b3828eaec065fe4a13678d97a6e35ba793fa379083923f2e4dace93b68b8f98f

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
04/10/2024, 03:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b3828eaec065fe4a13678d97a6e35ba793fa379083923f2e4dace93b68b8f98fN.exe
Size

468KB
MD5

895e10cbc5e933d8ffcbbba1523a8900
SHA1

dd0444c7880e231d47049c6c44734740340f9e84
SHA256

b3828eaec065fe4a13678d97a6e35ba793fa379083923f2e4dace93b68b8f98f
SHA512

1a07e653864246a8ada2f442f7efdcbdfe26da78e3378e5500f54fb9fd9112501bf8bb624cd3d67c19e8275f13a79f2db1fd9608b560d92c8dd4af212c6742a7
SSDEEP

3072:PfSCzgsMS08U2bYW3z3Crfc/YAZ3K7IpCNmHBJVpvEXg33kgNpUDF:PfvzL5U213DCrfL0txEXe0gNp

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
1588	Unicorn-27127.exe
2592	Unicorn-47817.exe
2776	Unicorn-51346.exe
2948	Unicorn-53785.exe
2480	Unicorn-56800.exe
2916	Unicorn-50670.exe
1960	Unicorn-17391.exe
1428	Unicorn-47252.exe
2688	Unicorn-30039.exe
2704	Unicorn-30039.exe
2828	Unicorn-10173.exe
2348	Unicorn-6804.exe
1020	Unicorn-58606.exe
1932	Unicorn-12934.exe
1684	Unicorn-12669.exe
2068	Unicorn-20722.exe
348	Unicorn-55890.exe
2036	Unicorn-49760.exe
1524	Unicorn-34187.exe
1680	Unicorn-50332.exe
1436	Unicorn-1323.exe
2984	Unicorn-21189.exe
1852	Unicorn-40021.exe
1384	Unicorn-33890.exe
552	Unicorn-59491.exe
2008	Unicorn-59756.exe
1172	Unicorn-49866.exe
1540	Unicorn-6310.exe
2588	Unicorn-26368.exe
2844	Unicorn-35422.exe
3000	Unicorn-37145.exe
2484	Unicorn-14162.exe
2472	Unicorn-16083.exe
2624	Unicorn-31904.exe
2732	Unicorn-32611.exe
568	Unicorn-51386.exe
1332	Unicorn-58769.exe
540	Unicorn-45034.exe
2680	Unicorn-34401.exe
1916	Unicorn-34474.exe
1924	Unicorn-14608.exe
1968	Unicorn-34209.exe
1716	Unicorn-50810.exe
1460	Unicorn-60897.exe
2324	Unicorn-37053.exe
2860	Unicorn-63403.exe
2340	Unicorn-3996.exe
2060	Unicorn-4188.exe
2300	Unicorn-4188.exe
944	Unicorn-60795.exe
1300	Unicorn-23761.exe
1556	Unicorn-10026.exe
1272	Unicorn-25489.exe
888	Unicorn-47380.exe
1308	Unicorn-45927.exe
2908	Unicorn-39797.exe
2088	Unicorn-9341.exe
2848	Unicorn-15485.exe
2572	Unicorn-32087.exe
1576	Unicorn-44732.exe
1972	Unicorn-18382.exe
2188	Unicorn-63669.exe
2332	Unicorn-20302.exe
1800	Unicorn-31271.exe

Loads dropped DLL 64 IoCs

pid	Process
2656	b3828eaec065fe4a13678d97a6e35ba793fa379083923f2e4dace93b68b8f98fN.exe
2656	b3828eaec065fe4a13678d97a6e35ba793fa379083923f2e4dace93b68b8f98fN.exe
1588	Unicorn-27127.exe
1588	Unicorn-27127.exe
2656	b3828eaec065fe4a13678d97a6e35ba793fa379083923f2e4dace93b68b8f98fN.exe
2656	b3828eaec065fe4a13678d97a6e35ba793fa379083923f2e4dace93b68b8f98fN.exe
2592	Unicorn-47817.exe
2592	Unicorn-47817.exe
2776	Unicorn-51346.exe
2776	Unicorn-51346.exe
2656	b3828eaec065fe4a13678d97a6e35ba793fa379083923f2e4dace93b68b8f98fN.exe
2656	b3828eaec065fe4a13678d97a6e35ba793fa379083923f2e4dace93b68b8f98fN.exe
1588	Unicorn-27127.exe
1588	Unicorn-27127.exe
2948	Unicorn-53785.exe
2948	Unicorn-53785.exe
2480	Unicorn-56800.exe
1960	Unicorn-17391.exe
2480	Unicorn-56800.exe
1960	Unicorn-17391.exe
2592	Unicorn-47817.exe
2592	Unicorn-47817.exe
1588	Unicorn-27127.exe
2776	Unicorn-51346.exe
2776	Unicorn-51346.exe
1588	Unicorn-27127.exe
2656	b3828eaec065fe4a13678d97a6e35ba793fa379083923f2e4dace93b68b8f98fN.exe
2916	Unicorn-50670.exe
2656	b3828eaec065fe4a13678d97a6e35ba793fa379083923f2e4dace93b68b8f98fN.exe
2916	Unicorn-50670.exe
2828	Unicorn-10173.exe
2828	Unicorn-10173.exe
1428	Unicorn-47252.exe
2592	Unicorn-47817.exe
2592	Unicorn-47817.exe
1428	Unicorn-47252.exe
1960	Unicorn-17391.exe
1960	Unicorn-17391.exe
2948	Unicorn-53785.exe
2948	Unicorn-53785.exe
2916	Unicorn-50670.exe
2916	Unicorn-50670.exe
2140	WerFault.exe
2140	WerFault.exe
2140	WerFault.exe
2140	WerFault.exe
1020	Unicorn-58606.exe
1020	Unicorn-58606.exe
2776	Unicorn-51346.exe
2348	Unicorn-6804.exe
2348	Unicorn-6804.exe
2776	Unicorn-51346.exe
1588	Unicorn-27127.exe
1684	Unicorn-12669.exe
1588	Unicorn-27127.exe
1684	Unicorn-12669.exe
2656	b3828eaec065fe4a13678d97a6e35ba793fa379083923f2e4dace93b68b8f98fN.exe
2656	b3828eaec065fe4a13678d97a6e35ba793fa379083923f2e4dace93b68b8f98fN.exe
2140	WerFault.exe
2704	Unicorn-30039.exe
2704	Unicorn-30039.exe
2068	Unicorn-20722.exe
2068	Unicorn-20722.exe
2480	Unicorn-56800.exe

Program crash 4 IoCs

pid	pid_target	Process	procid_target
2140	1932	WerFault.exe	42
2620	2844	WerFault.exe	58
2868	2924	WerFault.exe	112
7028	6004	WerFault.exe	513

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1963.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22700.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34344.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16083.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63403.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7520.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4631.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29259.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29030.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7828.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37037.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1323.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34474.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9341.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33635.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40396.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41373.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49689.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6261.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35401.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10456.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3384.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17353.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42301.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30253.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30039.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33635.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65336.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38793.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15121.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42301.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5052.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30253.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52839.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32611.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45640.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11569.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44486.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7401.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53785.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9189.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63170.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30253.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35666.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39481.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56373.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33002.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29930.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35215.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26481.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57261.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15889.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63170.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44412.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35999.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-647.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31032.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63170.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42637.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50670.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33635.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4188.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5615.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54452.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2656	b3828eaec065fe4a13678d97a6e35ba793fa379083923f2e4dace93b68b8f98fN.exe
1588	Unicorn-27127.exe
2592	Unicorn-47817.exe
2776	Unicorn-51346.exe
2948	Unicorn-53785.exe
1960	Unicorn-17391.exe
2916	Unicorn-50670.exe
2480	Unicorn-56800.exe
1428	Unicorn-47252.exe
2688	Unicorn-30039.exe
2704	Unicorn-30039.exe
2828	Unicorn-10173.exe
1932	Unicorn-12934.exe
1020	Unicorn-58606.exe
2348	Unicorn-6804.exe
1684	Unicorn-12669.exe
2068	Unicorn-20722.exe
1524	Unicorn-34187.exe
2036	Unicorn-49760.exe
348	Unicorn-55890.exe
1436	Unicorn-1323.exe
1680	Unicorn-50332.exe
2984	Unicorn-21189.exe
2008	Unicorn-59756.exe
1384	Unicorn-33890.exe
1852	Unicorn-40021.exe
552	Unicorn-59491.exe
1172	Unicorn-49866.exe
1540	Unicorn-6310.exe
2588	Unicorn-26368.exe
2844	Unicorn-35422.exe
3000	Unicorn-37145.exe
2484	Unicorn-14162.exe
2472	Unicorn-16083.exe
2624	Unicorn-31904.exe
2732	Unicorn-32611.exe
568	Unicorn-51386.exe
1716	Unicorn-50810.exe
540	Unicorn-45034.exe
2680	Unicorn-34401.exe
1916	Unicorn-34474.exe
1332	Unicorn-58769.exe
1924	Unicorn-14608.exe
1968	Unicorn-34209.exe
1460	Unicorn-60897.exe
2324	Unicorn-37053.exe
2860	Unicorn-63403.exe
2340	Unicorn-3996.exe
2060	Unicorn-4188.exe
2300	Unicorn-4188.exe
944	Unicorn-60795.exe
1300	Unicorn-23761.exe
1556	Unicorn-10026.exe
1272	Unicorn-25489.exe
888	Unicorn-47380.exe
2088	Unicorn-9341.exe
1308	Unicorn-45927.exe
2908	Unicorn-39797.exe
2572	Unicorn-32087.exe
1576	Unicorn-44732.exe
1972	Unicorn-18382.exe
2848	Unicorn-15485.exe
2188	Unicorn-63669.exe
2332	Unicorn-20302.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2656 wrote to memory of 1588	2656	b3828eaec065fe4a13678d97a6e35ba793fa379083923f2e4dace93b68b8f98fN.exe	28
PID 2656 wrote to memory of 1588	2656	b3828eaec065fe4a13678d97a6e35ba793fa379083923f2e4dace93b68b8f98fN.exe	28
PID 2656 wrote to memory of 1588	2656	b3828eaec065fe4a13678d97a6e35ba793fa379083923f2e4dace93b68b8f98fN.exe	28
PID 2656 wrote to memory of 1588	2656	b3828eaec065fe4a13678d97a6e35ba793fa379083923f2e4dace93b68b8f98fN.exe	28
PID 1588 wrote to memory of 2776	1588	Unicorn-27127.exe	29
PID 1588 wrote to memory of 2776	1588	Unicorn-27127.exe	29
PID 1588 wrote to memory of 2776	1588	Unicorn-27127.exe	29
PID 1588 wrote to memory of 2776	1588	Unicorn-27127.exe	29
PID 2656 wrote to memory of 2592	2656	b3828eaec065fe4a13678d97a6e35ba793fa379083923f2e4dace93b68b8f98fN.exe	30
PID 2656 wrote to memory of 2592	2656	b3828eaec065fe4a13678d97a6e35ba793fa379083923f2e4dace93b68b8f98fN.exe	30
PID 2656 wrote to memory of 2592	2656	b3828eaec065fe4a13678d97a6e35ba793fa379083923f2e4dace93b68b8f98fN.exe	30
PID 2656 wrote to memory of 2592	2656	b3828eaec065fe4a13678d97a6e35ba793fa379083923f2e4dace93b68b8f98fN.exe	30
PID 2592 wrote to memory of 2948	2592	Unicorn-47817.exe	31
PID 2592 wrote to memory of 2948	2592	Unicorn-47817.exe	31
PID 2592 wrote to memory of 2948	2592	Unicorn-47817.exe	31
PID 2592 wrote to memory of 2948	2592	Unicorn-47817.exe	31
PID 2776 wrote to memory of 2480	2776	Unicorn-51346.exe	32
PID 2776 wrote to memory of 2480	2776	Unicorn-51346.exe	32
PID 2776 wrote to memory of 2480	2776	Unicorn-51346.exe	32
PID 2776 wrote to memory of 2480	2776	Unicorn-51346.exe	32
PID 2656 wrote to memory of 2916	2656	b3828eaec065fe4a13678d97a6e35ba793fa379083923f2e4dace93b68b8f98fN.exe	33
PID 2656 wrote to memory of 2916	2656	b3828eaec065fe4a13678d97a6e35ba793fa379083923f2e4dace93b68b8f98fN.exe	33
PID 2656 wrote to memory of 2916	2656	b3828eaec065fe4a13678d97a6e35ba793fa379083923f2e4dace93b68b8f98fN.exe	33
PID 2656 wrote to memory of 2916	2656	b3828eaec065fe4a13678d97a6e35ba793fa379083923f2e4dace93b68b8f98fN.exe	33
PID 1588 wrote to memory of 1960	1588	Unicorn-27127.exe	34
PID 1588 wrote to memory of 1960	1588	Unicorn-27127.exe	34
PID 1588 wrote to memory of 1960	1588	Unicorn-27127.exe	34
PID 1588 wrote to memory of 1960	1588	Unicorn-27127.exe	34
PID 2948 wrote to memory of 1428	2948	Unicorn-53785.exe	35
PID 2948 wrote to memory of 1428	2948	Unicorn-53785.exe	35
PID 2948 wrote to memory of 1428	2948	Unicorn-53785.exe	35
PID 2948 wrote to memory of 1428	2948	Unicorn-53785.exe	35
PID 2480 wrote to memory of 2704	2480	Unicorn-56800.exe	36
PID 2480 wrote to memory of 2704	2480	Unicorn-56800.exe	36
PID 2480 wrote to memory of 2704	2480	Unicorn-56800.exe	36
PID 2480 wrote to memory of 2704	2480	Unicorn-56800.exe	36
PID 1960 wrote to memory of 2688	1960	Unicorn-17391.exe	37
PID 1960 wrote to memory of 2688	1960	Unicorn-17391.exe	37
PID 1960 wrote to memory of 2688	1960	Unicorn-17391.exe	37
PID 1960 wrote to memory of 2688	1960	Unicorn-17391.exe	37
PID 2592 wrote to memory of 2828	2592	Unicorn-47817.exe	38
PID 2592 wrote to memory of 2828	2592	Unicorn-47817.exe	38
PID 2592 wrote to memory of 2828	2592	Unicorn-47817.exe	38
PID 2592 wrote to memory of 2828	2592	Unicorn-47817.exe	38
PID 2776 wrote to memory of 1020	2776	Unicorn-51346.exe	40
PID 2776 wrote to memory of 1020	2776	Unicorn-51346.exe	40
PID 2776 wrote to memory of 1020	2776	Unicorn-51346.exe	40
PID 2776 wrote to memory of 1020	2776	Unicorn-51346.exe	40
PID 1588 wrote to memory of 2348	1588	Unicorn-27127.exe	39
PID 1588 wrote to memory of 2348	1588	Unicorn-27127.exe	39
PID 1588 wrote to memory of 2348	1588	Unicorn-27127.exe	39
PID 1588 wrote to memory of 2348	1588	Unicorn-27127.exe	39
PID 2656 wrote to memory of 1684	2656	b3828eaec065fe4a13678d97a6e35ba793fa379083923f2e4dace93b68b8f98fN.exe	41
PID 2656 wrote to memory of 1684	2656	b3828eaec065fe4a13678d97a6e35ba793fa379083923f2e4dace93b68b8f98fN.exe	41
PID 2656 wrote to memory of 1684	2656	b3828eaec065fe4a13678d97a6e35ba793fa379083923f2e4dace93b68b8f98fN.exe	41
PID 2656 wrote to memory of 1684	2656	b3828eaec065fe4a13678d97a6e35ba793fa379083923f2e4dace93b68b8f98fN.exe	41
PID 2916 wrote to memory of 1932	2916	Unicorn-50670.exe	42
PID 2916 wrote to memory of 1932	2916	Unicorn-50670.exe	42
PID 2916 wrote to memory of 1932	2916	Unicorn-50670.exe	42
PID 2916 wrote to memory of 1932	2916	Unicorn-50670.exe	42
PID 2828 wrote to memory of 2068	2828	Unicorn-10173.exe	43
PID 2828 wrote to memory of 2068	2828	Unicorn-10173.exe	43
PID 2828 wrote to memory of 2068	2828	Unicorn-10173.exe	43
PID 2828 wrote to memory of 2068	2828	Unicorn-10173.exe	43

C:\Users\Admin\AppData\Local\Temp\b3828eaec065fe4a13678d97a6e35ba793fa379083923f2e4dace93b68b8f98fN.exe
"C:\Users\Admin\AppData\Local\Temp\b3828eaec065fe4a13678d97a6e35ba793fa379083923f2e4dace93b68b8f98fN.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2656
- C:\Users\Admin\AppData\Local\Temp\Unicorn-27127.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-27127.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1588
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51346.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51346.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56800.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56800.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30039.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6310.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47380.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26348.exe
        8⤵
        
        PID:1660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47867.exe
        9⤵
        
        PID:3712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-634.exe
        9⤵
        
        PID:4384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36436.exe
        9⤵
        
        PID:5524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14409.exe
        9⤵
        
        PID:6672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61826.exe
        8⤵
        
        PID:3356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14369.exe
        8⤵
        
        PID:4348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33002.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39601.exe
        8⤵
        
        PID:7040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8786.exe
        7⤵
        
        PID:1708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10456.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10024.exe
        7⤵
        
        PID:3540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20234.exe
        7⤵
        
        PID:5012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33635.exe
        7⤵
        
        PID:5616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6121.exe
        7⤵
        
        PID:6188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39797.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44412.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17431.exe
        8⤵
        
        PID:7044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61058.exe
        7⤵
        
        PID:3632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14369.exe
        7⤵
        
        PID:4568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42301.exe
        7⤵
        
        PID:5512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21587.exe
        7⤵
        
        PID:6580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55600.exe
        6⤵
        
        PID:2212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8568.exe
        6⤵
        
        PID:3880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60571.exe
        6⤵
        
        PID:4420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34166.exe
        6⤵
        
        PID:5436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-587.exe
        6⤵
        
        PID:6440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35422.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2844
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2844 -s 240
        6⤵
        Program crash
        
        PID:2620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15485.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28728.exe
        6⤵
        
        PID:1452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38860.exe
        6⤵
        
        PID:4060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14369.exe
        6⤵
        
        PID:4988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42301.exe
        6⤵
        
        PID:5676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29930.exe
        6⤵
        
        PID:5224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6149.exe
        5⤵
        
        PID:2352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34796.exe
        5⤵
        
        PID:3600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37211.exe
        5⤵
        
        PID:2856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17858.exe
        5⤵
        
        PID:5784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30173.exe
        5⤵
        
        PID:6768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58606.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58606.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:1020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21189.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14162.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18382.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58688.exe
        8⤵
        
        PID:2208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63170.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14369.exe
        8⤵
        
        PID:4436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42301.exe
        8⤵
        
        PID:5296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22656.exe
        8⤵
        
        PID:6268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38822.exe
        7⤵
        
        PID:2460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58461.exe
        7⤵
        
        PID:3132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11569.exe
        7⤵
        
        PID:4016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17100.exe
        7⤵
        
        PID:5548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25465.exe
        7⤵
        
        PID:6296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63669.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6425.exe
        7⤵
        
        PID:884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11368.exe
        7⤵
        
        PID:3928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20234.exe
        7⤵
        
        PID:5004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33635.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38793.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22521.exe
        6⤵
        
        PID:600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15889.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11569.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17100.exe
        6⤵
        
        PID:5368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3970.exe
        6⤵
        
        PID:932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31904.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18465.exe
        6⤵
        
        PID:1720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42819.exe
        7⤵
        
        PID:1484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55920.exe
        8⤵
        
        PID:7076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63170.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14369.exe
        7⤵
        
        PID:4444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42301.exe
        7⤵
        
        PID:5492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21587.exe
        7⤵
        
        PID:6624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62266.exe
        6⤵
        
        PID:2788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35666.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53765.exe
        7⤵
        
        PID:4136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56373.exe
        7⤵
        
        PID:4712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52340.exe
        7⤵
        
        PID:6092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22924.exe
        6⤵
        
        PID:3092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7828.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53573.exe
        6⤵
        
        PID:572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50950.exe
        6⤵
        
        PID:5244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35215.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35666.exe
        6⤵
        
        PID:2024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53765.exe
        6⤵
        
        PID:4104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56373.exe
        6⤵
        
        PID:5144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41521.exe
        6⤵
        
        PID:5896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5615.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28790.exe
        5⤵
        
        PID:1712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64700.exe
        5⤵
        
        PID:3160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37037.exe
        5⤵
        
        PID:5136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29419.exe
        5⤵
        
        PID:5920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33890.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33890.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51386.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24241.exe
        6⤵
        
        PID:2120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16604.exe
        7⤵
        
        PID:3040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-634.exe
        7⤵
        
        PID:5048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36436.exe
        7⤵
        
        PID:5452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12105.exe
        7⤵
        
        PID:6148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19044.exe
        6⤵
        
        PID:3792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54325.exe
        6⤵
        
        PID:4724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39312.exe
        6⤵
        
        PID:5952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21587.exe
        6⤵
        
        PID:6488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4183.exe
        5⤵
        
        PID:2084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62859.exe
        6⤵
        
        PID:4080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-634.exe
        6⤵
        
        PID:4476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36436.exe
        6⤵
        
        PID:5464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63994.exe
        6⤵
        
        PID:6888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65260.exe
        5⤵
        
        PID:3716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26397.exe
        5⤵
        
        PID:4592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26505.exe
        5⤵
        
        PID:5388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5052.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34401.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34401.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50338.exe
        5⤵
        
        PID:2700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29703.exe
        6⤵
        
        PID:4824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22700.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58129.exe
        6⤵
        
        PID:6840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8169.exe
        5⤵
        
        PID:3984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20234.exe
        5⤵
        
        PID:5076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33635.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54746.exe
        5⤵
        
        PID:6660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47376.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47376.exe
      4⤵
      PID:1936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41968.exe
        5⤵
        
        PID:1872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34344.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41373.exe
        6⤵
        
        PID:6652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63170.exe
        5⤵
        
        PID:3800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14369.exe
        5⤵
        
        PID:3992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42301.exe
        5⤵
        
        PID:5568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22656.exe
        5⤵
        
        PID:6196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17353.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17353.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57643.exe
        5⤵
        
        PID:3496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21600.exe
        5⤵
        
        PID:4560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34870.exe
        5⤵
        
        PID:5352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29930.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27266.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27266.exe
      4⤵
      PID:2196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43699.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43699.exe
      4⤵
      PID:4148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27237.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27237.exe
      4⤵
      PID:5160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26179.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26179.exe
      4⤵
      PID:6116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12598.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12598.exe
      4⤵
      PID:6576
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17391.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17391.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30039.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30039.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25489.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33123.exe
        6⤵
        
        PID:2404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63170.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14369.exe
        6⤵
        
        PID:4328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42301.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29930.exe
        6⤵
        
        PID:6156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34202.exe
        5⤵
        
        PID:960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8568.exe
        5⤵
        
        PID:3848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60571.exe
        5⤵
        
        PID:4576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34166.exe
        5⤵
        
        PID:5440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-587.exe
        5⤵
        
        PID:6500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34187.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34187.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37053.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12730.exe
        6⤵
        
        PID:2516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35666.exe
        7⤵
        
        PID:2356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53765.exe
        7⤵
        
        PID:3996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56373.exe
        7⤵
        
        PID:2132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52340.exe
        7⤵
        
        PID:5268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9189.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1963.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62238.exe
        6⤵
        
        PID:4704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65336.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44066.exe
        6⤵
        
        PID:7100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9009.exe
        5⤵
        
        PID:992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8093.exe
        6⤵
        
        PID:4264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46794.exe
        6⤵
        
        PID:5856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30253.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17294.exe
        5⤵
        
        PID:3856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20234.exe
        5⤵
        
        PID:4336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33635.exe
        5⤵
        
        PID:5428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5052.exe
        5⤵
        
        PID:6476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63403.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63403.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46363.exe
        5⤵
        
        PID:2760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5629.exe
        6⤵
        
        PID:2448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61507.exe
        6⤵
        
        PID:3252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14369.exe
        6⤵
        
        PID:4188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42301.exe
        6⤵
        
        PID:5588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22656.exe
        6⤵
        
        PID:6256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49464.exe
        5⤵
        
        PID:2236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29030.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20234.exe
        5⤵
        
        PID:4484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33635.exe
        5⤵
        
        PID:5596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27658.exe
        5⤵
        
        PID:5812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52839.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28802.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28802.exe
      4⤵
      PID:2096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32032.exe
        5⤵
        
        PID:3748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9601.exe
        5⤵
        
        PID:4684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36436.exe
        5⤵
        
        PID:5456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63994.exe
        5⤵
        
        PID:6896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46316.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46316.exe
      4⤵
      PID:3812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1056.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1056.exe
      4⤵
      PID:4668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31177.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31177.exe
      4⤵
      PID:5960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-587.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-587.exe
      4⤵
      PID:6344
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6804.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6804.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40021.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40021.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32611.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7520.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45640.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38860.exe
        7⤵
        
        PID:3080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14369.exe
        7⤵
        
        PID:4948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42301.exe
        7⤵
        
        PID:5540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21587.exe
        7⤵
        
        PID:6420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58063.exe
        6⤵
        
        PID:1620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52596.exe
        6⤵
        
        PID:4040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20234.exe
        6⤵
        
        PID:5032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33635.exe
        6⤵
        
        PID:5636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52442.exe
        6⤵
        
        PID:5272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39678.exe
        5⤵
        
        PID:948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24249.exe
        5⤵
        
        PID:868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60061.exe
        6⤵
        
        PID:6472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15121.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11569.exe
        5⤵
        
        PID:4408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17100.exe
        5⤵
        
        PID:5304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57753.exe
        5⤵
        
        PID:6392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45034.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45034.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56965.exe
        5⤵
        
        PID:2336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64120.exe
        6⤵
        
        PID:2304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-634.exe
        6⤵
        
        PID:4400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36436.exe
        6⤵
        
        PID:5476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63994.exe
        6⤵
        
        PID:6880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61826.exe
        5⤵
        
        PID:3516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14369.exe
        5⤵
        
        PID:4428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42301.exe
        5⤵
        
        PID:5732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29930.exe
        5⤵
        
        PID:6140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-866.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-866.exe
      4⤵
      PID:112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35666.exe
        5⤵
        
        PID:852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53765.exe
        5⤵
        
        PID:3228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56373.exe
        5⤵
        
        PID:4764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50420.exe
        5⤵
        
        PID:2736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35401.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35401.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64700.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64700.exe
      4⤵
      PID:3216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37037.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37037.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48845.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48845.exe
      4⤵
      PID:2720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58298.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58298.exe
      4⤵
      PID:6828
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59491.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59491.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3996.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3996.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12590.exe
        5⤵
        
        PID:2748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16856.exe
        6⤵
        
        PID:5864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41373.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63170.exe
        5⤵
        
        PID:3752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14369.exe
        5⤵
        
        PID:5068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42301.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2371.exe
        5⤵
        
        PID:6244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40994.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40994.exe
      4⤵
      PID:1880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44486.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44486.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11569.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11569.exe
      4⤵
      PID:5092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17100.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17100.exe
      4⤵
      PID:5316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3970.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3970.exe
      4⤵
      PID:2536
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60795.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60795.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22761.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22761.exe
      4⤵
      PID:1320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35666.exe
        5⤵
        
        PID:1632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53765.exe
        5⤵
        
        PID:4120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56373.exe
        5⤵
        
        PID:2744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41521.exe
        5⤵
        
        PID:5880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5615.exe
        5⤵
        
        PID:6964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22924.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22924.exe
      4⤵
      PID:1616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7828.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7828.exe
      4⤵
      PID:4164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53573.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53573.exe
      4⤵
      PID:4788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31779.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31779.exe
      4⤵
      PID:5208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63000.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63000.exe
      4⤵
      PID:6360
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3845.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3845.exe
    3⤵
    PID:1648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57259.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57259.exe
      4⤵
      PID:3556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21600.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21600.exe
      4⤵
      PID:4544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34870.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34870.exe
      4⤵
      PID:5360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5744.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5744.exe
      4⤵
      PID:6860
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20654.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20654.exe
    3⤵
    PID:688
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43699.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43699.exe
    3⤵
    PID:4208
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27237.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27237.exe
    3⤵
    PID:5152
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26179.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26179.exe
    3⤵
    PID:6108
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12598.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12598.exe
    3⤵
    PID:6468
- C:\Users\Admin\AppData\Local\Temp\Unicorn-47817.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-47817.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2592
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53785.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53785.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47252.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47252.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:1428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55890.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4188.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43151.exe
        7⤵
        
        PID:1876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10761.exe
        8⤵
        
        PID:4640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52960.exe
        8⤵
        
        PID:5908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58129.exe
        8⤵
        
        PID:6832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61058.exe
        7⤵
        
        PID:3648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14369.exe
        7⤵
        
        PID:4600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42301.exe
        7⤵
        
        PID:5604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30423.exe
        7⤵
        
        PID:6604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38822.exe
        6⤵
        
        PID:2928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26481.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38860.exe
        7⤵
        
        PID:904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14369.exe
        7⤵
        
        PID:4144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34088.exe
        7⤵
        
        PID:5924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39850.exe
        7⤵
        
        PID:6416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6261.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58461.exe
        6⤵
        
        PID:4032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11569.exe
        6⤵
        
        PID:4960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17100.exe
        6⤵
        
        PID:5252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7401.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10026.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55922.exe
        6⤵
        
        PID:2328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55022.exe
        7⤵
        
        PID:2364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1963.exe
        7⤵
        
        PID:4312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62238.exe
        7⤵
        
        PID:2380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32855.exe
        7⤵
        
        PID:5876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54617.exe
        7⤵
        
        PID:6976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-647.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7828.exe
        6⤵
        
        PID:4224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53573.exe
        6⤵
        
        PID:2584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50950.exe
        6⤵
        
        PID:5228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50835.exe
        5⤵
        
        PID:1728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11061.exe
        6⤵
        
        PID:4068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25745.exe
        6⤵
        
        PID:4660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36436.exe
        6⤵
        
        PID:5504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46466.exe
        6⤵
        
        PID:6220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15889.exe
        5⤵
        
        PID:3564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11569.exe
        5⤵
        
        PID:4508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17100.exe
        5⤵
        
        PID:5564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55859.exe
        5⤵
        
        PID:6740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50332.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50332.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16083.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20302.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27258.exe
        7⤵
        
        PID:1896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38621.exe
        7⤵
        
        PID:3624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27458.exe
        7⤵
        
        PID:5840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3970.exe
        7⤵
        
        PID:2832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35999.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57259.exe
        7⤵
        
        PID:3548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20234.exe
        7⤵
        
        PID:4392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33635.exe
        7⤵
        
        PID:5652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13747.exe
        7⤵
        
        PID:6428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39261.exe
        6⤵
        
        PID:3120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7828.exe
        6⤵
        
        PID:4216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53573.exe
        6⤵
        
        PID:1984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48800.exe
        6⤵
        
        PID:6032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61132.exe
        6⤵
        
        PID:6312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31271.exe
        5⤵
        Executes dropped EXE
        
        PID:1800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52718.exe
        6⤵
        
        PID:1328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45747.exe
        6⤵
        
        PID:3144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14369.exe
        6⤵
        
        PID:5024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42301.exe
        6⤵
        
        PID:5700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54452.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31294.exe
        5⤵
        
        PID:2496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15570.exe
        5⤵
        
        PID:3256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11569.exe
        5⤵
        
        PID:4472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17100.exe
        5⤵
        
        PID:5372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22117.exe
        5⤵
        
        PID:6432
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58769.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58769.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29259.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2924
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2924 -s 220
        6⤵
        Program crash
        
        PID:2868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9189.exe
        5⤵
        
        PID:1860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1963.exe
        5⤵
        
        PID:4288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62238.exe
        5⤵
        
        PID:5128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65336.exe
        5⤵
        
        PID:6056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44066.exe
        5⤵
        
        PID:7068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31298.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31298.exe
      4⤵
      PID:1412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31032.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40396.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39481.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44194.exe
        5⤵
        
        PID:5788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35773.exe
        5⤵
        
        PID:6776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26735.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26735.exe
      4⤵
      PID:2280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48164.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48164.exe
      4⤵
      PID:4112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54103.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54103.exe
      4⤵
      PID:5196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44335.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44335.exe
      4⤵
      PID:6016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34266.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34266.exe
      4⤵
      PID:7120
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10173.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10173.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20722.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20722.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26368.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45927.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18126.exe
        7⤵
        
        PID:2440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59971.exe
        7⤵
        
        PID:3652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14369.exe
        7⤵
        
        PID:4204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42301.exe
        7⤵
        
        PID:5708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3440.exe
        7⤵
        
        PID:6168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32852.exe
        6⤵
        
        PID:2708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59482.exe
        6⤵
        
        PID:3140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53573.exe
        6⤵
        
        PID:4744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31779.exe
        6⤵
        
        PID:6124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14292.exe
        6⤵
        
        PID:6796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9341.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46216.exe
        6⤵
        
        PID:1488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15295.exe
        6⤵
        
        PID:3704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14369.exe
        6⤵
        
        PID:5108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42301.exe
        6⤵
        
        PID:5716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29930.exe
        6⤵
        
        PID:5996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39510.exe
        5⤵
        
        PID:2940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58461.exe
        5⤵
        
        PID:4092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11569.exe
        5⤵
        
        PID:5100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17100.exe
        5⤵
        
        PID:5308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3970.exe
        5⤵
        
        PID:5600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37145.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37145.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32087.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56965.exe
        6⤵
        
        PID:2316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6512.exe
        7⤵
        
        PID:3968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-634.exe
        7⤵
        
        PID:4516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52859.exe
        7⤵
        
        PID:5780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52309.exe
        7⤵
        
        PID:6812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61826.exe
        6⤵
        
        PID:3260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62238.exe
        6⤵
        
        PID:4676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48315.exe
        6⤵
        
        PID:6096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45934.exe
        6⤵
        
        PID:6396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52668.exe
        5⤵
        
        PID:2168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19592.exe
        6⤵
        
        PID:4820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25552.exe
        6⤵
        
        PID:5948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21367.exe
        6⤵
        
        PID:6632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10024.exe
        5⤵
        
        PID:3576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20234.exe
        5⤵
        
        PID:4996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33635.exe
        5⤵
        
        PID:5620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52442.exe
        5⤵
        
        PID:920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44732.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44732.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55865.exe
        5⤵
        
        PID:2640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63170.exe
        5⤵
        
        PID:3868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14369.exe
        5⤵
        
        PID:5056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42301.exe
        5⤵
        
        PID:5724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21587.exe
        5⤵
        
        PID:6408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58423.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58423.exe
      4⤵
      PID:864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53765.exe
        5⤵
        
        PID:4256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56373.exe
        5⤵
        
        PID:4800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52340.exe
        5⤵
        
        PID:6064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33260.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33260.exe
      4⤵
      PID:3164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12099.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12099.exe
      4⤵
      PID:4968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12635.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12635.exe
      4⤵
      PID:5420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61858.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61858.exe
      4⤵
      PID:6288
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49760.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49760.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34474.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34474.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50338.exe
        5⤵
        
        PID:2664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28507.exe
        6⤵
        
        PID:4772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55482.exe
        6⤵
        
        PID:5820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24387.exe
        6⤵
        
        PID:6456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22526.exe
        5⤵
        
        PID:3932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14369.exe
        5⤵
        
        PID:4580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42301.exe
        5⤵
        
        PID:5768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4675.exe
        5⤵
        
        PID:6752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46425.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46425.exe
      4⤵
      PID:2548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8093.exe
        5⤵
        
        PID:4280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42637.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35656.exe
        5⤵
        
        PID:5828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14280.exe
        5⤵
        
        PID:6932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59941.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59941.exe
      4⤵
      PID:3696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27466.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27466.exe
      4⤵
      PID:4520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28617.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28617.exe
      4⤵
      PID:5516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5052.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5052.exe
      4⤵
      PID:6516
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34209.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34209.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44059.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44059.exe
      4⤵
      PID:1432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45391.exe
        5⤵
        
        PID:3184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53765.exe
        5⤵
        
        PID:3232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56373.exe
        5⤵
        
        PID:4784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56980.exe
        5⤵
        
        PID:6132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13762.exe
        5⤵
        
        PID:6784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8805.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8805.exe
      4⤵
      PID:3220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1963.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1963.exe
      4⤵
      PID:4176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62238.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62238.exe
      4⤵
      PID:4696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65336.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65336.exe
      4⤵
      PID:6060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27346.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27346.exe
      4⤵
      PID:7000
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21781.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21781.exe
    3⤵
    PID:2660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-258.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-258.exe
      4⤵
      PID:1516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63170.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63170.exe
      4⤵
      PID:3900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14369.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14369.exe
      4⤵
      PID:4012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42301.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42301.exe
      4⤵
      PID:5752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29930.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29930.exe
      4⤵
      PID:6176
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11248.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11248.exe
    3⤵
    PID:1168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53765.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53765.exe
      4⤵
      PID:4088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56373.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56373.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57694.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57694.exe
      4⤵
      PID:7084
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9098.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9098.exe
    3⤵
    PID:3916
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56105.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56105.exe
    3⤵
    PID:4368
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7300.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7300.exe
    3⤵
    PID:5384
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-521.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-521.exe
    3⤵
    PID:6208
- C:\Users\Admin\AppData\Local\Temp\Unicorn-50670.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-50670.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2916
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12934.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12934.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1932
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1932 -s 240
      4⤵
      Loads dropped DLL
      Program crash
      PID:2140
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1323.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1323.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4188.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4188.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17282.exe
        5⤵
        
        PID:1608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35666.exe
        6⤵
        
        PID:2408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53765.exe
        6⤵
        
        PID:4128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56373.exe
        6⤵
        
        PID:4840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41521.exe
        6⤵
        
        PID:5904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57241.exe
        6⤵
        
        PID:7004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53890.exe
        5⤵
        
        PID:3592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27466.exe
        5⤵
        
        PID:4536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59069.exe
        5⤵
        
        PID:5328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63812.exe
        5⤵
        
        PID:7108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3384.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3384.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55022.exe
        5⤵
        
        PID:2816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61507.exe
        5⤵
        
        PID:3244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14369.exe
        5⤵
        
        PID:4452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42301.exe
        5⤵
        
        PID:5744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55329.exe
        5⤵
        
        PID:6684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14382.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14382.exe
      4⤵
      PID:2344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34896.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34896.exe
      4⤵
      PID:3736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11569.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11569.exe
      4⤵
      PID:4372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17100.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17100.exe
      4⤵
      PID:5580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22117.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22117.exe
      4⤵
      PID:6560
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23761.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23761.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50338.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50338.exe
      4⤵
      PID:2668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29055.exe
        5⤵
        
        PID:3176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53765.exe
        5⤵
        
        PID:4240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56373.exe
        5⤵
        
        PID:4836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41521.exe
        5⤵
        
        PID:5944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60602.exe
        5⤵
        
        PID:7060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9189.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9189.exe
      4⤵
      PID:3108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1963.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1963.exe
      4⤵
      PID:4304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62238.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62238.exe
      4⤵
      PID:4716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36297.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36297.exe
      4⤵
      PID:5184
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49689.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49689.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10293.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10293.exe
      4⤵
      PID:3876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56373.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56373.exe
      4⤵
      PID:4796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36387.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36387.exe
      4⤵
      PID:2220
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23124.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23124.exe
    3⤵
    PID:3604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48861.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48861.exe
      4⤵
      PID:3128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8641.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8641.exe
      4⤵
      PID:4756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3680.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3680.exe
      4⤵
      PID:5832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30253.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30253.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6616
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19330.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19330.exe
    3⤵
    PID:4552
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6273.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6273.exe
    3⤵
    PID:5344
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28993.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28993.exe
    3⤵
    PID:6692
- C:\Users\Admin\AppData\Local\Temp\Unicorn-12669.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-12669.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:1684
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59756.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59756.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53960.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53960.exe
      4⤵
      PID:1908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58688.exe
        5⤵
        
        PID:2812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63170.exe
        5⤵
        
        PID:3764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14369.exe
        5⤵
        
        PID:4980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42301.exe
        5⤵
        
        PID:5668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19283.exe
        5⤵
        
        PID:4656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52558.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52558.exe
      4⤵
      PID:2804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28214.exe
        5⤵
        
        PID:6236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17233.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17233.exe
      4⤵
      PID:3836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11569.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11569.exe
      4⤵
      PID:4464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17100.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17100.exe
      4⤵
      PID:5500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23186.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23186.exe
      4⤵
      PID:6320
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14608.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14608.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13031.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13031.exe
      4⤵
      PID:2040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-258.exe
        5⤵
        
        PID:1600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21763.exe
        6⤵
        
        PID:3520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20234.exe
        6⤵
        
        PID:5040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33635.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52442.exe
        6⤵
        
        PID:5260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15800.exe
        5⤵
        
        PID:664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1963.exe
        5⤵
        
        PID:4272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62238.exe
        5⤵
        
        PID:4692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5884.exe
        5⤵
        
        PID:4652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16848.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16848.exe
      4⤵
      PID:2684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25834.exe
        5⤵
        
        PID:6036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49916.exe
        5⤵
        
        PID:6356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11368.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11368.exe
      4⤵
      PID:3944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20234.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20234.exe
      4⤵
      PID:4360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51154.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51154.exe
      4⤵
      PID:5936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31308.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31308.exe
      4⤵
      PID:6748
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55142.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55142.exe
    3⤵
    PID:292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6128.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6128.exe
      4⤵
      PID:4000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-634.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-634.exe
      4⤵
      PID:4496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36436.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36436.exe
      4⤵
      PID:5484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30253.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30253.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6508
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23160.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23160.exe
    3⤵
    PID:3888
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11569.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11569.exe
    3⤵
    PID:4608
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17100.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17100.exe
    3⤵
    PID:5556
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6274.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6274.exe
    3⤵
    PID:6732
- C:\Users\Admin\AppData\Local\Temp\Unicorn-49866.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-49866.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1172
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50810.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50810.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13031.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13031.exe
      4⤵
      PID:1200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44638.exe
        5⤵
        
        PID:772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57261.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53573.exe
        5⤵
        
        PID:4732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16320.exe
        5⤵
        
        PID:5980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61132.exe
        5⤵
        
        PID:6336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62266.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62266.exe
      4⤵
      PID:3056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58461.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58461.exe
      4⤵
      PID:4024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11569.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11569.exe
      4⤵
      PID:5084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17100.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17100.exe
      4⤵
      PID:5284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19813.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19813.exe
      4⤵
      PID:5808
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24193.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24193.exe
    3⤵
    PID:616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16071.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16071.exe
      4⤵
      PID:1572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24885.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24885.exe
      4⤵
      PID:3664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14369.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14369.exe
      4⤵
      PID:4200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42301.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42301.exe
      4⤵
      PID:5404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29930.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29930.exe
      4⤵
      PID:2388
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30827.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30827.exe
    3⤵
    PID:896
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14034.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14034.exe
    3⤵
    PID:3960
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11569.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11569.exe
    3⤵
    PID:5116
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17100.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17100.exe
    3⤵
    PID:5376
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3970.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3970.exe
    3⤵
    PID:5276
- C:\Users\Admin\AppData\Local\Temp\Unicorn-60897.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-60897.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1460
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43208.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43208.exe
    3⤵
    PID:1448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29055.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29055.exe
      4⤵
      PID:3192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53765.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53765.exe
      4⤵
      PID:4248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56373.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56373.exe
      4⤵
      PID:1672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36387.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36387.exe
      4⤵
      PID:6028
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53890.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53890.exe
    3⤵
    PID:3580
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27466.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27466.exe
    3⤵
    PID:4528
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59069.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59069.exe
    3⤵
    PID:5320
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6121.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6121.exe
    3⤵
    PID:6300
- C:\Users\Admin\AppData\Local\Temp\Unicorn-4631.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-4631.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2268
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35666.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35666.exe
    3⤵
    PID:2000
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53765.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53765.exe
    3⤵
    PID:4052
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56373.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56373.exe
    3⤵
    PID:1792
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41521.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41521.exe
    3⤵
    PID:5868
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5615.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5615.exe
    3⤵
    PID:6972
- C:\Users\Admin\AppData\Local\Temp\Unicorn-5735.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-5735.exe
  2⤵
  PID:1668
- C:\Users\Admin\AppData\Local\Temp\Unicorn-38364.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-38364.exe
  2⤵
  PID:4156
- C:\Users\Admin\AppData\Local\Temp\Unicorn-31437.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-31437.exe
  2⤵
  PID:5188
- C:\Users\Admin\AppData\Local\Temp\Unicorn-15465.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-15465.exe
  2⤵
  PID:6004
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 6004 -s 188
    3⤵
    - Program crash
    PID:7028
- C:\Users\Admin\AppData\Local\Temp\Unicorn-58067.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-58067.exe
  2⤵
  PID:6380

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-12934.exe

Filesize
468KB

MD5
a8298268f1265de27aefdc690084cc84

SHA1
b419dcd71920ec1b00e129225198b537ec503132

SHA256
240e3ad311327b3d02197f50aabe831c828193dfbce70561b9f0a316bf9f41f2

SHA512
eeb9b85730634738f071363aa55c10519c694052cc25a974f1428e1b277045159d0b0ef177cff0dc60a958c62d0be2ef15647c281c756de7b09202daa99cae8b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-17391.exe

Filesize
468KB

MD5
2a9dfaf1de8d1a3201f5f3dcb1e14381

SHA1
add31937884f49b5de7a3bc79a57377d757b42ad

SHA256
044749172f2bed3de336df3cdd0489dd25c98380cbeb66321ca24e1d6348273a

SHA512
94dea8b01723294a13fd80fd6c59b7f4d1b3aad67ba4c5d7a6a1880355478a9854d44a4697ad697c1cebf28548c853202575b670798149c060ef0ded5dc7c3f3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-30039.exe

Filesize
468KB

MD5
8eef7c02196c7150ffb61edb5aff9660

SHA1
43957e4fb158e8c3ea6779b6c4fdbcf2813f68dc

SHA256
bcd91a175d94639e7cac4333086019373b4c504cc55423ca0067882b71b535d3

SHA512
b26cc6563f1a6acd594e556adb92d075d5a9229485fa8c2cffce0692919d66f651109cd575a8e4038fb3bbd7b83f214e9bd94ff9586cff7b3b29056d70e46a16

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39678.exe

Filesize
468KB

MD5
4c374d19cbb30f4e678c98b25d71819a

SHA1
47d5cf1f1139cc47c93112a587ec0bc88fae18e2

SHA256
fe65524c3b7c78ecb7c8b499a7ab1aba19c21f381942f6dd308abcb95df155ca

SHA512
d6f17d552d97cd0bc019104168f1f7046c208cb27302fb2597776db909baf617acbd0325c7daab909d3177fe7767184aae623fccd4e0fbddcc9159d24805ce77

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-47817.exe

Filesize
468KB

MD5
064dd384a252f2137a62cc2957a75f92

SHA1
127fd996519a112bf74f2c0f76563559d47fa608

SHA256
6b1992ca14383d4ad874e4f4cb7ebc0c30657efd402dcd1b04c6f2131fb2f278

SHA512
9532f13de12c87722e752fb40de42afb50d343d6167c2ee3810ccb7347fbfb1522b2a09ccfaa0eb51573c0ef2e1f6e29a2317054a27900cdbd5901d9c8e9f353

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-50670.exe

Filesize
468KB

MD5
4dc8cdd496c2a48c34bf38123bcc0856

SHA1
52f91bf4d78bbdd14b340f6f01d4fa59dc8ea079

SHA256
7ae1ebf98bc3c98dd5558cda31558e510e1dac288b6d5fce20783751cebf763b

SHA512
5bb8f968009413d216a98758001895bf523ce71ec20068f7a985bdacb916ba2fbc2b02c6eb42aa485d6e614a12e28f09e13c942fe708ffab4066d44302357c43

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-55890.exe

Filesize
468KB

MD5
e13b349018c9ebf3c3b9aafe0d3e8cef

SHA1
05611fd7a6d13a41c77cba3d0930490a3919fd56

SHA256
2bc44a0ea5e4bd1233556c132b554884a1594a2db9742c58afa77e24bb6a9381

SHA512
9223381d22bd31a759d1e5ac81d1ddfa9e3fbe9195ef7b114d8b6e09c5e1a544c83eaf3a8f531468f9b1a8fe3a8396663ebffbd391ade74e4c774a4d2bef7441

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-61858.exe

Filesize
468KB

MD5
b458dfd6fa601546e681465b40a4f1ee

SHA1
6ea1da6a18c9fdc0124db951811b3b8ba253e58f

SHA256
cbef4048beb3845c679031dc5f85fdc8e1e9cdedfe31de8a73a5438d6552f506

SHA512
fd276cc96e1b643369c15ed20e7173089074cd8425ef9e325e77a2fd39d079333b333dc3ca01d6bb14ff2bd57deccc54e9c42baf61eb77cc16971d15d726eabc

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-10173.exe

Filesize
468KB

MD5
335ef53e74e907e5f1c777107cfa2e1e

SHA1
ebadc9857dbfb3920b97c60f7805e4f94379d8a9

SHA256
eb630a5e4031e57cad9eab8924e4ba0c0b7969fbb4a7237bb1ab65245307c5b9

SHA512
cce07959d1a8c6317e37bb6686c9cb04ce2ccc43a38101ac07d99a11baf786300078d77bb1f2408c6546a0bdaa63eef1dff8c54ba6a46e62b3faf0c050e4c746

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-12669.exe

Filesize
468KB

MD5
9b368e24d410c6d92d693a9fe32f0772

SHA1
691c4c403eb84fff3865e5f85ea7c9abee30e908

SHA256
bba48159c800252334d53b3ff4a02a8259ee7f963a4286811b771a933f7e5dfd

SHA512
4a507121ac112adb50a33358c655d1f23683e2339bcb4e514adeda1d11c2d5ff5a01a484c681cfd9eee1248972e37fe85f8dd6449f7e27dba1f2c34f0cc15b77

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-20722.exe

Filesize
468KB

MD5
f2b4e32b81e25efa978d9cf099b61bf7

SHA1
39f6321c5780b680339042e07ecfd537065bc0a6

SHA256
6395947c5c5d87a7d1081e5bbd2bf3087dad32e889b83107c2f64ae85c7040ef

SHA512
ee8b63f5bb07da6760f9155293dedd643d267647f14144bb1acaa1142003a537fc45e5e5f2664b3e83b859da80892fdd1687e5365724f776801b62ff276a5991

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-27127.exe

Filesize
468KB

MD5
a7fb60234dc070831a0371d0867911eb

SHA1
56ac4f1c5d79e96ceb99f297f2880c9f6f9ec2f6

SHA256
99a25aac977b5829cffc8acd637b1341fb18bc6137b2ff92fdb3c1e0ef0233b1

SHA512
430e79cfba3152e8d87c96debc7d0c2c59807bcfbd82d3bff8ab619647672456c36ed651522ebb8c945d09f13c5ee4d878a78676c5115108e78ec7c5912f7c3f

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-47252.exe

Filesize
468KB

MD5
04a5a0a4415d8d460cb5e6e8a4487780

SHA1
ad85dbfb88340bc033ad67f2eb6788f7f2c0f028

SHA256
97915cf8dde779077e9b6a61d73bd057313564297482e0dffb12f9f16587dd62

SHA512
e8ee6a103d6e61a3a19f9f87421ea5cf60ac98ad2cc4136a36e5a40af0319b5ddf2a58db4d427dd9b1b5131eff3120c2c60f485271ded6221b7cf351732167f7

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-49760.exe

Filesize
468KB

MD5
17deb48516122a08f28b9c2522088d83

SHA1
e00b37bdaa87a044eee561393e2a4006e9345427

SHA256
244c78641301d7f3790aeace12347758197e18d4fd44b9ec43095f5ec7ba1a4a

SHA512
ae5003d09c6118087cb927cca5f71f0a466979a3b3e5f746cfc7ca9d90f88954e79c479906e998aa15d02f14c79e7afc801df8734ea0a817d5443981900ec212

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-51346.exe

Filesize
468KB

MD5
c15e270a4ee972625de770adc8b5ab6a

SHA1
149773fcf8bef4c38d89ab3913bdc283edecbb56

SHA256
6b19d333ebe35d5b175689b428caeec95e8eb7f836afe14092e9473d3a121249

SHA512
a01e48e6a9bfb06077f5456c4735fb693c1be3f303935557b8fc2cc23cc52b2b5bb8584c313bda64b94a6f14bdb6401432e102f45bf231fa4cffd83f61b300cc

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-53785.exe

Filesize
468KB

MD5
b42bf601faddc373e3857177174f57f4

SHA1
0172a5b20d32c014921cc663340521e64643eb5e

SHA256
81665d60a4299476f13583e554c3fc763a8535a0f45a79ebdf39ef87c1eab3a0

SHA512
5a089b32e20ec7144184a2622c678ce6f00cf262326b417120bb41ca8ccc1b90db2807bb567c1dabc1a392ec1e5bcbfa9666a1c75ab3d560582ae0370ce4b5ae

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-56800.exe

Filesize
468KB

MD5
f8ed383965497e8bbfad8a7eca794ec5

SHA1
fdb0f8705de00e4059e9b9a746e9dff2b0a8548c

SHA256
f04312e07d99081ff46acab807dee43dc1ac5206fa60d91c4430fe4c00803058

SHA512
aa9289481c724d1816802252fad0d7dde912f8e233d752e83e86dcc32b5053d03e875238b70445463d4b853f0a9f835633a27dfa5230ddc4f92a2285aa1a8cfc

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-58606.exe

Filesize
468KB

MD5
c83205abb0980a58cb6350048c28fe8a

SHA1
0375d9e6675b66f131956b6df71fa1c10a03a73b

SHA256
1b4ec9c30babe6061d8c57643a6f1a55eb1f9dab3a10b88dc312c2164c418ffb

SHA512
d8e41554d173565a6035f4741e44ad4cddb38c68f158a72ab44cc7fe8b47d99f19c1459a4893235d02d37fe25437f9e53d834029226e65cac22506800d73e780

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-6804.exe

Filesize
468KB

MD5
130df829788eb103d00927e31770d92e

SHA1
9529beb75fea86771415d48a38e2bda8806c2ab0

SHA256
45365e36c82e208ab29745002977823fc0539c2a06e39f812e0ea981d618da25

SHA512
74f3fdf7f72669104c0e10602ad53d2aee510ac3e23c36cdae1f340b2f95ca1a34095a8455b6145f0c4dacc994279067379c11a0fd8973cd64b31e23eb249eff

Download Submit
memory/348-218-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/540-419-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/552-288-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/568-417-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1020-257-0x00000000028B0000-0x0000000002925000-memory.dmp

Filesize
468KB

Download
memory/1020-253-0x00000000028B0000-0x0000000002925000-memory.dmp

Filesize
468KB

Download
memory/1020-150-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1172-311-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1332-414-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1384-284-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1384-416-0x00000000028D0000-0x0000000002945000-memory.dmp

Filesize
468KB

Download
memory/1428-216-0x0000000000370000-0x00000000003E5000-memory.dmp

Filesize
468KB

Download
memory/1428-213-0x0000000000370000-0x00000000003E5000-memory.dmp

Filesize
468KB

Download
memory/1436-250-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1524-228-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1540-323-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1588-372-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/1588-286-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/1588-23-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/1588-357-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1588-26-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/1588-144-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/1588-285-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/1588-146-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/1680-236-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1680-370-0x00000000024D0000-0x0000000002545000-memory.dmp

Filesize
468KB

Download
memory/1684-172-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1684-287-0x0000000001E70000-0x0000000001EE5000-memory.dmp

Filesize
468KB

Download
memory/1684-292-0x0000000001E70000-0x0000000001EE5000-memory.dmp

Filesize
468KB

Download
memory/1852-275-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1932-170-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1960-226-0x0000000002910000-0x0000000002985000-memory.dmp

Filesize
468KB

Download
memory/1960-227-0x0000000002910000-0x0000000002985000-memory.dmp

Filesize
468KB

Download
memory/1960-80-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2008-295-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2036-219-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2068-332-0x0000000002BE0000-0x0000000002C55000-memory.dmp

Filesize
468KB

Download
memory/2068-192-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2348-278-0x0000000000560000-0x00000000005D5000-memory.dmp

Filesize
468KB

Download
memory/2348-276-0x0000000000560000-0x00000000005D5000-memory.dmp

Filesize
468KB

Download
memory/2348-411-0x0000000000560000-0x00000000005D5000-memory.dmp

Filesize
468KB

Download
memory/2348-147-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2348-415-0x0000000000560000-0x00000000005D5000-memory.dmp

Filesize
468KB

Download
memory/2472-371-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2480-343-0x00000000025B0000-0x0000000002625000-memory.dmp

Filesize
468KB

Download
memory/2480-66-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2480-344-0x00000000025B0000-0x0000000002625000-memory.dmp

Filesize
468KB

Download
memory/2484-364-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2588-333-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2592-119-0x0000000001DE0000-0x0000000001E55000-memory.dmp

Filesize
468KB

Download
memory/2592-388-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2592-32-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2592-418-0x0000000001DE0000-0x0000000001E55000-memory.dmp

Filesize
468KB

Download
memory/2592-117-0x0000000001DE0000-0x0000000001E55000-memory.dmp

Filesize
468KB

Download
memory/2592-215-0x0000000001DE0000-0x0000000001E55000-memory.dmp

Filesize
468KB

Download
memory/2592-214-0x0000000001DE0000-0x0000000001E55000-memory.dmp

Filesize
468KB

Download
memory/2592-51-0x0000000001DE0000-0x0000000001E55000-memory.dmp

Filesize
468KB

Download
memory/2624-380-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2656-331-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2656-6-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2656-301-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2656-153-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2656-310-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2656-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2656-161-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2688-108-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2704-321-0x00000000024D0000-0x0000000002545000-memory.dmp

Filesize
468KB

Download
memory/2704-322-0x00000000024D0000-0x0000000002545000-memory.dmp

Filesize
468KB

Download
memory/2732-390-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2776-280-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2776-58-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2776-389-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2776-148-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2776-145-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2776-274-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2776-34-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2828-190-0x0000000002640000-0x00000000026B5000-memory.dmp

Filesize
468KB

Download
memory/2828-352-0x0000000002640000-0x00000000026B5000-memory.dmp

Filesize
468KB

Download
memory/2828-189-0x0000000002640000-0x00000000026B5000-memory.dmp

Filesize
468KB

Download
memory/2828-121-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2844-345-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2916-156-0x0000000002120000-0x0000000002195000-memory.dmp

Filesize
468KB

Download
memory/2916-72-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2916-251-0x0000000002120000-0x0000000002195000-memory.dmp

Filesize
468KB

Download
memory/2916-249-0x0000000002120000-0x0000000002195000-memory.dmp

Filesize
468KB

Download
memory/2916-168-0x0000000002120000-0x0000000002195000-memory.dmp

Filesize
468KB

Download
memory/2948-52-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2948-410-0x0000000002640000-0x00000000026B5000-memory.dmp

Filesize
468KB

Download
memory/2948-413-0x0000000002640000-0x00000000026B5000-memory.dmp

Filesize
468KB

Download
memory/2948-96-0x0000000002640000-0x00000000026B5000-memory.dmp

Filesize
468KB

Download
memory/2948-95-0x0000000002640000-0x00000000026B5000-memory.dmp

Filesize
468KB

Download
memory/2948-235-0x0000000002640000-0x00000000026B5000-memory.dmp

Filesize
468KB

Download
memory/2948-237-0x0000000002640000-0x00000000026B5000-memory.dmp

Filesize
468KB

Download
memory/2984-260-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2984-363-0x00000000024B0000-0x0000000002525000-memory.dmp

Filesize
468KB

Download
memory/3000-351-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download