        5⤵
        
        PID:3564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23691.exe
        5⤵
        
        PID:5040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31606.exe
        5⤵
        
        PID:6188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44913.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44913.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41417.exe
        5⤵
        
        PID:1772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60218.exe
        6⤵
        
        PID:2956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28147.exe
        6⤵
        
        PID:4428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58897.exe
        6⤵
        
        PID:5584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28795.exe
        6⤵
        
        PID:6040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32536.exe
        5⤵
        
        PID:4020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51256.exe
        5⤵
        
        PID:4560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60181.exe
        5⤵
        
        PID:4268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7678.exe
        5⤵
        
        PID:5320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62833.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62833.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34391.exe
        5⤵
        
        PID:3684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28147.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58897.exe
        5⤵
        
        PID:5348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32303.exe
        5⤵
        
        PID:6400
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33628.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33628.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22547.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22547.exe
      4⤵
      PID:4180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56627.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56627.exe
      4⤵
      PID:5632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64666.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64666.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5624
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36270.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36270.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29053.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29053.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12641.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44157.exe
        6⤵
        
        PID:2180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50535.exe
        7⤵
        
        PID:3588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28147.exe
        7⤵
        
        PID:4348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62981.exe
        7⤵
        
        PID:5180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32879.exe
        7⤵
        
        PID:5132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44053.exe
        6⤵
        
        PID:1476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41883.exe
        6⤵
        
        PID:4168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64762.exe
        6⤵
        
        PID:5472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20129.exe
        6⤵
        
        PID:5732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33611.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49995.exe
        6⤵
        
        PID:3192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6927.exe
        6⤵
        
        PID:4980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64762.exe
        6⤵
        
        PID:5576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20129.exe
        6⤵
        
        PID:5736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14124.exe
        5⤵
        
        PID:1028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47748.exe
        5⤵
        
        PID:4200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64265.exe
        5⤵
        
        PID:4624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7678.exe
        5⤵
        
        PID:5204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43045.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43045.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26020.exe
        5⤵
        
        PID:1804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64821.exe
        6⤵
        
        PID:888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64712.exe
        6⤵
        
        PID:3444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58897.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56807.exe
        6⤵
        
        PID:6224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54276.exe
        5⤵
        
        PID:2760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41883.exe
        5⤵
        
        PID:4116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64762.exe
        5⤵
        
        PID:5272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-216.exe
        5⤵
        
        PID:6580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24897.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24897.exe
      4⤵
      PID:2680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36041.exe
        5⤵
        
        PID:2532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43139.exe
        5⤵
        
        PID:4032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1528.exe
        5⤵
        
        PID:4124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32303.exe
        5⤵
        
        PID:6324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60664.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60664.exe
      4⤵
      PID:2636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26638.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26638.exe
      4⤵
      PID:3372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43645.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43645.exe
      4⤵
      PID:1876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24743.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24743.exe
      4⤵
      PID:5468
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4283.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4283.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33638.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33638.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46824.exe
        5⤵
        
        PID:916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64053.exe
        6⤵
        
        PID:1748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39055.exe
        6⤵
        
        PID:3796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58897.exe
        6⤵
        
        PID:5536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28795.exe
        6⤵
        
        PID:6024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49616.exe
        5⤵
        
        PID:2848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52791.exe
        5⤵
        
        PID:3744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64762.exe
        5⤵
        
        PID:5328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6960.exe
        5⤵
        
        PID:6644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38826.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38826.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45496.exe
        5⤵
        
        PID:2672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51308.exe
        5⤵
        
        PID:3152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54813.exe
        5⤵
        
        PID:5772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61612.exe
        5⤵
        
        PID:5300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56824.exe
        5⤵
        
        PID:7012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55894.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55894.exe
      4⤵
      PID:2272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50759.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50759.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15550.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15550.exe
      4⤵
      PID:5748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12279.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12279.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6696
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41537.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41537.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12999.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12999.exe
      4⤵
      PID:704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22507.exe
        5⤵
        
        PID:1000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2261.exe
        6⤵
        
        PID:5692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18840.exe
        6⤵
        
        PID:7140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11183.exe
        5⤵
        
        PID:3700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9205.exe
        5⤵
        
        PID:5052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55115.exe
        5⤵
        
        PID:5932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63731.exe
        5⤵
        
        PID:6808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63518.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63518.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2984
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2984 -s 240
        5⤵
        Program crash
        
        PID:3228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43310.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43310.exe
      4⤵
      PID:3356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16876.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16876.exe
      4⤵
      PID:4872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28968.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28968.exe
      4⤵
      PID:6108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65180.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65180.exe
      4⤵
      PID:6552
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49947.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49947.exe
    3⤵
    PID:2376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28584.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28584.exe
      4⤵
      PID:1904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53559.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53559.exe
      4⤵
      PID:4528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58047.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58047.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10446.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10446.exe
      4⤵
      PID:6736
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28544.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28544.exe
    3⤵
    PID:1372
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10625.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10625.exe
    3⤵
    PID:3464
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62893.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62893.exe
    3⤵
    PID:5008
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5415.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5415.exe
    3⤵
    PID:6704
- C:\Users\Admin\AppData\Local\Temp\Unicorn-17687.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-17687.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2928
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32914.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32914.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11782.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11782.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37029.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28210.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36024.exe
        7⤵
        
        PID:2344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54235.exe
        8⤵
        
        PID:3728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28147.exe
        8⤵
        
        PID:4324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62981.exe
        8⤵
        
        PID:5152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56807.exe
        8⤵
        
        PID:6248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45091.exe
        7⤵
        
        PID:3420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4127.exe
        7⤵
        
        PID:5020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39561.exe
        7⤵
        
        PID:5520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20659.exe
        7⤵
        
        PID:6156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37119.exe
        6⤵
        
        PID:2596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43690.exe
        7⤵
        
        PID:3064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28147.exe
        7⤵
        
        PID:4372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54813.exe
        7⤵
        
        PID:5824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32303.exe
        7⤵
        
        PID:6408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43115.exe
        6⤵
        
        PID:3436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44647.exe
        6⤵
        
        PID:4648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2206.exe
        6⤵
        
        PID:6084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22320.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16704.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31028.exe
        6⤵
        
        PID:2920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24557.exe
        7⤵
        
        PID:2416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28147.exe
        7⤵
        
        PID:4412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58897.exe
        7⤵
        
        PID:5528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56807.exe
        7⤵
        
        PID:6280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40352.exe
        6⤵
        
        PID:1628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41883.exe
        6⤵
        
        PID:3792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35458.exe
        6⤵
        
        PID:5916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40288.exe
        6⤵
        
        PID:7004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50855.exe
        5⤵
        
        PID:2676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6741.exe
        6⤵
        
        PID:2448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28147.exe
        6⤵
        
        PID:4404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58897.exe
        6⤵
        
        PID:5544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56807.exe
        6⤵
        
        PID:6256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63653.exe
        5⤵
        
        PID:1848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39083.exe
        5⤵
        
        PID:4140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39561.exe
        5⤵
        
        PID:5428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20659.exe
        5⤵
        
        PID:1288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9187.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9187.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50467.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58692.exe
        6⤵
        
        PID:1688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39611.exe
        7⤵
        
        PID:2052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60379.exe
        7⤵
        
        PID:3188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26491.exe
        7⤵
        
        PID:4644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3351.exe
        7⤵
        
        PID:6676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58303.exe
        6⤵
        
        PID:2684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28670.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7393.exe
        6⤵
        
        PID:4104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15469.exe
        6⤵
        
        PID:6516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6154.exe
        5⤵
        
        PID:1936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60218.exe
        6⤵
        
        PID:1888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28147.exe
        6⤵
        
        PID:4476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54813.exe
        6⤵
        
        PID:5792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32303.exe
        6⤵
        
        PID:6360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38402.exe
        5⤵
        
        PID:4012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42591.exe
        5⤵
        
        PID:4588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39561.exe
        5⤵
        
        PID:5420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24167.exe
        5⤵
        
        PID:6536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6511.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6511.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1147.exe
        5⤵
        
        PID:1212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57643.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7393.exe
        5⤵
        
        PID:5036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24213.exe
        5⤵
        
        PID:5676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62527.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62527.exe
      4⤵
      PID:1448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31625.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31625.exe
      4⤵
      PID:3500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7156.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7156.exe
      4⤵
      PID:2528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20659.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20659.exe
      4⤵
      PID:5972
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22534.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22534.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29053.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29053.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47535.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33057.exe
        6⤵
        
        PID:2284
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2284 -s 200
        7⤵
        Program crash
        
        PID:2316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-389.exe
        6⤵
        
        PID:2076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41883.exe
        6⤵
        
        PID:4084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3309.exe
        6⤵
        
        PID:4128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24213.exe
        6⤵
        
        PID:6100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28951.exe
        5⤵
        
        PID:1860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48734.exe
        6⤵
        
        PID:3100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28147.exe
        6⤵
        
        PID:4420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58897.exe
        6⤵
        
        PID:5592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56807.exe
        6⤵
        
        PID:6200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18099.exe
        5⤵
        
        PID:3168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47748.exe
        5⤵
        
        PID:4224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60181.exe
        5⤵
        
        PID:5196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17281.exe
        5⤵
        
        PID:6500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40113.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40113.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10773.exe
        5⤵
        
        PID:2856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4323.exe
        6⤵
        
        PID:332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62813.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58897.exe
        6⤵
        
        PID:5356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32303.exe
        6⤵
        
        PID:6432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52735.exe
        5⤵
        
        PID:3076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11011.exe
        5⤵
        
        PID:4940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7393.exe
        5⤵
        
        PID:4316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23637.exe
        5⤵
        
        PID:6472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23968.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23968.exe
      4⤵
      PID:2168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51464.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12756.exe
        5⤵
        
        PID:4232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26437.exe
        5⤵
        
        PID:6460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4058.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4058.exe
      4⤵
      PID:3176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8211.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8211.exe
      4⤵
      PID:4924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7437.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7437.exe
      4⤵
      PID:6120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59844.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59844.exe
      4⤵
      PID:6608
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63955.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63955.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34323.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34323.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48277.exe
        5⤵
        
        PID:1524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17671.exe
        6⤵
        
        PID:3816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28147.exe
        6⤵
        
        PID:4380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62981.exe
        6⤵
        
        PID:5244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28795.exe
        6⤵
        
        PID:5764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31768.exe
        5⤵
        
        PID:3768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47748.exe
        5⤵
        
        PID:4272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56097.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31606.exe
        5⤵
        
        PID:6272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11354.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11354.exe
      4⤵
      PID:2560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63918.exe
        5⤵
        
        PID:2924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28147.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1528.exe
        5⤵
        
        PID:1468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32303.exe
        5⤵
        
        PID:6384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57788.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57788.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47748.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47748.exe
      4⤵
      PID:4260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64265.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64265.exe
      4⤵
      PID:4148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7102.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7102.exe
      4⤵
      PID:6452
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63606.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63606.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31905.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31905.exe
      4⤵
      PID:1752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2600.exe
        5⤵
        
        PID:536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39055.exe
        5⤵
        
        PID:3864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58897.exe
        5⤵
        
        PID:5608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28795.exe
        5⤵
        
        PID:6164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24919.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24919.exe
      4⤵
      PID:2660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52791.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52791.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3309.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3309.exe
      4⤵
      PID:5236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-216.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-216.exe
      4⤵
      PID:6532
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44547.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44547.exe
    3⤵
    PID:1324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29191.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29191.exe
      4⤵
      PID:3456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28147.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28147.exe
      4⤵
      PID:4460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1528.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1528.exe
      4⤵
      PID:4132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24135.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24135.exe
      4⤵
      PID:6508
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60326.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60326.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2012
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39613.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39613.exe
    3⤵
    PID:3412
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39180.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39180.exe
    3⤵
    PID:5208
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62839.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62839.exe
    3⤵
    PID:6492
- C:\Users\Admin\AppData\Local\Temp\Unicorn-18615.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-18615.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2584
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42400.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42400.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-464.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-464.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58827.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62387.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52045.exe
        7⤵
        
        PID:3836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61007.exe
        7⤵
        
        PID:5056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49250.exe
        7⤵
        
        PID:5984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10943.exe
        7⤵
        
        PID:6800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49995.exe
        6⤵
        
        PID:3220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11011.exe
        6⤵
        
        PID:4840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3309.exe
        6⤵
        
        PID:936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24213.exe
        6⤵
        
        PID:5400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2641.exe
        5⤵
        
        PID:268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19275.exe
        6⤵
        
        PID:4600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34596.exe
        6⤵
        
        PID:6632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24918.exe
        5⤵
        
        PID:3584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15070.exe
        5⤵
        
        PID:5076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20070.exe
        5⤵
        
        PID:5968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21173.exe
        5⤵
        
        PID:6616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14457.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14457.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13404.exe
        5⤵
        
        PID:1976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40317.exe
        6⤵
        
        PID:848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64712.exe
        6⤵
        
        PID:3576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58897.exe
        6⤵
        
        PID:5412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28795.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21603.exe
        5⤵
        
        PID:2872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15070.exe
        5⤵
        
        PID:5116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46450.exe
        5⤵
        
        PID:6008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51280.exe
        5⤵
        
        PID:6864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7274.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7274.exe
      4⤵
      PID:2148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28065.exe
        5⤵
        
        PID:1480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64712.exe
        5⤵
        
        PID:3572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44124.exe
        5⤵
        
        PID:6016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48656.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61816.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61816.exe
      4⤵
      PID:2948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39083.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39083.exe
      4⤵
      PID:4152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43645.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43645.exe
      4⤵
      PID:5264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20659.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20659.exe
      4⤵
      PID:5880
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10207.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10207.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47535.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47535.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33441.exe
        5⤵
        
        PID:1952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14852.exe
        6⤵
        
        PID:2556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39055.exe
        6⤵
        
        PID:3968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58897.exe
        6⤵
        
        PID:5368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16751.exe
        6⤵
        
        PID:6480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60524.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52791.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64762.exe
        5⤵
        
        PID:5600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48142.exe
        5⤵
        
        PID:6292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44385.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44385.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31598.exe
        5⤵
        
        PID:3084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10160.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61612.exe
        5⤵
        
        PID:5464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56824.exe
        5⤵
        
        PID:7024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7456.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7456.exe
      4⤵
      PID:3844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47748.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47748.exe
      4⤵
      PID:3784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18923.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18923.exe
      4⤵
      PID:5924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57354.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57354.exe
      4⤵
      PID:7032
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-564.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-564.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35527.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35527.exe
      4⤵
      PID:1504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31598.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31598.exe
      4⤵
      PID:4048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10160.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10160.exe
      4⤵
      PID:2424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28437.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28437.exe
      4⤵
      PID:6092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4108.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4108.exe
      4⤵
      PID:6356
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12366.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12366.exe
    3⤵
    PID:2580
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62243.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62243.exe
    3⤵
    PID:3148
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35477.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35477.exe
    3⤵
    PID:5664
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12279.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12279.exe
    3⤵
    PID:6700
- C:\Users\Admin\AppData\Local\Temp\Unicorn-16561.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-16561.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:604
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4548.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4548.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59979.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59979.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10233.exe
        5⤵
        
        PID:1164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4323.exe
        6⤵
        
        PID:3300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40530.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15998.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32120.exe
        6⤵
        
        PID:7088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63730.exe
        5⤵
        
        PID:3200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16876.exe
        5⤵
        
        PID:4904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56097.exe
        5⤵
        
        PID:5376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3594.exe
        5⤵
        
        PID:316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25635.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25635.exe
      4⤵
      PID:1004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35522.exe
        5⤵
        
        PID:1992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28147.exe
        5⤵
        
        PID:4364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54813.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32303.exe
        5⤵
        
        PID:6416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55733.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55733.exe
      4⤵
      PID:3424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47748.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47748.exe
      4⤵
      PID:4208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60181.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60181.exe
      4⤵
      PID:4640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7678.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7678.exe
      4⤵
      PID:5928
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2589.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2589.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61640.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61640.exe
      4⤵
      PID:1068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20690.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20690.exe
      4⤵
      PID:3704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26491.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26491.exe
      4⤵
      PID:5012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32879.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32879.exe
      4⤵
      PID:5648
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60554.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60554.exe
    3⤵
    PID:1960
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55407.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55407.exe
    3⤵
    PID:5084
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46980.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46980.exe
    3⤵
    PID:5948
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46814.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46814.exe
    3⤵
    PID:6772
- C:\Users\Admin\AppData\Local\Temp\Unicorn-36650.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-36650.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1968
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34323.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34323.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2400
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51287.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51287.exe
      4⤵
      PID:2992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50720.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36459.exe
        5⤵
        
        PID:6964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56684.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56684.exe
      4⤵
      PID:3712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9205.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9205.exe
      4⤵
      PID:5092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40690.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40690.exe
      4⤵
      PID:6032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24.exe
      4⤵
      PID:6652
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43097.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43097.exe
    3⤵
    PID:1428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-239.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-239.exe
      4⤵
      PID:3328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62813.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62813.exe
      4⤵
      PID:4884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58897.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58897.exe
      4⤵
      PID:5304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56807.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56807.exe
      4⤵
      PID:6232
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45915.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45915.exe
    3⤵
    PID:3800
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15070.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15070.exe
    3⤵
    PID:5108
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46450.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46450.exe
    3⤵
    PID:5960
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47195.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47195.exe
    3⤵
    PID:6816
- C:\Users\Admin\AppData\Local\Temp\Unicorn-34321.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-34321.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1544
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-934.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-934.exe
    3⤵
    PID:576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52045.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52045.exe
      4⤵
      PID:3856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61007.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61007.exe
      4⤵
      PID:5068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49250.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49250.exe
      4⤵
      PID:5992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6859.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6859.exe
      4⤵
      PID:6852
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49995.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49995.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3212
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11011.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11011.exe
    3⤵
    PID:4932
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60678.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60678.exe
    3⤵
    PID:5656
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16744.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16744.exe
    3⤵
    PID:6684
- C:\Users\Admin\AppData\Local\Temp\Unicorn-38611.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-38611.exe
  2⤵
  PID:2408
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37181.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37181.exe
    3⤵
    PID:5128
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37720.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37720.exe
    3⤵
    PID:7156
- C:\Users\Admin\AppData\Local\Temp\Unicorn-28938.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-28938.exe
  2⤵
  PID:3472
- C:\Users\Admin\AppData\Local\Temp\Unicorn-45606.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-45606.exe
  2⤵
  PID:5044
- C:\Users\Admin\AppData\Local\Temp\Unicorn-24314.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-24314.exe
  2⤵
  PID:5940
- C:\Users\Admin\AppData\Local\Temp\Unicorn-17944.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-17944.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6792

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-11782.exe

Filesize
468KB

MD5
e2296170ec9e6ebde44a6d185ad7554b

SHA1
84365766c3d1a009986c63f1b2e0d151d3870081

SHA256
78d9c4dc567bfb6027f11ed95f976c9e79b8c5cfdceb4676f436e9449bd2de7c

SHA512
6f4d4f7bdeb7fbcdf3301250f9995d173ce3e12d6a00cc7aec1967946d92ca1586af26a51ca0197adfbb68632df0312213b45aacfe44155728168055d3e8745d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-12095.exe

Filesize
468KB

MD5
74157dfa53ab74bce032732087d9751b

SHA1
a4f88e2522a7fd371ac0e1bb17c653922b4ee495

SHA256
bbda5b436ca39cf0315d86db6a8f4174597ee96f21f1d61c95b1db0da65b8a7f

SHA512
c7f40f1148d2f9b739bff1dd0b49dba475034d61ad569bcf03719b8bb047f44a488c8f0cece79bc322ac37364e571ba32b7ebf40be261d54fd50656b55573238

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-16561.exe

Filesize
468KB

MD5
a270c85e47ae245a7620a3a5cd9f9395

SHA1
5b1b4ac8ecaa2b5dec341cd0512b703cde79beeb

SHA256
bd27c838f6af9faf9579a8a9eaee440edd517e4ff67c0b80b5ac47c5c58bf55f

SHA512
a1f84b48d70c4afa6b97d02d8320cb6d320efe37105ee448c20604e26f7cadaa0f6efa73c22096fc87be59d5e8d2629651f8fcd70a4ddc716dc3d2ad400fb99d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-22534.exe

Filesize
468KB

MD5
1c3ef867f0315fd4754081146b5430c2

SHA1
e2d43291c434dbc39e204f158b9e1d3b8d3c8767

SHA256
4c2484458008dccc36ded5d4d508627d79e2c5264c69428b0d1b0982d211e6bf

SHA512
2a6dc47debf5a58544565246a22da685a98b416c91823d97216cea817fa7977c7069e3bbe4870383ba3545bee91d135c37c4d48e88ff5476724a1eb19359b5af

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-32914.exe

Filesize
468KB

MD5
e9d705147eea33b5ee3d7da0b48abe02

SHA1
7ca29b3a75f71c55dfe97e640e55844538bec6f5

SHA256
f73166ad7ac9fdbba05021d217fc73fd26af4b267788190c1b8a794878435994

SHA512
db2960a253f8b21e1945530490f0d5c97e55daece3174d74964f7752c8963a66c93336d3e52e5f9bbb9b4be5da0cdf80362c71c300c0a14ad653088abf297f2f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-36270.exe

Filesize
468KB

MD5
8d169a3464a0e4f727f25dd251092c5c

SHA1
382fe787406a8fc292f087d4650cbeaccb60aa94

SHA256
97b2eefb98cfb153a80b412b7c060958e9eb21c202b41ba7ef1c15344b301357

SHA512
03f880627672308cde4863a1699d067bb091812d08c6325e6dca6189150c081c56caf3ef6d67577e9860fe61b5c60330a4f7b877f92f388cbc3f01c3b1887318

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-40113.exe

Filesize
468KB

MD5
cebe9be1eb35c80775c8122d5f12f8ba

SHA1
8f7ba545bab75013207ff639d4876e8499892e4a

SHA256
0c9b0cd5e7d66c67a7ee13690d9d7a90ee6cfce18c2fe896dbfb54d6dfb29089

SHA512
5872baab50c8c75f081b995d208826dcf59f72b40e08420e9b5b8f046212bbf7b0e0a2bd7ac428dffe410880a1cf961fb802b16878e2594781ca40257ee78668

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-41637.exe

Filesize
468KB

MD5
1dc3f4d6f77bbdf6ffbb3bfe42fe840d

SHA1
b9bb30ff09229259a8dbc83bccea40cd9f27ee24

SHA256
9c4ad7c59638dbf9dfafa7abc17de8def89db015c4865dbf7f5bdc0ece126e31

SHA512
1994ed9ff0a4b75c3e71f15e63b9fa9da0fc8db8ffcc6d420353d0ac89227d01227c86a80b2139b6b19ac95223f598d07e6cb5f1179a20f479e7a111a397a338

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-41859.exe

Filesize
468KB

MD5
73d1b0ddeeaec5b396084467cdb0ce92

SHA1
7143f021fbd3e57cef4a8e3ae0cf10767f63cc34

SHA256
459115a426d0573d67718c113fc00b2a547a95404969b5175c424182a2036b58

SHA512
49db9e19ebf00e43b627082f4b5c95f84286eb43900bf8bb538cbca1cc7b59ee56709981df66d499340f07989f9ab711bfd9ad237cedd2da32e396a5dc0a794a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-42400.exe

Filesize
468KB

MD5
ed9c40538984fa041169a202efbfb132

SHA1
a5c8c3614616afa643fb9edfa2ef86b07a3ff490

SHA256
35daae16f60d6cfeb3b3a6e81c3d568f9bff10674c87faa7bf5c40d15f433231

SHA512
7aa3ce97a227768b6c84c85bdb84e6c6dad006a3b90bcefd71fd9d13d5bb6f280e6106ba637e5ed92d8a2eae0f9169a517f950c71bf472d28068ef5bac39c656

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-42767.exe

Filesize
468KB

MD5
45d08d75ed7affe126ecda8a9d287ce4

SHA1
26358294e193bb6dec1e12490943ef0c346a08bb

SHA256
5ce12a3186591cfd641fcd16ddc71f03cd99eefc38821147913ea824e83dbaf4

SHA512
9a3dce2310e23834d89894013ca0b710c4bc565dcdb6c23a763e61b39d258921b6e00eae8916de4c76bf2ce8a0f64410a75c5879f74770ca6961dee02b6f9a26

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-4880.exe

Filesize
468KB

MD5
0f3a7dd4ff93be784e2127c9e3b56c2b

SHA1
354af03a37c08329808257ab2285fa7fec5baeeb

SHA256
9d991c7b7ce5ea035e358973651ba6d016483af5f42a3a07e87b3bf7c77e909c

SHA512
9895514698562f5dc8311a656bee3af53537de9c5c6cb840f9c0cabb2d0f258a55d64dc61c6b7d75d78401ccdf1862ca8d5642640e37c8742f9216810554ae8f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-58025.exe

Filesize
468KB

MD5
7871d11a6ee5083e7d765f35021cd872

SHA1
bb9a9de83f629925d1e9e7c426d82a13d49d58b2

SHA256
095f0173a0eacc2b5904901eaa81de8e7e220dc3f0e49a307a9ce184638d8214

SHA512
cafbe5cc7337b704e0bd4ae886790d73e630521011cb5d89ee07921212a5da3f8a5fb5e0c0a1a0066938c69d66bbdaf797adb795b52a73260221b149066c92a1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-7698.exe

Filesize
468KB

MD5
0ee99ff95c26f555120ba51f65a2c5f2

SHA1
1633e74e0980b4721b3ec9ce1aa2045f5c97a414

SHA256
7b2c1a68942abffd635b24b4ffb749646ae03fcda5eefe917005fde5efc30ccc

SHA512
cd5a21687973049d06a94e8438d351fc18e7c86473ae63c836ac7835210864fa014d43712ae1295211ece7859cc43f73e3769ea8c94f03df5fbe24e01c64d473

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-9739.exe

Filesize
468KB

MD5
92a3c52b0f567682dbd2f38da385c78d

SHA1
3ea257fde3b015baf69514ef881c0b38e86d91dd

SHA256
998a6c0bc68cc53fca6d7018c6eaf2f967de136100e0fbcdb963bc70deb41619

SHA512
577652a2175e4b3062bc0814f5952ff9ad937b1d1178d8d5bda58fd5a0f3b43ca7d3cd99eb985388aaf804baf72038a08cb47caf49fa24de0d44c8570690eee2

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-17687.exe

Filesize
468KB

MD5
4d28f1eab314d11e722b5be40db35a61

SHA1
33d30703ddd518dd120fbc95849c2d4a09d2ef6b

SHA256
7cb31ade601e972e10a86c6ae12e09d5813c116557b3cebab65fc05f20ca683b

SHA512
ee213c8b1092f09d0f6a78352eea531183fb5f65f055a54824aa761b04d9c738d31644bad5ea5c21219ddc4e0c4a28f0530141a4d47ecb156cd74557b97f074f

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-18615.exe

Filesize
468KB

MD5
03017faa4f58c00565a972ca1717908a

SHA1
308fb484d636d209699279483dff639ff1774387

SHA256
a2f2eeda2ad69521ec68771ad95f2f37462496fb1f78a275ffec5c16b4319d7b

SHA512
14ed8f35be88f1d0e52d698812a1ed8295afae85595becb3ff39067cbe0a8df37e548b65eb4be4f8188f715f4da07a226af7bc8ee03c14dd19a5a1a8021a829e

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-20505.exe

Filesize
468KB

MD5
a8be8887c0e6027eea1c232513e25109

SHA1
5480988ba2e6fcbc27248c78cba2435ca055f381

SHA256
ac44b6f6261d7473a29ad5c8bf23f1df6822c932548f8b34c32e56fda22973f6

SHA512
0c946e87ab324245aae247267f4f3aa5594359f2f44e685923b93cf67b3f8cc2e17e9838d0f94ecf0ca867c431edced505d795d3cc6accbea03a71921163a951

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-33879.exe

Filesize
468KB

MD5
fe2d689effc63d7976eef5822ed2f4e7

SHA1
8cff2329cbc1c451a0ebc54305a03e6c801bbc8c

SHA256
997d2215efc59e21fbc3d794551b5e70ef97db808b40b5412ca4af9e3ec6fff6

SHA512
8276b3a9899f4246396686e27b3e94e86a5934b0efefff410d10cbabd4b4860e2ddf31a10fac4df77a0622f36d5fe898dc2f8cf7f23fc07673debea287030a67

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-37029.exe

Filesize
468KB

MD5
3f32667af339dba22cd1a64599c867bb

SHA1
b567a30d27b1d4a42f939a3bbabb654579b92cd5

SHA256
19bf25311ba751ab2f0aa07707bf445631a37070d7a6179a1179bc1cb00b30f7

SHA512
8b96aaf0ec69bf5639622ab68c4982ce7a242b809c69c25b721fa58b95cf265e8a361174abc7b09054ec872a0b94c98a76510163ee35326a5d07153534706752

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-57065.exe

Filesize
468KB

MD5
196101831848980fa6a9bb4a464d7212

SHA1
4f57eb5f635b1a84b470fbc7c5b782154527335d

SHA256
6f0f775ba2e5000dd573c40a02ddce0a331048c72ca16047055ed92c6a9517dd

SHA512
eb654cc1e0048792641cf61046f5a95d1a165fcd3f0461fd380a7e9c9a1bf5b54368b0ed4e7a232bdb8b8e3c299bbbc673fb870037a1e5596c040dfad047b2f9

Download Submit
memory/276-237-0x00000000024D0000-0x0000000002545000-memory.dmp

Filesize
468KB

Download
memory/276-140-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/276-249-0x00000000024D0000-0x0000000002545000-memory.dmp

Filesize
468KB

Download
memory/592-251-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/604-275-0x0000000001E30000-0x0000000001EA5000-memory.dmp

Filesize
468KB

Download
memory/604-268-0x0000000001E30000-0x0000000001EA5000-memory.dmp

Filesize
468KB

Download
memory/604-158-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/644-410-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/676-236-0x0000000002490000-0x0000000002505000-memory.dmp

Filesize
468KB

Download
memory/676-247-0x0000000002490000-0x0000000002505000-memory.dmp

Filesize
468KB

Download
memory/676-127-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/784-248-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/928-231-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/928-397-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/928-396-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/1320-376-0x00000000025A0000-0x0000000002615000-memory.dmp

Filesize
468KB

Download
memory/1320-218-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1384-378-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1388-289-0x0000000003470000-0x00000000034E5000-memory.dmp

Filesize
468KB

Download
memory/1388-157-0x0000000002940000-0x00000000029B5000-memory.dmp

Filesize
468KB

Download
memory/1388-11-0x0000000002940000-0x00000000029B5000-memory.dmp

Filesize
468KB

Download
memory/1388-68-0x0000000003470000-0x00000000034E5000-memory.dmp

Filesize
468KB

Download
memory/1388-388-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1388-290-0x0000000003470000-0x00000000034E5000-memory.dmp

Filesize
468KB

Download
memory/1388-151-0x0000000002940000-0x00000000029B5000-memory.dmp

Filesize
468KB

Download
memory/1388-398-0x0000000002940000-0x00000000029B5000-memory.dmp

Filesize
468KB

Download
memory/1388-33-0x0000000003470000-0x00000000034E5000-memory.dmp

Filesize
468KB

Download
memory/1388-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1388-10-0x0000000003470000-0x00000000034E5000-memory.dmp

Filesize
468KB

Download
memory/1632-111-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1632-202-0x0000000003350000-0x00000000033C5000-memory.dmp

Filesize
468KB

Download
memory/1632-201-0x0000000003350000-0x00000000033C5000-memory.dmp

Filesize
468KB

Download
memory/1632-365-0x0000000002820000-0x0000000002895000-memory.dmp

Filesize
468KB

Download
memory/1632-364-0x0000000002820000-0x0000000002895000-memory.dmp

Filesize
468KB

Download
memory/1684-321-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1724-367-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1732-320-0x0000000002670000-0x00000000026E5000-memory.dmp

Filesize
468KB

Download
memory/1732-318-0x0000000002670000-0x00000000026E5000-memory.dmp

Filesize
468KB

Download
memory/1884-267-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1968-291-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2004-339-0x0000000001C80000-0x0000000001CF5000-memory.dmp

Filesize
468KB

Download
memory/2004-190-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2004-333-0x0000000001C80000-0x0000000001CF5000-memory.dmp

Filesize
468KB

Download
memory/2064-277-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2152-187-0x0000000001E10000-0x0000000001E85000-memory.dmp

Filesize
468KB

Download
memory/2152-81-0x0000000001E10000-0x0000000001E85000-memory.dmp

Filesize
468KB

Download
memory/2152-351-0x0000000001E10000-0x0000000001E85000-memory.dmp

Filesize
468KB

Download
memory/2152-356-0x0000000001E10000-0x0000000001E85000-memory.dmp

Filesize
468KB

Download
memory/2152-34-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2152-188-0x0000000001E10000-0x0000000001E85000-memory.dmp

Filesize
468KB

Download
memory/2240-399-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2404-347-0x0000000002600000-0x0000000002675000-memory.dmp

Filesize
468KB

Download
memory/2404-348-0x0000000002600000-0x0000000002675000-memory.dmp

Filesize
468KB

Download
memory/2404-204-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2428-282-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2452-293-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2540-216-0x00000000025C0000-0x0000000002635000-memory.dmp

Filesize
468KB

Download
memory/2540-107-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2540-217-0x00000000025C0000-0x0000000002635000-memory.dmp

Filesize
468KB

Download
memory/2540-387-0x00000000025C0000-0x0000000002635000-memory.dmp

Filesize
468KB

Download
memory/2568-70-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2568-235-0x0000000002860000-0x00000000028D5000-memory.dmp

Filesize
468KB

Download
memory/2568-244-0x0000000002860000-0x00000000028D5000-memory.dmp

Filesize
468KB

Download
memory/2584-303-0x0000000002500000-0x0000000002575000-memory.dmp

Filesize
468KB

Download
memory/2584-69-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2584-139-0x0000000002500000-0x0000000002575000-memory.dmp

Filesize
468KB

Download
memory/2584-145-0x0000000002500000-0x0000000002575000-memory.dmp

Filesize
468KB

Download
memory/2584-302-0x0000000002500000-0x0000000002575000-memory.dmp

Filesize
468KB

Download
memory/2588-349-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2640-147-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2640-255-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2640-256-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2704-340-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2748-273-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2748-13-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2748-409-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2748-138-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2748-130-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2792-336-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2820-357-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2876-389-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2928-126-0x00000000020A0000-0x0000000002115000-memory.dmp

Filesize
468KB

Download
memory/2928-35-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2928-281-0x00000000020A0000-0x0000000002115000-memory.dmp

Filesize
468KB

Download
memory/2928-125-0x00000000020A0000-0x0000000002115000-memory.dmp

Filesize
468KB

Download
memory/2928-269-0x00000000020A0000-0x0000000002115000-memory.dmp

Filesize
468KB

Download
memory/2996-304-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3020-177-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/3020-338-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/3020-335-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/3020-175-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/3068-110-0x0000000002550000-0x00000000025C5000-memory.dmp

Filesize
468KB

Download
memory/3068-408-0x0000000002550000-0x00000000025C5000-memory.dmp

Filesize
468KB

Download
memory/3068-230-0x0000000002550000-0x00000000025C5000-memory.dmp

Filesize
468KB

Download
memory/3068-71-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3068-229-0x0000000002550000-0x00000000025C5000-memory.dmp

Filesize
468KB

Download