7a46059986ebd037b16ba28fdb183bf25dc0ece7ecfec3555733f6153ca586ff

Analysis

max time kernel
120s
max time network
16s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
02/10/2024, 16:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7a46059986ebd037b16ba28fdb183bf25dc0ece7ecfec3555733f6153ca586ffN.exe
Size

468KB
MD5

a5f8cb384bbbf142713f498bf71282b0
SHA1

4f2f0cefd4ef6e403ef071d3944b5fcaa1c1fa70
SHA256

7a46059986ebd037b16ba28fdb183bf25dc0ece7ecfec3555733f6153ca586ff
SHA512

c3904783db4b8fa7bfe933a75b1366ea5a81718943740a04053229e930f035601b2a84b4f4c7cf9c3782530367d5d0ea7a4cd38e3eb23c21f9a78784bb200dab
SSDEEP

3072:58AXogIdId5UtbYsPzcjcc8HG2C4D3p5hmHekVXaGCXkzbEgGFlO:58EowbUtLPAjccaZdNGCUXEgG

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2360	Unicorn-22166.exe
2968	Unicorn-43245.exe
488	Unicorn-31547.exe
2992	Unicorn-60972.exe
2740	Unicorn-53359.exe
2804	Unicorn-9917.exe
2728	Unicorn-16048.exe
2504	Unicorn-53162.exe
372	Unicorn-16960.exe
1980	Unicorn-837.exe
836	Unicorn-19403.exe
1868	Unicorn-29618.exe
1592	Unicorn-37786.exe
1624	Unicorn-29353.exe
2924	Unicorn-26088.exe
2944	Unicorn-58637.exe
2800	Unicorn-46940.exe
2396	Unicorn-43069.exe
2224	Unicorn-45107.exe
1652	Unicorn-22841.exe
1380	Unicorn-6675.exe
2288	Unicorn-59405.exe
2764	Unicorn-6120.exe
392	Unicorn-51792.exe
2008	Unicorn-18373.exe
2012	Unicorn-7635.exe
2540	Unicorn-58319.exe
3024	Unicorn-64449.exe
2372	Unicorn-55519.exe
3044	Unicorn-64449.exe
2980	Unicorn-51932.exe
2496	Unicorn-59872.exe
2840	Unicorn-16270.exe
2612	Unicorn-40412.exe
3060	Unicorn-38558.exe
2548	Unicorn-11247.exe
1768	Unicorn-31668.exe
1372	Unicorn-31403.exe
1356	Unicorn-28330.exe
1636	Unicorn-48196.exe
1936	Unicorn-53027.exe
2956	Unicorn-44304.exe
1688	Unicorn-42258.exe
2684	Unicorn-56447.exe
2208	Unicorn-36197.exe
764	Unicorn-23391.exe
3004	Unicorn-51979.exe
872	Unicorn-32113.exe
2172	Unicorn-48642.exe
604	Unicorn-15222.exe
1704	Unicorn-48285.exe
1340	Unicorn-37349.exe
2164	Unicorn-57215.exe
2392	Unicorn-5968.exe
1580	Unicorn-28627.exe
2812	Unicorn-7941.exe
2324	Unicorn-8206.exe
2932	Unicorn-54785.exe
2648	Unicorn-45134.exe
3068	Unicorn-24159.exe
1440	Unicorn-6861.exe
1752	Unicorn-4698.exe
1616	Unicorn-17697.exe
2512	Unicorn-36494.exe

Loads dropped DLL 64 IoCs

pid	Process
2236	7a46059986ebd037b16ba28fdb183bf25dc0ece7ecfec3555733f6153ca586ffN.exe
2236	7a46059986ebd037b16ba28fdb183bf25dc0ece7ecfec3555733f6153ca586ffN.exe
2360	Unicorn-22166.exe
2360	Unicorn-22166.exe
2236	7a46059986ebd037b16ba28fdb183bf25dc0ece7ecfec3555733f6153ca586ffN.exe
2236	7a46059986ebd037b16ba28fdb183bf25dc0ece7ecfec3555733f6153ca586ffN.exe
2968	Unicorn-43245.exe
2968	Unicorn-43245.exe
2360	Unicorn-22166.exe
2360	Unicorn-22166.exe
2236	7a46059986ebd037b16ba28fdb183bf25dc0ece7ecfec3555733f6153ca586ffN.exe
488	Unicorn-31547.exe
2236	7a46059986ebd037b16ba28fdb183bf25dc0ece7ecfec3555733f6153ca586ffN.exe
488	Unicorn-31547.exe
2992	Unicorn-60972.exe
2992	Unicorn-60972.exe
2968	Unicorn-43245.exe
2968	Unicorn-43245.exe
2804	Unicorn-9917.exe
2804	Unicorn-9917.exe
2740	Unicorn-53359.exe
2740	Unicorn-53359.exe
2360	Unicorn-22166.exe
2360	Unicorn-22166.exe
2236	7a46059986ebd037b16ba28fdb183bf25dc0ece7ecfec3555733f6153ca586ffN.exe
2728	Unicorn-16048.exe
2236	7a46059986ebd037b16ba28fdb183bf25dc0ece7ecfec3555733f6153ca586ffN.exe
2728	Unicorn-16048.exe
488	Unicorn-31547.exe
488	Unicorn-31547.exe
2504	Unicorn-53162.exe
2504	Unicorn-53162.exe
2992	Unicorn-60972.exe
2992	Unicorn-60972.exe
372	Unicorn-16960.exe
372	Unicorn-16960.exe
2968	Unicorn-43245.exe
2968	Unicorn-43245.exe
1980	Unicorn-837.exe
1980	Unicorn-837.exe
2804	Unicorn-9917.exe
2804	Unicorn-9917.exe
1592	Unicorn-37786.exe
1592	Unicorn-37786.exe
1868	Unicorn-29618.exe
1868	Unicorn-29618.exe
2728	Unicorn-16048.exe
2728	Unicorn-16048.exe
2924	Unicorn-26088.exe
2740	Unicorn-53359.exe
2924	Unicorn-26088.exe
2740	Unicorn-53359.exe
488	Unicorn-31547.exe
488	Unicorn-31547.exe
2236	7a46059986ebd037b16ba28fdb183bf25dc0ece7ecfec3555733f6153ca586ffN.exe
1624	Unicorn-29353.exe
836	Unicorn-19403.exe
1624	Unicorn-29353.exe
2236	7a46059986ebd037b16ba28fdb183bf25dc0ece7ecfec3555733f6153ca586ffN.exe
836	Unicorn-19403.exe
2360	Unicorn-22166.exe
2360	Unicorn-22166.exe
2944	Unicorn-58637.exe
2944	Unicorn-58637.exe

Program crash 4 IoCs

pid	pid_target	Process	procid_target
1160	1536	WerFault.exe	128
5896	4340	WerFault.exe	348
5480	1764	WerFault.exe	384
5648	2272	WerFault.exe	386

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37786.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51792.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8744.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41906.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3817.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21162.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16270.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13330.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18975.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42436.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60752.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1224.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57535.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8744.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29353.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41399.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8414.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17050.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33661.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10533.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11750.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19195.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59487.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60387.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27835.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50571.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6861.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13240.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-79.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20415.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26088.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7661.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64893.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18135.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8744.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57929.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11548.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27835.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54681.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3817.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58459.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8057.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16960.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19372.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8744.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17078.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45134.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4698.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54273.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29772.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27416.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1734.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7a46059986ebd037b16ba28fdb183bf25dc0ece7ecfec3555733f6153ca586ffN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50571.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56998.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11750.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28373.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13271.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49701.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17381.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13091.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2938.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61507.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57271.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2236	7a46059986ebd037b16ba28fdb183bf25dc0ece7ecfec3555733f6153ca586ffN.exe
2360	Unicorn-22166.exe
2968	Unicorn-43245.exe
488	Unicorn-31547.exe
2992	Unicorn-60972.exe
2740	Unicorn-53359.exe
2804	Unicorn-9917.exe
2728	Unicorn-16048.exe
2504	Unicorn-53162.exe
372	Unicorn-16960.exe
1980	Unicorn-837.exe
1592	Unicorn-37786.exe
1868	Unicorn-29618.exe
2924	Unicorn-26088.exe
1624	Unicorn-29353.exe
836	Unicorn-19403.exe
2944	Unicorn-58637.exe
2800	Unicorn-46940.exe
2224	Unicorn-45107.exe
1652	Unicorn-22841.exe
2396	Unicorn-43069.exe
1380	Unicorn-6675.exe
2288	Unicorn-59405.exe
2764	Unicorn-6120.exe
392	Unicorn-51792.exe
3044	Unicorn-64449.exe
2012	Unicorn-7635.exe
2540	Unicorn-58319.exe
2008	Unicorn-18373.exe
2980	Unicorn-51932.exe
2372	Unicorn-55519.exe
3024	Unicorn-64449.exe
2496	Unicorn-59872.exe
2840	Unicorn-16270.exe
2612	Unicorn-40412.exe
3060	Unicorn-38558.exe
2548	Unicorn-11247.exe
1768	Unicorn-31668.exe
1372	Unicorn-31403.exe
1356	Unicorn-28330.exe
2956	Unicorn-44304.exe
1936	Unicorn-53027.exe
1636	Unicorn-48196.exe
1688	Unicorn-42258.exe
2684	Unicorn-56447.exe
2208	Unicorn-36197.exe
604	Unicorn-15222.exe
2172	Unicorn-48642.exe
1704	Unicorn-48285.exe
1340	Unicorn-37349.exe
2164	Unicorn-57215.exe
2392	Unicorn-5968.exe
764	Unicorn-23391.exe
1580	Unicorn-28627.exe
3004	Unicorn-51979.exe
872	Unicorn-32113.exe
2812	Unicorn-7941.exe
2324	Unicorn-8206.exe
2932	Unicorn-54785.exe
2648	Unicorn-45134.exe
3068	Unicorn-24159.exe
1440	Unicorn-6861.exe
1752	Unicorn-4698.exe
1616	Unicorn-17697.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2236 wrote to memory of 2360	2236	7a46059986ebd037b16ba28fdb183bf25dc0ece7ecfec3555733f6153ca586ffN.exe	31
PID 2236 wrote to memory of 2360	2236	7a46059986ebd037b16ba28fdb183bf25dc0ece7ecfec3555733f6153ca586ffN.exe	31
PID 2236 wrote to memory of 2360	2236	7a46059986ebd037b16ba28fdb183bf25dc0ece7ecfec3555733f6153ca586ffN.exe	31
PID 2236 wrote to memory of 2360	2236	7a46059986ebd037b16ba28fdb183bf25dc0ece7ecfec3555733f6153ca586ffN.exe	31
PID 2360 wrote to memory of 2968	2360	Unicorn-22166.exe	32
PID 2360 wrote to memory of 2968	2360	Unicorn-22166.exe	32
PID 2360 wrote to memory of 2968	2360	Unicorn-22166.exe	32
PID 2360 wrote to memory of 2968	2360	Unicorn-22166.exe	32
PID 2236 wrote to memory of 488	2236	7a46059986ebd037b16ba28fdb183bf25dc0ece7ecfec3555733f6153ca586ffN.exe	33
PID 2236 wrote to memory of 488	2236	7a46059986ebd037b16ba28fdb183bf25dc0ece7ecfec3555733f6153ca586ffN.exe	33
PID 2236 wrote to memory of 488	2236	7a46059986ebd037b16ba28fdb183bf25dc0ece7ecfec3555733f6153ca586ffN.exe	33
PID 2236 wrote to memory of 488	2236	7a46059986ebd037b16ba28fdb183bf25dc0ece7ecfec3555733f6153ca586ffN.exe	33
PID 2968 wrote to memory of 2992	2968	Unicorn-43245.exe	34
PID 2968 wrote to memory of 2992	2968	Unicorn-43245.exe	34
PID 2968 wrote to memory of 2992	2968	Unicorn-43245.exe	34
PID 2968 wrote to memory of 2992	2968	Unicorn-43245.exe	34
PID 2360 wrote to memory of 2740	2360	Unicorn-22166.exe	35
PID 2360 wrote to memory of 2740	2360	Unicorn-22166.exe	35
PID 2360 wrote to memory of 2740	2360	Unicorn-22166.exe	35
PID 2360 wrote to memory of 2740	2360	Unicorn-22166.exe	35
PID 2236 wrote to memory of 2804	2236	7a46059986ebd037b16ba28fdb183bf25dc0ece7ecfec3555733f6153ca586ffN.exe	36
PID 2236 wrote to memory of 2804	2236	7a46059986ebd037b16ba28fdb183bf25dc0ece7ecfec3555733f6153ca586ffN.exe	36
PID 2236 wrote to memory of 2804	2236	7a46059986ebd037b16ba28fdb183bf25dc0ece7ecfec3555733f6153ca586ffN.exe	36
PID 2236 wrote to memory of 2804	2236	7a46059986ebd037b16ba28fdb183bf25dc0ece7ecfec3555733f6153ca586ffN.exe	36
PID 488 wrote to memory of 2728	488	Unicorn-31547.exe	37
PID 488 wrote to memory of 2728	488	Unicorn-31547.exe	37
PID 488 wrote to memory of 2728	488	Unicorn-31547.exe	37
PID 488 wrote to memory of 2728	488	Unicorn-31547.exe	37
PID 2992 wrote to memory of 2504	2992	Unicorn-60972.exe	38
PID 2992 wrote to memory of 2504	2992	Unicorn-60972.exe	38
PID 2992 wrote to memory of 2504	2992	Unicorn-60972.exe	38
PID 2992 wrote to memory of 2504	2992	Unicorn-60972.exe	38
PID 2968 wrote to memory of 372	2968	Unicorn-43245.exe	39
PID 2968 wrote to memory of 372	2968	Unicorn-43245.exe	39
PID 2968 wrote to memory of 372	2968	Unicorn-43245.exe	39
PID 2968 wrote to memory of 372	2968	Unicorn-43245.exe	39
PID 2804 wrote to memory of 1980	2804	Unicorn-9917.exe	40
PID 2804 wrote to memory of 1980	2804	Unicorn-9917.exe	40
PID 2804 wrote to memory of 1980	2804	Unicorn-9917.exe	40
PID 2804 wrote to memory of 1980	2804	Unicorn-9917.exe	40
PID 2740 wrote to memory of 1868	2740	Unicorn-53359.exe	41
PID 2740 wrote to memory of 1868	2740	Unicorn-53359.exe	41
PID 2740 wrote to memory of 1868	2740	Unicorn-53359.exe	41
PID 2740 wrote to memory of 1868	2740	Unicorn-53359.exe	41
PID 2360 wrote to memory of 836	2360	Unicorn-22166.exe	42
PID 2360 wrote to memory of 836	2360	Unicorn-22166.exe	42
PID 2360 wrote to memory of 836	2360	Unicorn-22166.exe	42
PID 2360 wrote to memory of 836	2360	Unicorn-22166.exe	42
PID 2236 wrote to memory of 1624	2236	7a46059986ebd037b16ba28fdb183bf25dc0ece7ecfec3555733f6153ca586ffN.exe	43
PID 2236 wrote to memory of 1624	2236	7a46059986ebd037b16ba28fdb183bf25dc0ece7ecfec3555733f6153ca586ffN.exe	43
PID 2236 wrote to memory of 1624	2236	7a46059986ebd037b16ba28fdb183bf25dc0ece7ecfec3555733f6153ca586ffN.exe	43
PID 2236 wrote to memory of 1624	2236	7a46059986ebd037b16ba28fdb183bf25dc0ece7ecfec3555733f6153ca586ffN.exe	43
PID 2728 wrote to memory of 1592	2728	Unicorn-16048.exe	44
PID 2728 wrote to memory of 1592	2728	Unicorn-16048.exe	44
PID 2728 wrote to memory of 1592	2728	Unicorn-16048.exe	44
PID 2728 wrote to memory of 1592	2728	Unicorn-16048.exe	44
PID 488 wrote to memory of 2924	488	Unicorn-31547.exe	45
PID 488 wrote to memory of 2924	488	Unicorn-31547.exe	45
PID 488 wrote to memory of 2924	488	Unicorn-31547.exe	45
PID 488 wrote to memory of 2924	488	Unicorn-31547.exe	45
PID 2504 wrote to memory of 2944	2504	Unicorn-53162.exe	46
PID 2504 wrote to memory of 2944	2504	Unicorn-53162.exe	46
PID 2504 wrote to memory of 2944	2504	Unicorn-53162.exe	46
PID 2504 wrote to memory of 2944	2504	Unicorn-53162.exe	46

C:\Users\Admin\AppData\Local\Temp\7a46059986ebd037b16ba28fdb183bf25dc0ece7ecfec3555733f6153ca586ffN.exe
"C:\Users\Admin\AppData\Local\Temp\7a46059986ebd037b16ba28fdb183bf25dc0ece7ecfec3555733f6153ca586ffN.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2236
- C:\Users\Admin\AppData\Local\Temp\Unicorn-22166.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-22166.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2360
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43245.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43245.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60972.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60972.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53162.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58637.exe
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:2944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59872.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4698.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50329.exe
        9⤵
        
        PID:2124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54273.exe
        10⤵
        
        PID:1664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2365.exe
        10⤵
        
        PID:4292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50571.exe
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:6072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18844.exe
        10⤵
        
        PID:6356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63187.exe
        9⤵
        
        PID:4076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16398.exe
        9⤵
        
        PID:4368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41906.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:6032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2309.exe
        9⤵
        
        PID:6692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43483.exe
        8⤵
        
        PID:1860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65044.exe
        9⤵
        
        PID:4676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54681.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:4340
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4340 -s 188
        10⤵
        Program crash
        
        PID:5896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43240.exe
        9⤵
        
        PID:7044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52933.exe
        8⤵
        
        PID:3640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19195.exe
        8⤵
        
        PID:3328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-79.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-79.exe
        8⤵
        
        PID:4648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60752.exe
        8⤵
        
        PID:5772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17078.exe
        8⤵
        
        PID:6560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17697.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48186.exe
        8⤵
        
        PID:1716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27835.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2879.exe
        8⤵
        
        PID:5224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20415.exe
        8⤵
        
        PID:6104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57929.exe
        8⤵
        
        PID:7000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5491.exe
        7⤵
        
        PID:2672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23041.exe
        7⤵
        
        PID:3764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10217.exe
        7⤵
        
        PID:5456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29432.exe
        7⤵
        
        PID:6480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61084.exe
        7⤵
        
        PID:6392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16270.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36494.exe
        7⤵
        Executes dropped EXE
        
        PID:2512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44486.exe
        8⤵
        
        PID:2536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42962.exe
        8⤵
        
        PID:4548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26752.exe
        8⤵
        
        PID:5464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12366.exe
        8⤵
        
        PID:6488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17078.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3026.exe
        7⤵
        
        PID:3088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19195.exe
        7⤵
        
        PID:3736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-79.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-79.exe
        7⤵
        
        PID:4844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60752.exe
        7⤵
        
        PID:5660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17078.exe
        7⤵
        
        PID:6352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19372.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36235.exe
        7⤵
        
        PID:2884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35152.exe
        7⤵
        
        PID:3440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2879.exe
        7⤵
        
        PID:4304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20415.exe
        7⤵
        
        PID:5260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57929.exe
        7⤵
        
        PID:7056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35586.exe
        6⤵
        
        PID:1444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59300.exe
        6⤵
        
        PID:3720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27283.exe
        6⤵
        
        PID:5416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7901.exe
        6⤵
        
        PID:6504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46940.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40412.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12181.exe
        7⤵
        
        PID:2472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60931.exe
        8⤵
        
        PID:2616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35152.exe
        8⤵
        
        PID:3432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2879.exe
        8⤵
        
        PID:4560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20415.exe
        8⤵
        
        PID:5864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57005.exe
        8⤵
        
        PID:6820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44766.exe
        7⤵
        
        PID:1344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18135.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8744.exe
        7⤵
        
        PID:4664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11750.exe
        7⤵
        
        PID:5796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13.exe
        7⤵
        
        PID:6556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57277.exe
        6⤵
        
        PID:2264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52545.exe
        7⤵
        
        PID:2852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6205.exe
        7⤵
        
        PID:4608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8744.exe
        7⤵
        
        PID:4712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11750.exe
        7⤵
        
        PID:5960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19554.exe
        6⤵
        
        PID:1744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11603.exe
        6⤵
        
        PID:3788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-79.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-79.exe
        6⤵
        
        PID:4568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60752.exe
        6⤵
        
        PID:5704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58459.exe
        6⤵
        
        PID:6856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38558.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56722.exe
        6⤵
        
        PID:2960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60630.exe
        7⤵
        
        PID:572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27835.exe
        7⤵
        
        PID:3340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2879.exe
        7⤵
        
        PID:5168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20415.exe
        7⤵
        
        PID:5880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57929.exe
        7⤵
        
        PID:6920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52633.exe
        6⤵
        
        PID:2952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41571.exe
        6⤵
        
        PID:3296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8744.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11750.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56998.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8372.exe
        5⤵
        
        PID:1052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10530.exe
        6⤵
        
        PID:4136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27283.exe
        6⤵
        
        PID:5448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3817.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61871.exe
        5⤵
        
        PID:2156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51940.exe
        5⤵
        
        PID:3784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-609.exe
        5⤵
        
        PID:4860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56286.exe
        5⤵
        
        PID:5812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55749.exe
        5⤵
        
        PID:6620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16960.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16960.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43069.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48196.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53178.exe
        7⤵
        
        PID:2144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4029.exe
        8⤵
        
        PID:2972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64893.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2879.exe
        8⤵
        
        PID:5128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20415.exe
        8⤵
        
        PID:5520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57929.exe
        8⤵
        
        PID:6968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49893.exe
        7⤵
        
        PID:264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13091.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8744.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11750.exe
        7⤵
        
        PID:5696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13.exe
        7⤵
        
        PID:6512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45757.exe
        6⤵
        
        PID:2112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62332.exe
        7⤵
        
        PID:3140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65132.exe
        7⤵
        
        PID:4152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2879.exe
        7⤵
        
        PID:5240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20415.exe
        7⤵
        
        PID:6016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57929.exe
        7⤵
        
        PID:7120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57271.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19195.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-79.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-79.exe
        6⤵
        
        PID:4544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60752.exe
        6⤵
        
        PID:5600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21162.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53027.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45202.exe
        6⤵
        
        PID:2316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21793.exe
        7⤵
        
        PID:932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11847.exe
        7⤵
        
        PID:3684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2879.exe
        7⤵
        
        PID:4572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20415.exe
        7⤵
        
        PID:5744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16548.exe
        7⤵
        
        PID:6440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55212.exe
        6⤵
        
        PID:2752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25582.exe
        6⤵
        
        PID:3612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8744.exe
        6⤵
        
        PID:4536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11750.exe
        6⤵
        
        PID:5576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4097.exe
        6⤵
        
        PID:6188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27779.exe
        5⤵
        
        PID:2776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63187.exe
        6⤵
        
        PID:4092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44812.exe
        6⤵
        
        PID:2476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60752.exe
        6⤵
        
        PID:5592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58459.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25420.exe
        5⤵
        
        PID:1584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2938.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49080.exe
        5⤵
        
        PID:2180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12280.exe
        5⤵
        
        PID:5980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45107.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45107.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11247.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-661.exe
        6⤵
        
        PID:2908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54273.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65132.exe
        7⤵
        
        PID:4160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2879.exe
        7⤵
        
        PID:5184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20415.exe
        7⤵
        
        PID:6120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57929.exe
        7⤵
        
        PID:7076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54828.exe
        6⤵
        
        PID:3076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13330.exe
        6⤵
        
        PID:4224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8744.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11750.exe
        6⤵
        
        PID:5680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13.exe
        6⤵
        
        PID:6576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12892.exe
        5⤵
        
        PID:2024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31227.exe
        6⤵
        
        PID:1904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13330.exe
        6⤵
        
        PID:4208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8744.exe
        6⤵
        
        PID:4240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11750.exe
        6⤵
        
        PID:5636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13.exe
        6⤵
        
        PID:6364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42549.exe
        5⤵
        
        PID:2892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54753.exe
        5⤵
        
        PID:3408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-79.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-79.exe
        5⤵
        
        PID:3480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60752.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31403.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31403.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51673.exe
        5⤵
        
        PID:2364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25685.exe
        6⤵
        
        PID:2788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57540.exe
        6⤵
        
        PID:4024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2879.exe
        6⤵
        
        PID:5176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20415.exe
        6⤵
        
        PID:5836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57005.exe
        6⤵
        
        PID:6804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50936.exe
        5⤵
        
        PID:2756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5738.exe
        5⤵
        
        PID:3792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8744.exe
        5⤵
        
        PID:4496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11750.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25529.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25529.exe
      4⤵
      PID:2132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59487.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2261.exe
        5⤵
        
        PID:7140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43851.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43851.exe
      4⤵
      PID:3148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8263.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8263.exe
      4⤵
      PID:4328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20905.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20905.exe
      4⤵
      PID:5996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8899.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8899.exe
      4⤵
      PID:7152
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53359.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53359.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29618.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29618.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:1868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6120.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56447.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63349.exe
        7⤵
        
        PID:952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8827.exe
        8⤵
        
        PID:4256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47499.exe
        8⤵
        
        PID:6136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1224.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39197.exe
        7⤵
        
        PID:3648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13330.exe
        7⤵
        
        PID:4184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8744.exe
        7⤵
        
        PID:4592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11750.exe
        7⤵
        
        PID:5736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13.exe
        7⤵
        
        PID:6428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63328.exe
        6⤵
        
        PID:1536
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1536 -s 220
        7⤵
        Program crash
        
        PID:1160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63244.exe
        6⤵
        
        PID:3048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18956.exe
        6⤵
        
        PID:3188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-79.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-79.exe
        6⤵
        
        PID:4272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60752.exe
        6⤵
        
        PID:5780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58459.exe
        6⤵
        
        PID:6772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36197.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5321.exe
        6⤵
        
        PID:2948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17050.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3440.exe
        7⤵
        
        PID:3760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2879.exe
        7⤵
        
        PID:5216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20415.exe
        7⤵
        
        PID:5852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57929.exe
        7⤵
        
        PID:6844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37339.exe
        6⤵
        
        PID:1684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13091.exe
        6⤵
        
        PID:4040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8744.exe
        6⤵
        
        PID:4816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11750.exe
        6⤵
        
        PID:5856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41393.exe
        6⤵
        
        PID:6420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15719.exe
        5⤵
        
        PID:2736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4221.exe
        6⤵
        
        PID:2652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27835.exe
        6⤵
        
        PID:3352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2879.exe
        6⤵
        
        PID:5144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20415.exe
        6⤵
        
        PID:6112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57929.exe
        6⤵
        
        PID:6940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11548.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14375.exe
        5⤵
        
        PID:3776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27283.exe
        5⤵
        
        PID:5408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3817.exe
        5⤵
        
        PID:6540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31593.exe
        5⤵
        
        PID:7016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7635.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7635.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8206.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50329.exe
        6⤵
        
        PID:2920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1734.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63318.exe
        6⤵
        
        PID:3548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13330.exe
        6⤵
        
        PID:4232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8744.exe
        6⤵
        
        PID:4752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11750.exe
        6⤵
        
        PID:6128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43483.exe
        5⤵
        
        PID:1068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35903.exe
        6⤵
        
        PID:3688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65132.exe
        6⤵
        
        PID:4168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2879.exe
        6⤵
        
        PID:4348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20415.exe
        6⤵
        
        PID:5540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3720.exe
        6⤵
        
        PID:6776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52933.exe
        5⤵
        
        PID:3624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19195.exe
        5⤵
        
        PID:3280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-79.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-79.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60752.exe
        5⤵
        
        PID:5560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38039.exe
        5⤵
        
        PID:7008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54785.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54785.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55072.exe
        5⤵
        
        PID:2412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49378.exe
        6⤵
        
        PID:5344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9697.exe
        6⤵
        
        PID:6204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49452.exe
        5⤵
        
        PID:3112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10533.exe
        5⤵
        
        PID:4400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50571.exe
        5⤵
        
        PID:6096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18844.exe
        5⤵
        
        PID:6728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31154.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31154.exe
      4⤵
      PID:1320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60387.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60387.exe
      4⤵
      PID:3176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56735.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56735.exe
      4⤵
      PID:4440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42436.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42436.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63381.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63381.exe
      4⤵
      PID:6660
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19403.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19403.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64449.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64449.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15222.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52503.exe
        6⤵
        
        PID:2864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25301.exe
        7⤵
        
        PID:688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11847.exe
        7⤵
        
        PID:3744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2879.exe
        7⤵
        
        PID:5192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20415.exe
        7⤵
        
        PID:5248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57929.exe
        7⤵
        
        PID:7096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60478.exe
        6⤵
        
        PID:3252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19195.exe
        6⤵
        
        PID:3376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-79.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-79.exe
        6⤵
        
        PID:4288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60752.exe
        6⤵
        
        PID:5872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57535.exe
        6⤵
        
        PID:6800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35891.exe
        5⤵
        
        PID:880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10094.exe
        6⤵
        
        PID:6948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29772.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19195.exe
        5⤵
        
        PID:3300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-79.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-79.exe
        5⤵
        
        PID:4520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60752.exe
        5⤵
        
        PID:5512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37349.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37349.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26951.exe
        5⤵
        
        PID:1324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29031.exe
        5⤵
        
        PID:3984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10533.exe
        5⤵
        
        PID:4432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50571.exe
        5⤵
        
        PID:6008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18844.exe
        5⤵
        
        PID:6752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-400.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-400.exe
      4⤵
      PID:1724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54753.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54753.exe
      4⤵
      PID:3484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-79.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-79.exe
      4⤵
      PID:4656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60752.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60752.exe
      4⤵
      PID:5820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17078.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17078.exe
      4⤵
      PID:6608
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51932.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51932.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45949.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45949.exe
      4⤵
      PID:2720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9540.exe
        5⤵
        
        PID:2936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11847.exe
        5⤵
        
        PID:3996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2879.exe
        5⤵
        
        PID:5200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20415.exe
        5⤵
        
        PID:5748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57929.exe
        5⤵
        
        PID:6944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56202.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56202.exe
      4⤵
      PID:3132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19195.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19195.exe
      4⤵
      PID:4112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-79.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-79.exe
      4⤵
      PID:4856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60752.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60752.exe
      4⤵
      PID:5684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17078.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17078.exe
      4⤵
      PID:6280
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48285.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48285.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28373.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28373.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33661.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37141.exe
        5⤵
        
        PID:4784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64459.exe
        5⤵
        
        PID:5488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4097.exe
        5⤵
        
        PID:6228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54753.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54753.exe
      4⤵
      PID:3516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-79.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-79.exe
      4⤵
      PID:4344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60752.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60752.exe
      4⤵
      PID:5644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57535.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57535.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6764
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44131.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44131.exe
    3⤵
    PID:1656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8414.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8414.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1432
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27835.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27835.exe
      4⤵
      PID:3332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2879.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2879.exe
      4⤵
      PID:5160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20415.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20415.exe
      4⤵
      PID:5528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57005.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57005.exe
      4⤵
      PID:6824
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39402.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39402.exe
    3⤵
    PID:1924
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42606.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42606.exe
    3⤵
    PID:4628
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43480.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43480.exe
    3⤵
    PID:4796
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27416.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27416.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5404
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55394.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55394.exe
    3⤵
    PID:6900
- C:\Users\Admin\AppData\Local\Temp\Unicorn-31547.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-31547.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:488
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16048.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16048.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37786.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37786.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59405.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23391.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18975.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35152.exe
        7⤵
        
        PID:3528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2879.exe
        7⤵
        
        PID:5152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20415.exe
        7⤵
        
        PID:5716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16548.exe
        7⤵
        
        PID:6580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44958.exe
        6⤵
        
        PID:2068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48888.exe
        6⤵
        
        PID:3572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8744.exe
        6⤵
        
        PID:4688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11750.exe
        6⤵
        
        PID:5788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13.exe
        6⤵
        
        PID:6548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32113.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63349.exe
        6⤵
        
        PID:776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55211.exe
        7⤵
        
        PID:6452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46994.exe
        7⤵
        
        PID:5504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39197.exe
        6⤵
        
        PID:3576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13330.exe
        6⤵
        
        PID:4100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8744.exe
        6⤵
        
        PID:4252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11750.exe
        6⤵
        
        PID:5652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4097.exe
        6⤵
        
        PID:6232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57219.exe
        5⤵
        
        PID:2928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15787.exe
        6⤵
        
        PID:4672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17260.exe
        6⤵
        
        PID:5328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23432.exe
        6⤵
        
        PID:6200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58798.exe
        5⤵
        
        PID:3592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10530.exe
        5⤵
        
        PID:3428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27283.exe
        5⤵
        
        PID:5432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3817.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31593.exe
        5⤵
        
        PID:6876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51792.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51792.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57215.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47802.exe
        6⤵
        
        PID:1556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64893.exe
        6⤵
        
        PID:4016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2879.exe
        6⤵
        
        PID:5232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20415.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16548.exe
        6⤵
        
        PID:6368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49701.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13091.exe
        5⤵
        
        PID:4020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8744.exe
        5⤵
        
        PID:4668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11750.exe
        5⤵
        
        PID:5756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13.exe
        5⤵
        
        PID:6460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5968.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5968.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36235.exe
        5⤵
        
        PID:2716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35152.exe
        5⤵
        
        PID:3504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2879.exe
        5⤵
        
        PID:4476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54588.exe
        5⤵
        
        PID:6328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3720.exe
        5⤵
        
        PID:6712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64174.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64174.exe
      4⤵
      PID:1672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46088.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46088.exe
      4⤵
      PID:3416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27283.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27283.exe
      4⤵
      PID:5424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7901.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7901.exe
      4⤵
      PID:6496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31593.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31593.exe
      4⤵
      PID:7036
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26088.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26088.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18373.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18373.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51185.exe
        5⤵
        
        PID:2636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31227.exe
        6⤵
        
        PID:2700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35152.exe
        6⤵
        
        PID:3544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2879.exe
        6⤵
        
        PID:4512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20415.exe
        6⤵
        
        PID:5888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57929.exe
        6⤵
        
        PID:6964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9684.exe
        5⤵
        
        PID:2436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54753.exe
        5⤵
        
        PID:3524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-79.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-79.exe
        5⤵
        
        PID:4624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60752.exe
        5⤵
        
        PID:5844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58459.exe
        5⤵
        
        PID:6848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45134.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45134.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13271.exe
        5⤵
        
        PID:2844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12335.exe
        6⤵
        
        PID:4600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54681.exe
        6⤵
        
        PID:2272
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2272 -s 188
        7⤵
        Program crash
        
        PID:5648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38226.exe
        6⤵
        
        PID:6880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57929.exe
        6⤵
        
        PID:6992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49452.exe
        5⤵
        
        PID:3100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10533.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50571.exe
        5⤵
        
        PID:6088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18844.exe
        5⤵
        
        PID:6744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52450.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52450.exe
      4⤵
      PID:2744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7537.exe
        5⤵
        
        PID:2416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27835.exe
        5⤵
        
        PID:3316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2879.exe
        5⤵
        
        PID:4316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20415.exe
        5⤵
        
        PID:5336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57929.exe
        5⤵
        
        PID:6924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56857.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56857.exe
      4⤵
      PID:2228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10291.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10291.exe
      4⤵
      PID:4036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49080.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49080.exe
      4⤵
      PID:4848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12280.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12280.exe
      4⤵
      PID:5612
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58319.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58319.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28627.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28627.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61507.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6205.exe
        5⤵
        
        PID:4616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8744.exe
        5⤵
        
        PID:4740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11750.exe
        5⤵
        
        PID:5952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61377.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61377.exe
      4⤵
      PID:2848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13091.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13091.exe
      4⤵
      PID:1812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8744.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8744.exe
      4⤵
      PID:924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11750.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11750.exe
      4⤵
      PID:5584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13.exe
      4⤵
      PID:6264
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7941.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7941.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4060.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4060.exe
      4⤵
      PID:1932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63187.exe
        5⤵
        
        PID:4084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16398.exe
        5⤵
        
        PID:4380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41906.exe
        5⤵
        
        PID:6024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2309.exe
        5⤵
        
        PID:6684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5819.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5819.exe
      4⤵
      PID:888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5738.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5738.exe
      4⤵
      PID:4032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8744.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8744.exe
      4⤵
      PID:4704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11750.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11750.exe
      4⤵
      PID:5764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13.exe
      4⤵
      PID:6600
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41399.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41399.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63318.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63318.exe
      4⤵
      PID:3536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13330.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13330.exe
      4⤵
      PID:4192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8744.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8744.exe
      4⤵
      PID:4768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11750.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11750.exe
      4⤵
      PID:5264
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-219.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-219.exe
    3⤵
    PID:2356
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3468.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3468.exe
    3⤵
    PID:3236
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44615.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44615.exe
    3⤵
    PID:4812
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50951.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50951.exe
    3⤵
    PID:5936
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35793.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35793.exe
    3⤵
    PID:6172
- C:\Users\Admin\AppData\Local\Temp\Unicorn-9917.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-9917.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2804
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-837.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-837.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22841.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22841.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31668.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10510.exe
        6⤵
        
        PID:2680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45612.exe
        7⤵
        
        PID:3400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65132.exe
        7⤵
        
        PID:4144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2879.exe
        7⤵
        
        PID:4504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20415.exe
        7⤵
        
        PID:5544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57929.exe
        7⤵
        
        PID:6976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52933.exe
        6⤵
        
        PID:3616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19195.exe
        6⤵
        
        PID:3584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-79.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-79.exe
        6⤵
        
        PID:4636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60752.exe
        6⤵
        
        PID:5268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43483.exe
        5⤵
        
        PID:2336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43671.exe
        6⤵
        
        PID:1908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49452.exe
        6⤵
        
        PID:4060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10533.exe
        6⤵
        
        PID:4396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50571.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18844.exe
        6⤵
        
        PID:6736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49409.exe
        5⤵
        
        PID:1520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3515.exe
        5⤵
        
        PID:4052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7733.exe
        5⤵
        
        PID:4412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25370.exe
        5⤵
        
        PID:5984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19374.exe
        5⤵
        
        PID:2200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28330.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28330.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63349.exe
        5⤵
        
        PID:3008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22731.exe
        6⤵
        
        PID:6592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39197.exe
        5⤵
        
        PID:3632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13330.exe
        5⤵
        
        PID:4176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8744.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11750.exe
        5⤵
        
        PID:5976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61303.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61303.exe
      4⤵
      PID:1864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42191.exe
        5⤵
        
        PID:7060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34933.exe
        5⤵
        
        PID:6616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58798.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58798.exe
      4⤵
      PID:3564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10530.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10530.exe
      4⤵
      PID:3232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33157.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33157.exe
      4⤵
      PID:5928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58045.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58045.exe
      4⤵
      PID:6652
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6675.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6675.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44304.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44304.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8637.exe
        5⤵
        
        PID:344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33002.exe
        6⤵
        
        PID:2772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6205.exe
        6⤵
        
        PID:4584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8744.exe
        6⤵
        
        PID:4376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11750.exe
        6⤵
        
        PID:5720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13.exe
        6⤵
        
        PID:6464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5819.exe
        5⤵
        
        PID:2304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5738.exe
        5⤵
        
        PID:3208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8744.exe
        5⤵
        
        PID:4716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11750.exe
        5⤵
        
        PID:5828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46333.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46333.exe
      4⤵
      PID:816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58689.exe
        5⤵
        
        PID:1516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25388.exe
        6⤵
        
        PID:6432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39197.exe
        5⤵
        
        PID:3604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13330.exe
        5⤵
        
        PID:4200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8744.exe
        5⤵
        
        PID:4528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11750.exe
        5⤵
        
        PID:5500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7634.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7634.exe
      4⤵
      PID:1228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17754.exe
        5⤵
        
        PID:940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9175.exe
        5⤵
        
        PID:6160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60729.exe
        5⤵
        
        PID:6180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58798.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58798.exe
      4⤵
      PID:3656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10530.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10530.exe
      4⤵
      PID:4120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49080.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49080.exe
      4⤵
      PID:4792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12280.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12280.exe
      4⤵
      PID:5672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61084.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61084.exe
      4⤵
      PID:6340
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42258.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42258.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55072.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55072.exe
      4⤵
      PID:352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24121.exe
        5⤵
        
        PID:3700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54681.exe
        5⤵
        
        PID:1764
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1764 -s 188
        6⤵
        Program crash
        
        PID:5480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14550.exe
        5⤵
        
        PID:5492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1057.exe
        5⤵
        
        PID:6216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49452.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49452.exe
      4⤵
      PID:3096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10533.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10533.exe
      4⤵
      PID:4464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50571.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50571.exe
      4⤵
      PID:6048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18844.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18844.exe
      4⤵
      PID:6724
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27070.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27070.exe
    3⤵
    PID:2448
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60387.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60387.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3164
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56735.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56735.exe
    3⤵
    PID:4356
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42436.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42436.exe
    3⤵
    PID:6064
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63381.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63381.exe
    3⤵
    PID:6668
- C:\Users\Admin\AppData\Local\Temp\Unicorn-29353.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-29353.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1624
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64449.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64449.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51979.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51979.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27335.exe
        5⤵
        
        PID:840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49452.exe
        5⤵
        
        PID:3108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10533.exe
        5⤵
        
        PID:4456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50571.exe
        5⤵
        
        PID:6080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18844.exe
        5⤵
        
        PID:6700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7661.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7661.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63187.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63187.exe
      4⤵
      PID:4068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16398.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16398.exe
      4⤵
      PID:4448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41906.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41906.exe
      4⤵
      PID:6040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2309.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2309.exe
      4⤵
      PID:6676
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48642.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48642.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-853.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-853.exe
      4⤵
      PID:1108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13240.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11847.exe
        5⤵
        
        PID:3752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2879.exe
        5⤵
        
        PID:996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20415.exe
        5⤵
        
        PID:5800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57929.exe
        5⤵
        
        PID:7032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18154.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18154.exe
      4⤵
      PID:3320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13330.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13330.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8744.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8744.exe
      4⤵
      PID:4736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11750.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11750.exe
      4⤵
      PID:3012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41393.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41393.exe
      4⤵
      PID:6404
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63467.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63467.exe
    3⤵
    PID:1900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30157.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30157.exe
      4⤵
      PID:6296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51462.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51462.exe
      4⤵
      PID:7144
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17381.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17381.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3492
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10530.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10530.exe
    3⤵
    PID:4128
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49080.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49080.exe
    3⤵
    PID:4808
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12280.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12280.exe
    3⤵
    PID:1384
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36928.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36928.exe
    3⤵
    PID:6288
- C:\Users\Admin\AppData\Local\Temp\Unicorn-55519.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-55519.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2372
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24159.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24159.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13271.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13271.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44486.exe
        5⤵
        
        PID:2076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27835.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2879.exe
        5⤵
        
        PID:5136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20415.exe
        5⤵
        
        PID:5620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57929.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49509.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49509.exe
      4⤵
      PID:2596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41571.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41571.exe
      4⤵
      PID:3384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8744.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8744.exe
      4⤵
      PID:4484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11750.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11750.exe
      4⤵
      PID:5556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40469.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40469.exe
      4⤵
      PID:6836
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51927.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51927.exe
    3⤵
    PID:2660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42710.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42710.exe
      4⤵
      PID:5292
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10530.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10530.exe
    3⤵
    PID:3696
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27283.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27283.exe
    3⤵
    PID:5440
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21097.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21097.exe
    3⤵
    PID:6784
- C:\Users\Admin\AppData\Local\Temp\Unicorn-6861.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-6861.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1440
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27875.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27875.exe
    3⤵
    PID:2300
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35619.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35619.exe
    3⤵
    PID:3732
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2879.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2879.exe
    3⤵
    PID:5208
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20415.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20415.exe
    3⤵
    PID:5908
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57929.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57929.exe
    3⤵
    PID:7024
- C:\Users\Admin\AppData\Local\Temp\Unicorn-53107.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-53107.exe
  2⤵
  PID:2576
- C:\Users\Admin\AppData\Local\Temp\Unicorn-17770.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-17770.exe
  2⤵
  PID:3288
- C:\Users\Admin\AppData\Local\Temp\Unicorn-39280.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-39280.exe
  2⤵
  PID:4308
- C:\Users\Admin\AppData\Local\Temp\Unicorn-55151.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-55151.exe
  2⤵
  PID:5476
- C:\Users\Admin\AppData\Local\Temp\Unicorn-8057.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-8057.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6184

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-12366.exe

Filesize
468KB

MD5
d390120d09fe1ca668fc658047481a9f

SHA1
7ab0e38cf5037122cd82fb88008de57fa01654e3

SHA256
464f79cfbb906b31e48863f4f0f70d1d9a5d951f673ba616558e283f3ef5cdc5

SHA512
16754d27b4f2db142a1a3bd4422a1a2f3af451bf2aba54499fe1ed5ec34dd655571dea63c6ab24f937d5f11ce26cd93c11637204d0af96ac1df16f244c88d191

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-26088.exe

Filesize
468KB

MD5
1b7533d1a48cbbba172960995ea6073d

SHA1
7cf402f0d623b4d339946921b69871e27011b133

SHA256
8a25dfa83a67194842d60b1b5279a6fcf36fb1751e88a9ad29cc196f48e3bb3c

SHA512
66ba8740b793ab36e6564bf4a4c216db13e3cf8f6a140458cdbeb4f80d43c053ef97d8b7cc62b7b04c17bc93191baa77aa48a5ddede2bc3abd8ba1e4b7bb12f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-29353.exe

Filesize
468KB

MD5
d7295be5859eadbf8f5d0cf6d14d402c

SHA1
4a56dd9da62fc06516165fab9f9413a318989352

SHA256
9457e67253704fdee05bb71eda330f61876e46f13ae44bd65bf69d60052927cc

SHA512
365d08e0b364943c8d785fdf0c890369b33f1cc69e461f72403eee2f918952481162d226a9b2c35da417b88e0fcd3276cc4f4163bb4e3f75f962aab9f4d1815e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-31547.exe

Filesize
468KB

MD5
bbf0cdaa7b355202817bea0717413bda

SHA1
16ee51b7a64ca94afc6d9e9965f074e21bde14a7

SHA256
a8bdb20b3766a27b37c16b46c102736cc942f66792121858a6fd3a22079b75b8

SHA512
f940664846377c3a7802a33d1201138362294a57cc91762fa9812d1bc0e8e96f4100cefb5288020e4658093bc6c078bdf5c8731196ae947376ac2ae3033d0573

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-44812.exe

Filesize
468KB

MD5
3fb1e93211722a019d51d0f92014f2ec

SHA1
ee7660024d0629b06e32c9da543874d3d1ce0a34

SHA256
0608e14090fd2778746e2d0ffd2b1773cc023d731b8901ddfe60e027350dfcc8

SHA512
6b80f9db301f872aeda40e535370c83709841be781c05f8cf3ee0bbe4dce28971b22e12696277c87a0194485e5c90ba86d824d95efdf0de19bef3b080fb5bf8b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-53359.exe

Filesize
468KB

MD5
6fdfa71a86a50f345b61a597f2149c04

SHA1
9e0e8284c9bbbf4af63926f9326a7a21b5cd3cc8

SHA256
a3f46186aa9347b9f998bc8f791f56bac42f238c4d96655e8daf9d5a69905764

SHA512
0d939a0404c25f8fe631430248d8af17ddc56abf536764b9f913b46e292030e556cccf80e002fd2ab4ded47441cb3b3b14d35049cdd2ae0b55877a10bd5e5cad

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-837.exe

Filesize
468KB

MD5
34556d66c1b7c2ad95ba66ef10fb7952

SHA1
f6b5e7299b684ecb9b794f7684e8c8132c31353b

SHA256
7a6de780772355c06c3224d5323be21b82cb1b7019c7bf5d98cf13dde0c2ae51

SHA512
752c37028a209307a98938d67dd9a4b87013197a5b4dfd7fe7f964526531b809ce28cf08f770a032044736281d9f6affbd9a0e4410f95bb0d0996973542392d5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-9540.exe

Filesize
468KB

MD5
b69b0ab365b8ea56997b858c38ae069d

SHA1
5eabb1de660cd7a69dbb1ede3b53a15e0e2fbc85

SHA256
69d9bbd5acbda0bdbc7cc9631ac6d83c09eb1d6505a274ed8316964f23ecbf9f

SHA512
727f7e305022975f379eef01de49573f28e4e2d3eeab0a20a91bb25bf94f337d7651de68d4ae312c27af4e3c13338fc2e7d409389ebfe1921629fcea7c3c2a61

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-16048.exe

Filesize
468KB

MD5
88b5cc86443429a0194bb09c2a688b3e

SHA1
5795fb8ddf136abb332b032e79364632f9625ba2

SHA256
0f0917ec460fa1dc85a78b15359956178a102b804d4b1801f1f7fa59f2aab97f

SHA512
c9d57fb70a8d30ef03153ee6efa8b7550e45aad0361c1f5472f36de453ff4e35f34652c136cf1d2f28fe8b17926a0e27ca070c96830a070823253fd7c098e131

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-16960.exe

Filesize
468KB

MD5
66dc4525146b295180835dbece4b6c59

SHA1
a969c9c26dff506df5304950e985edbc893f9453

SHA256
f0a46377182e12548bd55dc319feb3db9b7e43c046ecf1db18e6eac79826948e

SHA512
928a104aad1192e2e11b93cc195c799af4c8eec33303ed2f1ebe21ca80da50ea5ee6de1902e72b05754eb4671fd1938d17243497874568bbffba1f9053a3fcd6

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-19403.exe

Filesize
468KB

MD5
95c5ce8e5386d8c9dd9529fa16bfeb0c

SHA1
aac64c5a41fa1257c852a8eb40b8f64944c38caf

SHA256
eecacd1df7e36a5b232f204ad35da8f1534ee864f685fc0b4e5e9d31620bc05d

SHA512
e8dd4bc1793f569b90f74161b37e5b01449c8a5eeea2f47eb692f74de45a9db8bf2068071d9fa782873f64c584d38610ad6828610260ad3aa0524c2182878b11

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-22166.exe

Filesize
468KB

MD5
11b3a940e3ce8436773e79c5a0a81eb8

SHA1
30248bd708a7d7098a4a45fd41cf45a46399d28b

SHA256
1ab3d60ea4e13bb84c41f6a046889c95a0ddd9f2c6768fade9e176f7833b6cb0

SHA512
f09ba26cff4de8efd5af372da434195028cb6842832bc40c8ae70332e39e2a15846deeafb7a356ecc30e45b81f9aed971d548c6247f387f4a5df141514ecf11e

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-29618.exe

Filesize
468KB

MD5
e22508e4bff8be9b68a38e61d6bd6666

SHA1
ec3fa3c910a327d4812c996f09da7cde8ee8c021

SHA256
0b3ed5e4df14b22d6f4f4113da8ee39fab1a66981c6c9ab8ed7f94f5563e9e2d

SHA512
3bbf2c188608cd7914dd4a16db84fb313bd1a8a8fbf084da4bc046a989a4fb359edfb2994fb6c3bf599e82f5a6b34beef7b92410c50bf0a86cce4d21211d47fb

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-37786.exe

Filesize
468KB

MD5
395aba62a5e0ef9a7ec89774eb00e6c9

SHA1
5b81629f8e83959c10a1d94396ad5b44830f5bc3

SHA256
18363efa81f6250b04f8293f1b82846018efbd9b73db8a351e690bf1fea3896f

SHA512
86e205a24060a67d45ba3104b059006623af41c3e6a4c9dde98457c4d864165dac3b230a404ebd83c73473dfac2ed09b547deac96169fbc22ff7d6f6e12160b6

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-43069.exe

Filesize
468KB

MD5
26a0773facd221b2c68faee1088289f8

SHA1
d48e9c30bda03e4fce7f201ed8176fd993446bce

SHA256
59cbd88f11ec90b189dd57be14c5d0c1723e7fa75bc24c1d7f3412f0b86c6117

SHA512
187135795b59e00743f0f4c1a69ff5e3ddd9a9140484c8721f3bf16b592f6170bf06320e25ce2988fa485e3b7e888569b4e85e681390b40628282435d5acea1f

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-43245.exe

Filesize
468KB

MD5
f28f5d843370e5e44ca46d344435dc31

SHA1
0e1d57345659bf35258631e5623da99265cae69f

SHA256
4a662eaf9a8066346e36ec7b945570f484520e640f10799dc610d3cc7d3fb98b

SHA512
4c7e01447cf1ddbfb1b3a9a2fe0a2a05fabca06f53a4d254a86c519723c07d1821a5c016256b5f2d85ff300efce1d3371b616fa6d004daef9835a93349e318b1

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-45107.exe

Filesize
468KB

MD5
d080a4da6f4301a234701f292b601786

SHA1
c73f751c547fc3bc58da7b523c4f1f07f8f5cc5b

SHA256
a85270e659d188725b5efa678e38967864d3041a997f7d2a709f9955491dcbe6

SHA512
b051ca08022d1d0d776b5b7aa05b6ae3294658d65998f11c5248187b66bf067e758398e134e3c06a831a50abbb15eba7f9a816bd5946f6123c0db81f50604e33

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-46940.exe

Filesize
468KB

MD5
84abdf1d1c64693ea6a97211702c815e

SHA1
ea0bf8e43e13f66934db2569ea61a3a9a7cb0089

SHA256
ae0f1de4ae1ce3bd0243bd2c179fe20938d15342b1eea67c6d0c2135491ad1e1

SHA512
75db2d953afba3411a050a5db9f4329340c9a7b1741ef32fd7a85fc88fbf7239a3094f055eb31bcc71167c3a68ad8f5fcafbe313a1fb76a68badaa82f77d7ac7

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-53162.exe

Filesize
468KB

MD5
774aa3733835f3e41cd74e6ff34a85ea

SHA1
9645dc192d8d989040214d77b1b9019e76fb97b2

SHA256
697f9089935bc25258cb65cc67e6ca3bae2a7b491df3035f8ec2760b5d8c646a

SHA512
db09b8146c316cc224fd3ff2b60a34acfb50f14ebbfbb31b365d1388fd1136d802836fcc636e3400dfe142fa3959b6b23d5677e779b9d71348d417b28d1b4969

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-58637.exe

Filesize
468KB

MD5
24cdb42ac807bd09aa7380099f8d68fa

SHA1
29c4430ffb7171846b6014910654df8515be3966

SHA256
57d09497792393cc3532eef29b1e0359a654976af37861a997d2070305248772

SHA512
15b51d381d6ed7c528d5fd8119569dbbb84e69a56034e0b4bc3b82dd652401e2573b7d3af429d9c673a98c7d2a56039538aefd4cddc4292efc4851c393a116ff

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-60972.exe

Filesize
468KB

MD5
75c06484d67140972384bd19664addac

SHA1
0dd91eda76fa62e334b505db716fec6f2abb6e2f

SHA256
8feaaa05d8c397f86640c3cc412d57f3ffcb5b5bbd805f6a9770e7ccab8e4734

SHA512
9a1bc0ec44d927afc1b8a32800c7b80eb893efa0360698148cca5981cfec18ddb98dba257305a8657f095586e9ee5afbab7afaa3e1120f698c06db41c9b4386f

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-9917.exe

Filesize
468KB

MD5
edabd820b4c64b4cfab8f0f13f95e6df

SHA1
01f71d1dc81b9ceec3f9365f140286b7c4a4aba1

SHA256
eed009b073c799ce172ef44cbb42ea0dbbe15aefc2e776db8be47159229e4f4f

SHA512
cfcfe61515ae1d676f59324d52458e84f8ae7dae54869b2010a3b09353e197efa59d8d73298291b77da1d74ac310e436b47efb97d4d61e46a767b0d1f7141af4

Download Submit
memory/372-223-0x00000000024E0000-0x0000000002555000-memory.dmp

Filesize
468KB

Download
memory/372-224-0x00000000024E0000-0x0000000002555000-memory.dmp

Filesize
468KB

Download
memory/392-287-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/488-308-0x0000000002610000-0x0000000002685000-memory.dmp

Filesize
468KB

Download
memory/488-175-0x0000000002610000-0x0000000002685000-memory.dmp

Filesize
468KB

Download
memory/488-307-0x0000000002610000-0x0000000002685000-memory.dmp

Filesize
468KB

Download
memory/488-383-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/488-34-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/488-176-0x0000000002610000-0x0000000002685000-memory.dmp

Filesize
468KB

Download
memory/836-147-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/836-312-0x0000000000540000-0x00000000005B5000-memory.dmp

Filesize
468KB

Download
memory/836-322-0x0000000000540000-0x00000000005B5000-memory.dmp

Filesize
468KB

Download
memory/1356-426-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1372-412-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1380-258-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1592-265-0x0000000002700000-0x0000000002775000-memory.dmp

Filesize
468KB

Download
memory/1592-267-0x0000000002700000-0x0000000002775000-memory.dmp

Filesize
468KB

Download
memory/1592-174-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1624-177-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1624-314-0x00000000027C0000-0x0000000002835000-memory.dmp

Filesize
468KB

Download
memory/1652-243-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1768-408-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1868-149-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1868-280-0x0000000002890000-0x0000000002905000-memory.dmp

Filesize
468KB

Download
memory/1868-278-0x0000000002890000-0x0000000002905000-memory.dmp

Filesize
468KB

Download
memory/1980-238-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/1980-242-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/1980-123-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2008-296-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2012-309-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2224-392-0x0000000002440000-0x00000000024B5000-memory.dmp

Filesize
468KB

Download
memory/2224-388-0x0000000002440000-0x00000000024B5000-memory.dmp

Filesize
468KB

Download
memory/2224-236-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2236-172-0x0000000002840000-0x00000000028B5000-memory.dmp

Filesize
468KB

Download
memory/2236-79-0x0000000002840000-0x00000000028B5000-memory.dmp

Filesize
468KB

Download
memory/2236-346-0x0000000002840000-0x00000000028B5000-memory.dmp

Filesize
468KB

Download
memory/2236-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2236-313-0x0000000002840000-0x00000000028B5000-memory.dmp

Filesize
468KB

Download
memory/2236-318-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2236-319-0x0000000002840000-0x00000000028B5000-memory.dmp

Filesize
468KB

Download
memory/2236-171-0x0000000002840000-0x00000000028B5000-memory.dmp

Filesize
468KB

Download
memory/2236-28-0x0000000003370000-0x00000000033E5000-memory.dmp

Filesize
468KB

Download
memory/2236-6-0x0000000003370000-0x00000000033E5000-memory.dmp

Filesize
468KB

Download
memory/2236-67-0x0000000002840000-0x00000000028B5000-memory.dmp

Filesize
468KB

Download
memory/2288-268-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2360-18-0x0000000002310000-0x0000000002385000-memory.dmp

Filesize
468KB

Download
memory/2360-338-0x0000000002310000-0x0000000002385000-memory.dmp

Filesize
468KB

Download
memory/2360-143-0x0000000002310000-0x0000000002385000-memory.dmp

Filesize
468KB

Download
memory/2360-327-0x0000000002310000-0x0000000002385000-memory.dmp

Filesize
468KB

Download
memory/2360-144-0x0000000002310000-0x0000000002385000-memory.dmp

Filesize
468KB

Download
memory/2360-63-0x0000000002310000-0x0000000002385000-memory.dmp

Filesize
468KB

Download
memory/2360-353-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2360-23-0x0000000002310000-0x0000000002385000-memory.dmp

Filesize
468KB

Download
memory/2372-321-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2396-428-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2396-227-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2496-355-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2504-366-0x0000000002860000-0x00000000028D5000-memory.dmp

Filesize
468KB

Download
memory/2504-359-0x0000000002860000-0x00000000028D5000-memory.dmp

Filesize
468KB

Download
memory/2504-198-0x0000000003390000-0x0000000003405000-memory.dmp

Filesize
468KB

Download
memory/2504-201-0x0000000002860000-0x00000000028D5000-memory.dmp

Filesize
468KB

Download
memory/2540-311-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2548-393-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2612-374-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2728-179-0x00000000028E0000-0x0000000002955000-memory.dmp

Filesize
468KB

Download
memory/2728-84-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2728-173-0x00000000028E0000-0x0000000002955000-memory.dmp

Filesize
468KB

Download
memory/2740-141-0x00000000023C0000-0x0000000002435000-memory.dmp

Filesize
468KB

Download
memory/2740-420-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2740-291-0x00000000023C0000-0x0000000002435000-memory.dmp

Filesize
468KB

Download
memory/2740-64-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2764-281-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2800-372-0x0000000001E10000-0x0000000001E85000-memory.dmp

Filesize
468KB

Download
memory/2804-82-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2804-255-0x0000000002830000-0x00000000028A5000-memory.dmp

Filesize
468KB

Download
memory/2804-256-0x0000000002830000-0x00000000028A5000-memory.dmp

Filesize
468KB

Download
memory/2840-367-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2924-289-0x0000000002870000-0x00000000028E5000-memory.dmp

Filesize
468KB

Download
memory/2924-178-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2924-295-0x0000000002870000-0x00000000028E5000-memory.dmp

Filesize
468KB

Download
memory/2944-202-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2944-352-0x0000000003410000-0x0000000003485000-memory.dmp

Filesize
468KB

Download
memory/2968-49-0x0000000002540000-0x00000000025B5000-memory.dmp

Filesize
468KB

Download
memory/2968-235-0x0000000002540000-0x00000000025B5000-memory.dmp

Filesize
468KB

Download
memory/2968-230-0x0000000002540000-0x00000000025B5000-memory.dmp

Filesize
468KB

Download
memory/2968-103-0x0000000002540000-0x00000000025B5000-memory.dmp

Filesize
468KB

Download
memory/2968-373-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2968-410-0x0000000002540000-0x00000000025B5000-memory.dmp

Filesize
468KB

Download
memory/2968-409-0x0000000002540000-0x00000000025B5000-memory.dmp

Filesize
468KB

Download
memory/2980-328-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2992-51-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2992-382-0x00000000024E0000-0x0000000002555000-memory.dmp

Filesize
468KB

Download
memory/2992-402-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2992-93-0x00000000024E0000-0x0000000002555000-memory.dmp

Filesize
468KB

Download
memory/2992-206-0x00000000024E0000-0x0000000002555000-memory.dmp

Filesize
468KB

Download
memory/3060-384-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download