3bca3ac4209af2e5cc117e9c43a9247cb4dda9937df6c31f2fc0cd70158ada42

Analysis

max time kernel
150s
max time network
121s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
05/10/2024, 20:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3bca3ac4209af2e5cc117e9c43a9247cb4dda9937df6c31f2fc0cd70158ada42.exe
Size

468KB
MD5

0ce063677cb19a84fb528292e69a5abd
SHA1

d2402716a0f04198afcb20e1cc73c2ebc123744f
SHA256

3bca3ac4209af2e5cc117e9c43a9247cb4dda9937df6c31f2fc0cd70158ada42
SHA512

c5ba3e71e99be84c232bd129a47d6bc5dbb9473b829247127944f1efbf316bdb50524262ef1698fad9a579bc0abf1c2424aed24451141e5af749bae4d7907f2f
SSDEEP

3072:tuvaogWwzf8u2bYo8zrj1fr/9mu8rrpjPmHevVGNca/3Gpf++Flz:tuyocku2L83j1fyVNEca/uf++

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2216	Unicorn-11242.exe
2788	Unicorn-1211.exe
2688	Unicorn-59135.exe
1200	Unicorn-32021.exe
2620	Unicorn-11408.exe
2572	Unicorn-14101.exe
264	Unicorn-9362.exe
2100	Unicorn-39203.exe
868	Unicorn-54148.exe
2672	Unicorn-26951.exe
540	Unicorn-14598.exe
1936	Unicorn-38134.exe
1736	Unicorn-4947.exe
2016	Unicorn-34626.exe
1788	Unicorn-34361.exe
1564	Unicorn-18830.exe
1660	Unicorn-23468.exe
268	Unicorn-55586.exe
1604	Unicorn-20867.exe
1452	Unicorn-61808.exe
2468	Unicorn-9846.exe
1884	Unicorn-45856.exe
352	Unicorn-25436.exe
560	Unicorn-5570.exe
2272	Unicorn-25436.exe
2032	Unicorn-38872.exe
1516	Unicorn-41672.exe
3068	Unicorn-47802.exe
1636	Unicorn-47537.exe
2128	Unicorn-47802.exe
2144	Unicorn-32020.exe
2744	Unicorn-51777.exe
2736	Unicorn-37941.exe
1692	Unicorn-45555.exe
2864	Unicorn-1106.exe
2256	Unicorn-31741.exe
772	Unicorn-56992.exe
2836	Unicorn-3707.exe
1920	Unicorn-11320.exe
2900	Unicorn-31640.exe
2996	Unicorn-46131.exe
1252	Unicorn-37771.exe
3036	Unicorn-52161.exe
2200	Unicorn-17085.exe
448	Unicorn-59514.exe
1276	Unicorn-40293.exe
828	Unicorn-40293.exe
1236	Unicorn-7.exe
832	Unicorn-19873.exe
2348	Unicorn-64797.exe
1616	Unicorn-39331.exe
2476	Unicorn-4720.exe
1852	Unicorn-58575.exe
568	Unicorn-38709.exe
2356	Unicorn-27849.exe
2780	Unicorn-20235.exe
2576	Unicorn-55159.exe
2604	Unicorn-61289.exe
2180	Unicorn-34647.exe
2584	Unicorn-34382.exe
2904	Unicorn-42907.exe
1860	Unicorn-49037.exe
2300	Unicorn-12643.exe
2948	Unicorn-1590.exe

Loads dropped DLL 64 IoCs

pid	Process
1780	3bca3ac4209af2e5cc117e9c43a9247cb4dda9937df6c31f2fc0cd70158ada42.exe
1780	3bca3ac4209af2e5cc117e9c43a9247cb4dda9937df6c31f2fc0cd70158ada42.exe
2216	Unicorn-11242.exe
2216	Unicorn-11242.exe
1780	3bca3ac4209af2e5cc117e9c43a9247cb4dda9937df6c31f2fc0cd70158ada42.exe
1780	3bca3ac4209af2e5cc117e9c43a9247cb4dda9937df6c31f2fc0cd70158ada42.exe
2788	Unicorn-1211.exe
2788	Unicorn-1211.exe
2216	Unicorn-11242.exe
2688	Unicorn-59135.exe
2216	Unicorn-11242.exe
2688	Unicorn-59135.exe
1780	3bca3ac4209af2e5cc117e9c43a9247cb4dda9937df6c31f2fc0cd70158ada42.exe
1780	3bca3ac4209af2e5cc117e9c43a9247cb4dda9937df6c31f2fc0cd70158ada42.exe
1200	Unicorn-32021.exe
1200	Unicorn-32021.exe
2788	Unicorn-1211.exe
2788	Unicorn-1211.exe
2572	Unicorn-14101.exe
2572	Unicorn-14101.exe
2620	Unicorn-11408.exe
2620	Unicorn-11408.exe
2216	Unicorn-11242.exe
2216	Unicorn-11242.exe
2688	Unicorn-59135.exe
2688	Unicorn-59135.exe
264	Unicorn-9362.exe
264	Unicorn-9362.exe
1780	3bca3ac4209af2e5cc117e9c43a9247cb4dda9937df6c31f2fc0cd70158ada42.exe
1780	3bca3ac4209af2e5cc117e9c43a9247cb4dda9937df6c31f2fc0cd70158ada42.exe
2100	Unicorn-39203.exe
2100	Unicorn-39203.exe
1200	Unicorn-32021.exe
1200	Unicorn-32021.exe
868	Unicorn-54148.exe
868	Unicorn-54148.exe
2788	Unicorn-1211.exe
2788	Unicorn-1211.exe
2672	Unicorn-26951.exe
2672	Unicorn-26951.exe
2572	Unicorn-14101.exe
2572	Unicorn-14101.exe
2016	Unicorn-34626.exe
2016	Unicorn-34626.exe
1788	Unicorn-34361.exe
1788	Unicorn-34361.exe
264	Unicorn-9362.exe
264	Unicorn-9362.exe
1736	Unicorn-4947.exe
1736	Unicorn-4947.exe
1780	3bca3ac4209af2e5cc117e9c43a9247cb4dda9937df6c31f2fc0cd70158ada42.exe
1780	3bca3ac4209af2e5cc117e9c43a9247cb4dda9937df6c31f2fc0cd70158ada42.exe
2688	Unicorn-59135.exe
2216	Unicorn-11242.exe
540	Unicorn-14598.exe
2620	Unicorn-11408.exe
1936	Unicorn-38134.exe
2688	Unicorn-59135.exe
2216	Unicorn-11242.exe
540	Unicorn-14598.exe
2620	Unicorn-11408.exe
1936	Unicorn-38134.exe
1564	Unicorn-18830.exe
1564	Unicorn-18830.exe

Program crash 4 IoCs

pid	pid_target	Process	procid_target
3636	3480	WerFault.exe	281
3632	3528	WerFault.exe	280
3656	3428	WerFault.exe	282
3872	3516	WerFault.exe	283

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6839.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53752.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48715.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46058.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54657.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5669.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42886.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2109.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9796.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18345.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48258.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46115.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60560.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25122.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65307.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7526.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5521.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44988.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8999.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42374.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6930.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12265.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40704.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28691.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50581.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12265.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6763.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3722.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26951.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8837.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54530.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65307.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49668.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25384.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8780.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34028.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47411.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54102.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19772.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-974.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30497.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21403.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55159.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5434.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11299.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33917.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11599.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49668.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48258.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28438.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52776.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55194.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52724.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50581.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37941.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59514.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24528.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6530.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41506.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9796.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9796.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49833.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39203.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
1780	3bca3ac4209af2e5cc117e9c43a9247cb4dda9937df6c31f2fc0cd70158ada42.exe
2216	Unicorn-11242.exe
2788	Unicorn-1211.exe
2688	Unicorn-59135.exe
1200	Unicorn-32021.exe
2572	Unicorn-14101.exe
2620	Unicorn-11408.exe
264	Unicorn-9362.exe
2100	Unicorn-39203.exe
868	Unicorn-54148.exe
2672	Unicorn-26951.exe
1736	Unicorn-4947.exe
2016	Unicorn-34626.exe
540	Unicorn-14598.exe
1788	Unicorn-34361.exe
1936	Unicorn-38134.exe
1564	Unicorn-18830.exe
1660	Unicorn-23468.exe
268	Unicorn-55586.exe
1604	Unicorn-20867.exe
1452	Unicorn-61808.exe
2468	Unicorn-9846.exe
1884	Unicorn-45856.exe
2272	Unicorn-25436.exe
560	Unicorn-5570.exe
352	Unicorn-25436.exe
3068	Unicorn-47802.exe
1636	Unicorn-47537.exe
2032	Unicorn-38872.exe
1516	Unicorn-41672.exe
2144	Unicorn-32020.exe
2128	Unicorn-47802.exe
2744	Unicorn-51777.exe
2736	Unicorn-37941.exe
1692	Unicorn-45555.exe
2864	Unicorn-1106.exe
772	Unicorn-56992.exe
1920	Unicorn-11320.exe
2256	Unicorn-31741.exe
2836	Unicorn-3707.exe
2900	Unicorn-31640.exe
2996	Unicorn-46131.exe
1252	Unicorn-37771.exe
3036	Unicorn-52161.exe
2200	Unicorn-17085.exe
448	Unicorn-59514.exe
828	Unicorn-40293.exe
832	Unicorn-19873.exe
1276	Unicorn-40293.exe
2348	Unicorn-64797.exe
1236	Unicorn-7.exe
1616	Unicorn-39331.exe
2476	Unicorn-4720.exe
2780	Unicorn-20235.exe
2576	Unicorn-55159.exe
1852	Unicorn-58575.exe
2584	Unicorn-34382.exe
2604	Unicorn-61289.exe
2180	Unicorn-34647.exe
2356	Unicorn-27849.exe
568	Unicorn-38709.exe
1860	Unicorn-49037.exe
2904	Unicorn-42907.exe
2300	Unicorn-12643.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1780 wrote to memory of 2216	1780	3bca3ac4209af2e5cc117e9c43a9247cb4dda9937df6c31f2fc0cd70158ada42.exe	31
PID 1780 wrote to memory of 2216	1780	3bca3ac4209af2e5cc117e9c43a9247cb4dda9937df6c31f2fc0cd70158ada42.exe	31
PID 1780 wrote to memory of 2216	1780	3bca3ac4209af2e5cc117e9c43a9247cb4dda9937df6c31f2fc0cd70158ada42.exe	31
PID 1780 wrote to memory of 2216	1780	3bca3ac4209af2e5cc117e9c43a9247cb4dda9937df6c31f2fc0cd70158ada42.exe	31
PID 2216 wrote to memory of 2788	2216	Unicorn-11242.exe	32
PID 2216 wrote to memory of 2788	2216	Unicorn-11242.exe	32
PID 2216 wrote to memory of 2788	2216	Unicorn-11242.exe	32
PID 2216 wrote to memory of 2788	2216	Unicorn-11242.exe	32
PID 1780 wrote to memory of 2688	1780	3bca3ac4209af2e5cc117e9c43a9247cb4dda9937df6c31f2fc0cd70158ada42.exe	33
PID 1780 wrote to memory of 2688	1780	3bca3ac4209af2e5cc117e9c43a9247cb4dda9937df6c31f2fc0cd70158ada42.exe	33
PID 1780 wrote to memory of 2688	1780	3bca3ac4209af2e5cc117e9c43a9247cb4dda9937df6c31f2fc0cd70158ada42.exe	33
PID 1780 wrote to memory of 2688	1780	3bca3ac4209af2e5cc117e9c43a9247cb4dda9937df6c31f2fc0cd70158ada42.exe	33
PID 2788 wrote to memory of 1200	2788	Unicorn-1211.exe	34
PID 2788 wrote to memory of 1200	2788	Unicorn-1211.exe	34
PID 2788 wrote to memory of 1200	2788	Unicorn-1211.exe	34
PID 2788 wrote to memory of 1200	2788	Unicorn-1211.exe	34
PID 2216 wrote to memory of 2572	2216	Unicorn-11242.exe	35
PID 2216 wrote to memory of 2572	2216	Unicorn-11242.exe	35
PID 2216 wrote to memory of 2572	2216	Unicorn-11242.exe	35
PID 2216 wrote to memory of 2572	2216	Unicorn-11242.exe	35
PID 2688 wrote to memory of 2620	2688	Unicorn-59135.exe	36
PID 2688 wrote to memory of 2620	2688	Unicorn-59135.exe	36
PID 2688 wrote to memory of 2620	2688	Unicorn-59135.exe	36
PID 2688 wrote to memory of 2620	2688	Unicorn-59135.exe	36
PID 1780 wrote to memory of 264	1780	3bca3ac4209af2e5cc117e9c43a9247cb4dda9937df6c31f2fc0cd70158ada42.exe	37
PID 1780 wrote to memory of 264	1780	3bca3ac4209af2e5cc117e9c43a9247cb4dda9937df6c31f2fc0cd70158ada42.exe	37
PID 1780 wrote to memory of 264	1780	3bca3ac4209af2e5cc117e9c43a9247cb4dda9937df6c31f2fc0cd70158ada42.exe	37
PID 1780 wrote to memory of 264	1780	3bca3ac4209af2e5cc117e9c43a9247cb4dda9937df6c31f2fc0cd70158ada42.exe	37
PID 1200 wrote to memory of 2100	1200	Unicorn-32021.exe	38
PID 1200 wrote to memory of 2100	1200	Unicorn-32021.exe	38
PID 1200 wrote to memory of 2100	1200	Unicorn-32021.exe	38
PID 1200 wrote to memory of 2100	1200	Unicorn-32021.exe	38
PID 2788 wrote to memory of 868	2788	Unicorn-1211.exe	39
PID 2788 wrote to memory of 868	2788	Unicorn-1211.exe	39
PID 2788 wrote to memory of 868	2788	Unicorn-1211.exe	39
PID 2788 wrote to memory of 868	2788	Unicorn-1211.exe	39
PID 2572 wrote to memory of 2672	2572	Unicorn-14101.exe	40
PID 2572 wrote to memory of 2672	2572	Unicorn-14101.exe	40
PID 2572 wrote to memory of 2672	2572	Unicorn-14101.exe	40
PID 2572 wrote to memory of 2672	2572	Unicorn-14101.exe	40
PID 2620 wrote to memory of 1936	2620	Unicorn-11408.exe	41
PID 2620 wrote to memory of 1936	2620	Unicorn-11408.exe	41
PID 2620 wrote to memory of 1936	2620	Unicorn-11408.exe	41
PID 2620 wrote to memory of 1936	2620	Unicorn-11408.exe	41
PID 2216 wrote to memory of 540	2216	Unicorn-11242.exe	42
PID 2216 wrote to memory of 540	2216	Unicorn-11242.exe	42
PID 2216 wrote to memory of 540	2216	Unicorn-11242.exe	42
PID 2216 wrote to memory of 540	2216	Unicorn-11242.exe	42
PID 2688 wrote to memory of 1736	2688	Unicorn-59135.exe	43
PID 2688 wrote to memory of 1736	2688	Unicorn-59135.exe	43
PID 2688 wrote to memory of 1736	2688	Unicorn-59135.exe	43
PID 2688 wrote to memory of 1736	2688	Unicorn-59135.exe	43
PID 264 wrote to memory of 2016	264	Unicorn-9362.exe	44
PID 264 wrote to memory of 2016	264	Unicorn-9362.exe	44
PID 264 wrote to memory of 2016	264	Unicorn-9362.exe	44
PID 264 wrote to memory of 2016	264	Unicorn-9362.exe	44
PID 1780 wrote to memory of 1788	1780	3bca3ac4209af2e5cc117e9c43a9247cb4dda9937df6c31f2fc0cd70158ada42.exe	45
PID 1780 wrote to memory of 1788	1780	3bca3ac4209af2e5cc117e9c43a9247cb4dda9937df6c31f2fc0cd70158ada42.exe	45
PID 1780 wrote to memory of 1788	1780	3bca3ac4209af2e5cc117e9c43a9247cb4dda9937df6c31f2fc0cd70158ada42.exe	45
PID 1780 wrote to memory of 1788	1780	3bca3ac4209af2e5cc117e9c43a9247cb4dda9937df6c31f2fc0cd70158ada42.exe	45
PID 2100 wrote to memory of 1564	2100	Unicorn-39203.exe	46
PID 2100 wrote to memory of 1564	2100	Unicorn-39203.exe	46
PID 2100 wrote to memory of 1564	2100	Unicorn-39203.exe	46
PID 2100 wrote to memory of 1564	2100	Unicorn-39203.exe	46

C:\Users\Admin\AppData\Local\Temp\3bca3ac4209af2e5cc117e9c43a9247cb4dda9937df6c31f2fc0cd70158ada42.exe
"C:\Users\Admin\AppData\Local\Temp\3bca3ac4209af2e5cc117e9c43a9247cb4dda9937df6c31f2fc0cd70158ada42.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1780
- C:\Users\Admin\AppData\Local\Temp\Unicorn-11242.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-11242.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2216
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1211.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1211.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32021.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32021.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39203.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18830.exe
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:1564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51777.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1590.exe
        8⤵
        Executes dropped EXE
        
        PID:2948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5669.exe
        9⤵
        
        PID:2944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5521.exe
        9⤵
        
        PID:3516
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3516 -s 180
        10⤵
        Program crash
        
        PID:3872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9796.exe
        9⤵
        
        PID:5056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49668.exe
        9⤵
        
        PID:5224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24853.exe
        9⤵
        
        PID:6588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50581.exe
        9⤵
        
        PID:7220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20614.exe
        8⤵
        
        PID:2972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5635.exe
        8⤵
        
        PID:3932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44988.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9885.exe
        8⤵
        
        PID:5848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4252.exe
        8⤵
        
        PID:7108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12265.exe
        8⤵
        
        PID:7688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26841.exe
        7⤵
        
        PID:1392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5669.exe
        8⤵
        
        PID:1940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22289.exe
        9⤵
        
        PID:3376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61598.exe
        9⤵
        
        PID:4244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8992.exe
        9⤵
        
        PID:6076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33519.exe
        9⤵
        
        PID:6732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1579.exe
        9⤵
        
        PID:6468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8837.exe
        8⤵
        
        PID:3116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9796.exe
        8⤵
        
        PID:4668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53752.exe
        8⤵
        
        PID:5560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11390.exe
        8⤵
        
        PID:6868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23489.exe
        8⤵
        
        PID:7184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5953.exe
        7⤵
        
        PID:1896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62507.exe
        7⤵
        
        PID:3396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28452.exe
        7⤵
        
        PID:5080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26951.exe
        7⤵
        
        PID:5996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48258.exe
        7⤵
        
        PID:6212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6930.exe
        7⤵
        
        PID:7788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37941.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46707.exe
        7⤵
        
        PID:1676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21492.exe
        8⤵
        
        PID:1224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52771.exe
        9⤵
        
        PID:4352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38136.exe
        9⤵
        
        PID:4904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49833.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:5776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12387.exe
        9⤵
        
        PID:6984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2539.exe
        9⤵
        
        PID:7904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-974.exe
        8⤵
        
        PID:3680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47126.exe
        8⤵
        
        PID:4860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9885.exe
        8⤵
        
        PID:468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4252.exe
        8⤵
        
        PID:7124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12265.exe
        8⤵
        
        PID:7812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60941.exe
        7⤵
        
        PID:2220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22572.exe
        7⤵
        
        PID:4036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15661.exe
        7⤵
        
        PID:4476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41003.exe
        7⤵
        
        PID:5276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8318.exe
        7⤵
        
        PID:6580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2109.exe
        7⤵
        
        PID:7452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63711.exe
        6⤵
        
        PID:2908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37444.exe
        7⤵
        
        PID:2832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57236.exe
        7⤵
        
        PID:3264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52863.exe
        7⤵
        
        PID:4252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17664.exe
        7⤵
        
        PID:4984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26420.exe
        7⤵
        
        PID:6132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52724.exe
        7⤵
        
        PID:7016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33796.exe
        7⤵
        
        PID:7724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35041.exe
        6⤵
        
        PID:2912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41529.exe
        6⤵
        
        PID:3148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45971.exe
        6⤵
        
        PID:3592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9529.exe
        6⤵
        
        PID:5140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5420.exe
        6⤵
        
        PID:6012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42923.exe
        6⤵
        
        PID:7060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11130.exe
        6⤵
        
        PID:7628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23468.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45555.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4304.exe
        7⤵
        
        PID:2548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6162.exe
        8⤵
        
        PID:976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60560.exe
        8⤵
        
        PID:3504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9796.exe
        8⤵
        
        PID:4612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53752.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6763.exe
        8⤵
        
        PID:6556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50581.exe
        8⤵
        
        PID:7388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54657.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35977.exe
        7⤵
        
        PID:3468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16399.exe
        7⤵
        
        PID:4924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9885.exe
        7⤵
        
        PID:5840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4252.exe
        7⤵
        
        PID:7132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12265.exe
        7⤵
        
        PID:7612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2913.exe
        6⤵
        
        PID:924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43090.exe
        7⤵
        
        PID:2484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57236.exe
        7⤵
        
        PID:3296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65307.exe
        7⤵
        
        PID:3492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17664.exe
        7⤵
        
        PID:4716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6000.exe
        7⤵
        
        PID:5472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52724.exe
        7⤵
        
        PID:7048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3069.exe
        7⤵
        
        PID:7840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47842.exe
        6⤵
        
        PID:108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11299.exe
        6⤵
        
        PID:3236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62507.exe
        6⤵
        
        PID:3496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44679.exe
        6⤵
        
        PID:5216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6530.exe
        6⤵
        
        PID:5636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48258.exe
        6⤵
        
        PID:7164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41740.exe
        6⤵
        
        PID:7916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1106.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2166.exe
        6⤵
        
        PID:1876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33059.exe
        7⤵
        
        PID:1468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-974.exe
        7⤵
        
        PID:3700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43042.exe
        7⤵
        
        PID:4828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9885.exe
        7⤵
        
        PID:6016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4252.exe
        7⤵
        
        PID:7104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12265.exe
        7⤵
        
        PID:7772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62970.exe
        6⤵
        
        PID:776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22572.exe
        6⤵
        
        PID:3996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15661.exe
        6⤵
        
        PID:4364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41003.exe
        6⤵
        
        PID:5412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53243.exe
        6⤵
        
        PID:6872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2109.exe
        6⤵
        
        PID:7460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61216.exe
        5⤵
        
        PID:2540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8837.exe
        6⤵
        
        PID:3112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9796.exe
        6⤵
        
        PID:4484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49668.exe
        6⤵
        
        PID:5424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4241.exe
        6⤵
        
        PID:6888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50581.exe
        6⤵
        
        PID:7364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57014.exe
        5⤵
        
        PID:2448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65458.exe
        5⤵
        
        PID:3400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7526.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50728.exe
        5⤵
        
        PID:6136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64055.exe
        5⤵
        
        PID:6812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44980.exe
        5⤵
        
        PID:7232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54148.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54148.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55586.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31741.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54766.exe
        7⤵
        
        PID:2580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-974.exe
        8⤵
        
        PID:3668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15661.exe
        8⤵
        
        PID:4208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41003.exe
        8⤵
        
        PID:5188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8318.exe
        8⤵
        
        PID:6744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2109.exe
        8⤵
        
        PID:7436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49478.exe
        7⤵
        
        PID:2328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49700.exe
        7⤵
        
        PID:4652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47689.exe
        7⤵
        
        PID:5948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64278.exe
        7⤵
        
        PID:6496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21403.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49291.exe
        6⤵
        
        PID:2928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18973.exe
        7⤵
        
        PID:3648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61598.exe
        7⤵
        
        PID:4432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43803.exe
        7⤵
        
        PID:5392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33519.exe
        7⤵
        
        PID:6724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1579.exe
        7⤵
        
        PID:7292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40655.exe
        6⤵
        
        PID:1716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62507.exe
        6⤵
        
        PID:3732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58001.exe
        6⤵
        
        PID:3572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26951.exe
        6⤵
        
        PID:1888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48258.exe
        6⤵
        
        PID:6344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6930.exe
        6⤵
        
        PID:7732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56992.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38923.exe
        6⤵
        
        PID:1720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6162.exe
        7⤵
        
        PID:2052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54530.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9796.exe
        7⤵
        
        PID:5064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14857.exe
        7⤵
        
        PID:6092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24853.exe
        7⤵
        
        PID:6792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50581.exe
        7⤵
        
        PID:7300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51834.exe
        6⤵
        
        PID:744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22572.exe
        6⤵
        
        PID:4060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15661.exe
        6⤵
        
        PID:4692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45087.exe
        6⤵
        
        PID:5604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55765.exe
        6⤵
        
        PID:6472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2109.exe
        6⤵
        
        PID:7420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3135.exe
        5⤵
        
        PID:1192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46894.exe
        6⤵
        
        PID:2536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5521.exe
        6⤵
        
        PID:3528
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3528 -s 180
        7⤵
        Program crash
        
        PID:3632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9796.exe
        6⤵
        
        PID:4536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53752.exe
        6⤵
        
        PID:5544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11390.exe
        6⤵
        
        PID:6840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23489.exe
        6⤵
        
        PID:7472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6172.exe
        5⤵
        
        PID:2324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16456.exe
        5⤵
        
        PID:3892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55998.exe
        5⤵
        
        PID:4504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45617.exe
        5⤵
        
        PID:5528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51299.exe
        5⤵
        
        PID:6452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40780.exe
        5⤵
        
        PID:7256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20867.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20867.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37771.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36292.exe
        6⤵
        
        PID:2956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28703.exe
        7⤵
        
        PID:3200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61598.exe
        7⤵
        
        PID:4284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8992.exe
        7⤵
        
        PID:6084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3722.exe
        7⤵
        
        PID:6384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16730.exe
        7⤵
        
        PID:7700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57236.exe
        6⤵
        
        PID:3336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65307.exe
        6⤵
        
        PID:4228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56559.exe
        6⤵
        
        PID:5304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28307.exe
        6⤵
        
        PID:6260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42374.exe
        6⤵
        
        PID:6432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13713.exe
        6⤵
        
        PID:7944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10204.exe
        5⤵
        
        PID:1864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25467.exe
        6⤵
        
        PID:988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8837.exe
        6⤵
        
        PID:4092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9796.exe
        6⤵
        
        PID:4460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49668.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24853.exe
        6⤵
        
        PID:6636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50581.exe
        6⤵
        
        PID:7264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39565.exe
        5⤵
        
        PID:2712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28438.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6996.exe
        5⤵
        
        PID:4468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24467.exe
        5⤵
        
        PID:5248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25384.exe
        5⤵
        
        PID:6612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46115.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17085.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17085.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17578.exe
        5⤵
        
        PID:2596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5669.exe
        6⤵
        
        PID:2884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22289.exe
        7⤵
        
        PID:3368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61598.exe
        7⤵
        
        PID:4644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47887.exe
        7⤵
        
        PID:5496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15428.exe
        7⤵
        
        PID:6436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1579.exe
        7⤵
        
        PID:7196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8837.exe
        6⤵
        
        PID:3196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9796.exe
        6⤵
        
        PID:4496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53752.exe
        6⤵
        
        PID:5584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6763.exe
        6⤵
        
        PID:6564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50581.exe
        6⤵
        
        PID:7356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32787.exe
        5⤵
        
        PID:3020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62507.exe
        5⤵
        
        PID:3616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34482.exe
        5⤵
        
        PID:5008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26951.exe
        5⤵
        
        PID:5904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48258.exe
        5⤵
        
        PID:6200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6930.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8887.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8887.exe
      4⤵
      PID:3064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5394.exe
        5⤵
        
        PID:2776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8837.exe
        5⤵
        
        PID:4044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9796.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49668.exe
        5⤵
        
        PID:5376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24853.exe
        5⤵
        
        PID:6596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50581.exe
        5⤵
        
        PID:6880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47411.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47411.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20302.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20302.exe
      4⤵
      PID:3956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51532.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51532.exe
      4⤵
      PID:4512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45393.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45393.exe
      4⤵
      PID:5168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2718.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2718.exe
      4⤵
      PID:6752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17245.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17245.exe
      4⤵
      PID:7284
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14101.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14101.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26951.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26951.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61808.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11320.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6058.exe
        7⤵
        
        PID:824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54102.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:1976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52776.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9796.exe
        8⤵
        
        PID:5024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14857.exe
        8⤵
        
        PID:6064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24853.exe
        8⤵
        
        PID:6760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50581.exe
        8⤵
        
        PID:6908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1948.exe
        7⤵
        
        PID:2616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19256.exe
        7⤵
        
        PID:3424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16399.exe
        7⤵
        
        PID:4896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45373.exe
        7⤵
        
        PID:6220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20843.exe
        7⤵
        
        PID:6460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8378.exe
        7⤵
        
        PID:7656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48715.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5155.exe
        7⤵
        
        PID:320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8837.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9796.exe
        7⤵
        
        PID:4440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49668.exe
        7⤵
        
        PID:5240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52724.exe
        7⤵
        
        PID:6536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3069.exe
        7⤵
        
        PID:7872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63877.exe
        6⤵
        
        PID:2264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61043.exe
        7⤵
        
        PID:4732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7701.exe
        7⤵
        
        PID:6072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6522.exe
        7⤵
        
        PID:7088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41931.exe
        7⤵
        
        PID:7708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28438.exe
        6⤵
        
        PID:4028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6996.exe
        6⤵
        
        PID:4372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55194.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25384.exe
        6⤵
        
        PID:6800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46115.exe
        6⤵
        
        PID:6820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3707.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31030.exe
        6⤵
        
        PID:1900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52393.exe
        7⤵
        
        PID:8168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57236.exe
        6⤵
        
        PID:3304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65307.exe
        6⤵
        
        PID:3564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53653.exe
        6⤵
        
        PID:1020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28307.exe
        6⤵
        
        PID:6284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25846.exe
        6⤵
        
        PID:6808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13713.exe
        6⤵
        
        PID:7856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36960.exe
        5⤵
        
        PID:1008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11650.exe
        6⤵
        
        PID:5012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52434.exe
        6⤵
        
        PID:5724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9563.exe
        6⤵
        
        PID:6416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10244.exe
        6⤵
        
        PID:7340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19772.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55998.exe
        5⤵
        
        PID:4456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6722.exe
        5⤵
        
        PID:5196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3853.exe
        5⤵
        
        PID:6572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40780.exe
        5⤵
        
        PID:6924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9846.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9846.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46131.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37854.exe
        6⤵
        
        PID:2508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21539.exe
        7⤵
        
        PID:2360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8837.exe
        7⤵
        
        PID:4076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9796.exe
        7⤵
        
        PID:4408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49668.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24853.exe
        7⤵
        
        PID:6620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50581.exe
        7⤵
        
        PID:2332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50874.exe
        6⤵
        
        PID:2964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22572.exe
        6⤵
        
        PID:3972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15661.exe
        6⤵
        
        PID:4312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6192.exe
        6⤵
        
        PID:2368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8318.exe
        6⤵
        
        PID:6776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2109.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55513.exe
        5⤵
        
        PID:2796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5669.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5521.exe
        6⤵
        
        PID:3480
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3480 -s 180
        7⤵
        Program crash
        
        PID:3636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9796.exe
        6⤵
        
        PID:5032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14857.exe
        6⤵
        
        PID:6056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24853.exe
        6⤵
        
        PID:6716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50581.exe
        6⤵
        
        PID:7248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61568.exe
        5⤵
        
        PID:2792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25122.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6996.exe
        5⤵
        
        PID:1444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45373.exe
        5⤵
        
        PID:6316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20843.exe
        5⤵
        
        PID:6424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8378.exe
        5⤵
        
        PID:7516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31640.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31640.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5394.exe
        5⤵
        
        PID:3012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-974.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43042.exe
        5⤵
        
        PID:1608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30497.exe
        5⤵
        
        PID:5788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4252.exe
        5⤵
        
        PID:7076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12265.exe
        5⤵
        
        PID:7676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7075.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7075.exe
      4⤵
      PID:2740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19772.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19772.exe
      4⤵
      PID:3948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55998.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55998.exe
      4⤵
      PID:4700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45617.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45617.exe
      4⤵
      PID:5536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51299.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51299.exe
      4⤵
      PID:6508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40780.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40780.exe
      4⤵
      PID:7176
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14598.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14598.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47802.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47802.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64797.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9286.exe
        6⤵
        
        PID:1028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-974.exe
        6⤵
        
        PID:3708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15661.exe
        6⤵
        
        PID:4320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6192.exe
        6⤵
        
        PID:4272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8318.exe
        6⤵
        
        PID:6680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2109.exe
        6⤵
        
        PID:7428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41143.exe
        5⤵
        
        PID:2384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62507.exe
        5⤵
        
        PID:3488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40704.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26951.exe
        5⤵
        
        PID:5832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48258.exe
        5⤵
        
        PID:6256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6930.exe
        5⤵
        
        PID:7756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38709.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38709.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6162.exe
        5⤵
        
        PID:2716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60560.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9796.exe
        5⤵
        
        PID:4544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53752.exe
        5⤵
        
        PID:5540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6763.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50581.exe
        5⤵
        
        PID:7372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32.exe
      4⤵
      PID:1588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28438.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28438.exe
      4⤵
      PID:3964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6996.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6996.exe
      4⤵
      PID:4416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24467.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24467.exe
      4⤵
      PID:5400
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25384.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25384.exe
      4⤵
      PID:6628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46115.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46115.exe
      4⤵
      PID:6528
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47537.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47537.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19873.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19873.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36292.exe
        5⤵
        
        PID:1932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13370.exe
        6⤵
        
        PID:1928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8837.exe
        6⤵
        
        PID:4084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9796.exe
        6⤵
        
        PID:4380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49668.exe
        6⤵
        
        PID:5236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24853.exe
        6⤵
        
        PID:6644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50581.exe
        6⤵
        
        PID:2168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11299.exe
        5⤵
        
        PID:3212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62507.exe
        5⤵
        
        PID:4160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48763.exe
        5⤵
        
        PID:5292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6530.exe
        5⤵
        
        PID:5640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48258.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41740.exe
        5⤵
        
        PID:7932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59981.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59981.exe
      4⤵
      PID:348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14556.exe
        5⤵
        
        PID:4740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52434.exe
        5⤵
        
        PID:5704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9563.exe
        5⤵
        
        PID:6364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10244.exe
        5⤵
        
        PID:7240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5434.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5434.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5635.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5635.exe
      4⤵
      PID:4144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47894.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47894.exe
      4⤵
      PID:5320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45373.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45373.exe
      4⤵
      PID:6240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39125.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39125.exe
      4⤵
      PID:6704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8378.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8378.exe
      4⤵
      PID:7576
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4720.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4720.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43090.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43090.exe
      4⤵
      PID:2136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16073.exe
        5⤵
        
        PID:6532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57236.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57236.exe
      4⤵
      PID:3272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58365.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58365.exe
      4⤵
      PID:4616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64225.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64225.exe
      4⤵
      PID:5924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4252.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4252.exe
      4⤵
      PID:5176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12265.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12265.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7796
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17624.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17624.exe
    3⤵
    PID:696
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3164.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3164.exe
    3⤵
    PID:3128
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41506.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41506.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3888
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57546.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57546.exe
    3⤵
    PID:4908
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24897.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24897.exe
    3⤵
    PID:5748
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46933.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46933.exe
    3⤵
    PID:6848
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64581.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64581.exe
    3⤵
    PID:7188
- C:\Users\Admin\AppData\Local\Temp\Unicorn-59135.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-59135.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2688
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11408.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11408.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38134.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38134.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:1936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47802.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40293.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15461.exe
        7⤵
        
        PID:2840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26509.exe
        7⤵
        
        PID:3160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65307.exe
        7⤵
        
        PID:4176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4343.exe
        7⤵
        
        PID:5208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28307.exe
        7⤵
        
        PID:6300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60656.exe
        7⤵
        
        PID:6248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58995.exe
        6⤵
        
        PID:2936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33931.exe
        7⤵
        
        PID:3432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22791.exe
        7⤵
        
        PID:4288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47788.exe
        7⤵
        
        PID:916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55698.exe
        7⤵
        
        PID:5768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3722.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16730.exe
        7⤵
        
        PID:7604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22572.exe
        6⤵
        
        PID:4004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15661.exe
        6⤵
        
        PID:4400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41003.exe
        6⤵
        
        PID:5180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8318.exe
        6⤵
        
        PID:6708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2109.exe
        6⤵
        
        PID:7404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4901.exe
        6⤵
        
        PID:1488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22241.exe
        6⤵
        
        PID:3520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9796.exe
        6⤵
        
        PID:5048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49668.exe
        6⤵
        
        PID:5232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24853.exe
        6⤵
        
        PID:6604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50581.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11599.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62507.exe
        5⤵
        
        PID:4136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58001.exe
        5⤵
        
        PID:4932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6530.exe
        5⤵
        
        PID:5652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48258.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41740.exe
        5⤵
        
        PID:7952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32020.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32020.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27849.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6162.exe
        6⤵
        
        PID:2344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29833.exe
        6⤵
        
        PID:3600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9796.exe
        6⤵
        
        PID:4552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53752.exe
        6⤵
        
        PID:5524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11390.exe
        6⤵
        
        PID:6656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23489.exe
        6⤵
        
        PID:7280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11299.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62507.exe
        5⤵
        
        PID:4120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34482.exe
        5⤵
        
        PID:5100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23842.exe
        5⤵
        
        PID:6336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64517.exe
        5⤵
        
        PID:980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12578.exe
        5⤵
        
        PID:7968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55159.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55159.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10609.exe
        5⤵
        
        PID:2444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21495.exe
        6⤵
        
        PID:3612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49926.exe
        6⤵
        
        PID:4844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35086.exe
        6⤵
        
        PID:6100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3722.exe
        6⤵
        
        PID:6944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16730.exe
        6⤵
        
        PID:7660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57236.exe
        5⤵
        
        PID:3328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65307.exe
        5⤵
        
        PID:3552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17664.exe
        5⤵
        
        PID:5132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6000.exe
        5⤵
        
        PID:5468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52724.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3069.exe
        5⤵
        
        PID:7828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10344.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10344.exe
      4⤵
      PID:752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2634.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2634.exe
      4⤵
      PID:3176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50230.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50230.exe
      4⤵
      PID:4636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43224.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43224.exe
      4⤵
      PID:5968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37412.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37412.exe
      4⤵
      PID:6484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44980.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44980.exe
      4⤵
      PID:6352
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4947.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4947.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25436.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25436.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49037.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34730.exe
        6⤵
        
        PID:1988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50459.exe
        7⤵
        
        PID:3404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51572.exe
        7⤵
        
        PID:3576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33397.exe
        7⤵
        
        PID:5020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44843.exe
        7⤵
        
        PID:6232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25308.exe
        7⤵
        
        PID:6388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35244.exe
        7⤵
        
        PID:7640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57236.exe
        6⤵
        
        PID:3280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65307.exe
        6⤵
        
        PID:4152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17664.exe
        6⤵
        
        PID:5108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28307.exe
        6⤵
        
        PID:6276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60656.exe
        6⤵
        
        PID:7156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13713.exe
        6⤵
        
        PID:7596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5897.exe
        5⤵
        
        PID:2524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19772.exe
        5⤵
        
        PID:3936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55998.exe
        5⤵
        
        PID:4424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41533.exe
        5⤵
        
        PID:5336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3853.exe
        5⤵
        
        PID:6688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40780.exe
        5⤵
        
        PID:7396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12643.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12643.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24528.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65307.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17489.exe
        5⤵
        
        PID:5660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28307.exe
        5⤵
        
        PID:6292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25846.exe
        5⤵
        
        PID:3364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13713.exe
        5⤵
        
        PID:7868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5953.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5953.exe
      4⤵
      PID:1892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25122.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25122.exe
      4⤵
      PID:3460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6996.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6996.exe
      4⤵
      PID:1344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28551.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28551.exe
      4⤵
      PID:5644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7293.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7293.exe
      4⤵
      PID:6492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46115.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46115.exe
      4⤵
      PID:7212
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41672.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41672.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61289.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61289.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64278.exe
        5⤵
        
        PID:2680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18252.exe
        6⤵
        
        PID:5620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33907.exe
        6⤵
        
        PID:6176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28691.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57236.exe
        5⤵
        
        PID:3104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65307.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17664.exe
        5⤵
        
        PID:4936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28307.exe
        5⤵
        
        PID:6204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42374.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13713.exe
        5⤵
        
        PID:7820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17578.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17578.exe
      4⤵
      PID:2732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34028.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5434.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5434.exe
      4⤵
      PID:3252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5635.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5635.exe
      4⤵
      PID:4168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47894.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47894.exe
      4⤵
      PID:5312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55002.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55002.exe
      4⤵
      PID:5256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4252.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4252.exe
      4⤵
      PID:6936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47075.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47075.exe
      4⤵
      PID:7896
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34382.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34382.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6162.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6162.exe
      4⤵
      PID:2724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60560.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60560.exe
      4⤵
      PID:3580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9796.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9796.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14857.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14857.exe
      4⤵
      PID:4540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24853.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24853.exe
      4⤵
      PID:6664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50581.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50581.exe
      4⤵
      PID:7348
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62769.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62769.exe
    3⤵
    PID:1704
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3237.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3237.exe
    3⤵
    PID:3864
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7526.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7526.exe
    3⤵
    PID:4684
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24086.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24086.exe
    3⤵
    PID:5612
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45964.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45964.exe
    3⤵
    PID:6372
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44980.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44980.exe
    3⤵
    PID:7204
- C:\Users\Admin\AppData\Local\Temp\Unicorn-9362.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-9362.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:264
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34626.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34626.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45856.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45856.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52161.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13925.exe
        6⤵
        
        PID:860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6162.exe
        7⤵
        
        PID:1208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28703.exe
        8⤵
        
        PID:3172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61598.exe
        8⤵
        
        PID:4660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47887.exe
        8⤵
        
        PID:5504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27925.exe
        8⤵
        
        PID:6884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6424.exe
        8⤵
        
        PID:7084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8837.exe
        7⤵
        
        PID:4068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9796.exe
        7⤵
        
        PID:4304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64058.exe
        7⤵
        
        PID:5684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3722.exe
        7⤵
        
        PID:7096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16730.exe
        7⤵
        
        PID:7780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50573.exe
        6⤵
        
        PID:1628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11564.exe
        7⤵
        
        PID:3184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51572.exe
        7⤵
        
        PID:3568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50694.exe
        7⤵
        
        PID:5328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14665.exe
        7⤵
        
        PID:5352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3722.exe
        7⤵
        
        PID:7008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51541.exe
        7⤵
        
        PID:7880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5434.exe
        6⤵
        
        PID:3244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5635.exe
        6⤵
        
        PID:4184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43810.exe
        6⤵
        
        PID:5160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45373.exe
        6⤵
        
        PID:6268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2846.exe
        6⤵
        
        PID:7580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57459.exe
        5⤵
        
        PID:2124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6162.exe
        6⤵
        
        PID:2844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33917.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9796.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44843.exe
        6⤵
        
        PID:6324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8780.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35244.exe
        6⤵
        
        PID:7836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32623.exe
        5⤵
        
        PID:1308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45971.exe
        5⤵
        
        PID:3900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9529.exe
        5⤵
        
        PID:4712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5420.exe
        5⤵
        
        PID:5912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42923.exe
        5⤵
        
        PID:7140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11130.exe
        5⤵
        
        PID:7764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59514.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59514.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37444.exe
        5⤵
        
        PID:2628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57236.exe
        5⤵
        
        PID:3288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65307.exe
        5⤵
        
        PID:3412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17664.exe
        5⤵
        
        PID:920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6000.exe
        5⤵
        
        PID:5488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52724.exe
        5⤵
        
        PID:6960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3069.exe
        5⤵
        
        PID:7848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18869.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18869.exe
      4⤵
      PID:2388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11299.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11299.exe
      4⤵
      PID:3120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62507.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62507.exe
      4⤵
      PID:3928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58001.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58001.exe
      4⤵
      PID:4964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26951.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26951.exe
      4⤵
      PID:5896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48258.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48258.exe
      4⤵
      PID:6152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6930.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6930.exe
      4⤵
      PID:7644
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5570.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5570.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34647.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34647.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65456.exe
        5⤵
        
        PID:2316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25465.exe
        6⤵
        
        PID:4952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52434.exe
        6⤵
        
        PID:5716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9563.exe
        6⤵
        
        PID:6408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10244.exe
        6⤵
        
        PID:7380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57236.exe
        5⤵
        
        PID:3320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65307.exe
        5⤵
        
        PID:4104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56559.exe
        5⤵
        
        PID:5340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6000.exe
        5⤵
        
        PID:5460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52724.exe
        5⤵
        
        PID:7028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3069.exe
        5⤵
        
        PID:7860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59793.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59793.exe
      4⤵
      PID:1256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28438.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28438.exe
      4⤵
      PID:4012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6996.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6996.exe
      4⤵
      PID:4392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55194.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55194.exe
      4⤵
      PID:6116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25384.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25384.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46115.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46115.exe
      4⤵
      PID:3916
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42907.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42907.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46058.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46058.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6839.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6839.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6996.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6996.exe
      4⤵
      PID:4260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55194.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55194.exe
      4⤵
      PID:6124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25384.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25384.exe
      4⤵
      PID:6784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46115.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46115.exe
      4⤵
      PID:7332
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61491.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61491.exe
    3⤵
    PID:692
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5900.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5900.exe
      4⤵
      PID:4216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63601.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63601.exe
      4⤵
      PID:4360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29220.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29220.exe
      4⤵
      PID:6024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12387.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12387.exe
      4⤵
      PID:7040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33265.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33265.exe
      4⤵
      PID:7740
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2634.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2634.exe
    3⤵
    PID:3204
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45971.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45971.exe
    3⤵
    PID:4112
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9529.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9529.exe
    3⤵
    PID:4980
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46452.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46452.exe
    3⤵
    PID:5284
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42923.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42923.exe
    3⤵
    PID:7068
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45940.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45940.exe
    3⤵
    PID:7960
- C:\Users\Admin\AppData\Local\Temp\Unicorn-34361.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-34361.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:1788
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25436.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25436.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58575.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58575.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6162.exe
        5⤵
        
        PID:2432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37233.exe
        5⤵
        
        PID:3384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9796.exe
        5⤵
        
        PID:5116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44843.exe
        5⤵
        
        PID:6188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53897.exe
        5⤵
        
        PID:3908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35244.exe
        5⤵
        
        PID:7748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51834.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51834.exe
      4⤵
      PID:2924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22572.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22572.exe
      4⤵
      PID:4052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15661.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15661.exe
      4⤵
      PID:4676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28307.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28307.exe
      4⤵
      PID:6308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60656.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60656.exe
      4⤵
      PID:6356
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20235.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20235.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40952.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40952.exe
      4⤵
      PID:1944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5669.exe
        5⤵
        
        PID:2868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5521.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3428
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3428 -s 180
        6⤵
        Program crash
        
        PID:3656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9796.exe
        5⤵
        
        PID:1408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53752.exe
        5⤵
        
        PID:5552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6763.exe
        5⤵
        
        PID:6548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50581.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13022.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13022.exe
      4⤵
      PID:2568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5635.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5635.exe
      4⤵
      PID:3896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18345.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18345.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30497.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30497.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4252.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4252.exe
      4⤵
      PID:6972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12265.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12265.exe
      4⤵
      PID:7620
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59326.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59326.exe
    3⤵
    PID:3040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42886.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42886.exe
      4⤵
      PID:6928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7940.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7940.exe
      4⤵
      PID:8172
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11299.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11299.exe
    3⤵
    PID:3220
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62507.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62507.exe
    3⤵
    PID:4128
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58001.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58001.exe
    3⤵
    PID:5148
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6530.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6530.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5668
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48258.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48258.exe
    3⤵
    PID:6216
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41740.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41740.exe
    3⤵
    PID:7924
- C:\Users\Admin\AppData\Local\Temp\Unicorn-38872.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-38872.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2032
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40293.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40293.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65456.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65456.exe
      4⤵
      PID:3028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42886.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12024.exe
        5⤵
        
        PID:8188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57236.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57236.exe
      4⤵
      PID:3312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58365.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58365.exe
      4⤵
      PID:4624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64225.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64225.exe
      4⤵
      PID:5936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47212.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47212.exe
      4⤵
      PID:6512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2109.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2109.exe
      4⤵
      PID:7412
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56281.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56281.exe
    3⤵
    PID:1784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43410.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43410.exe
      4⤵
      PID:5956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45875.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45875.exe
      4⤵
      PID:7488
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5434.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5434.exe
    3⤵
    PID:3140
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5635.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5635.exe
    3⤵
    PID:3588
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8999.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8999.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5076
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9885.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9885.exe
    3⤵
    PID:1212
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4252.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4252.exe
    3⤵
    PID:6992
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12265.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12265.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:7668
- C:\Users\Admin\AppData\Local\Temp\Unicorn-39331.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-39331.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1616
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6162.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6162.exe
    3⤵
    PID:2184
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3191.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3191.exe
    3⤵
    PID:3696
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9796.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9796.exe
    3⤵
    PID:4448
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53752.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53752.exe
    3⤵
    PID:5576
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11390.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11390.exe
    3⤵
    PID:6860
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23489.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23489.exe
    3⤵
    PID:7484
- C:\Users\Admin\AppData\Local\Temp\Unicorn-40741.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-40741.exe
  2⤵
  PID:856
- C:\Users\Admin\AppData\Local\Temp\Unicorn-12176.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-12176.exe
  2⤵
  PID:3532
- C:\Users\Admin\AppData\Local\Temp\Unicorn-46197.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-46197.exe
  2⤵
  PID:4276
- C:\Users\Admin\AppData\Local\Temp\Unicorn-49593.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-49593.exe
  2⤵
  PID:6104
- C:\Users\Admin\AppData\Local\Temp\Unicorn-40519.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-40519.exe
  2⤵
  PID:6768
- C:\Users\Admin\AppData\Local\Temp\Unicorn-64581.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-64581.exe
  2⤵
  PID:7272

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-14598.exe

Filesize
468KB

MD5
828c4e76853b9cfa4fa2e9ae137259ea

SHA1
f75ed5914698ed4aa8e91f2cbd11bd71aa06eda0

SHA256
cd446fc1626d4f16e7e04b58a76864f28b3658d5b9a98bb6c7b81e57675aaec4

SHA512
2439d80548e8c662a4e57eccc88d4709f1c3e7ab494533a5f0807d3f182a46f350f2a9f3d7669a104f554939a476f5e1d8a177721e116fd9b8554b4a3eb00f6f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-34626.exe

Filesize
468KB

MD5
2d0603162b660e80df5c0265dabd9adb

SHA1
bf4021b27ba241568bc565bbc87cbb0173554aef

SHA256
552fd334691016864a45426c34de114299dc0b9a1e97a37dede2dcaefad1f1e0

SHA512
d94f8283db1999053d4a1a2f8b0f1672b05f084685ef1df2541be1d767eba408c9ec8a237e79c6fcf66219da581c209410d4314aeb125404c536022b1a5acc0b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-38134.exe

Filesize
468KB

MD5
dd371aea87a47219a6c2a99b09857a72

SHA1
fbbb10fbe7981bfe3fd446df990bc2b04e35586f

SHA256
f4d1e9c119812036626045fe89f3155d2562df5fb03d64f3114b2509b444c356

SHA512
1379558fdc2dc0ef8330005e8d508cff6004bb17458527130ccc90b132ae45eb42e298ea91cbabc107a5464f2d3909dc849f5cd0a7c9186421463679c8037fea

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39203.exe

Filesize
468KB

MD5
9ee25c9ac21a60e064c6d5912ee8dc69

SHA1
b547208f4ab8fc8e777f0175832f5d162ee31956

SHA256
ff5666311e21c3b140a3a1514d75c4df1ad1b3c665d050c0802e1222bfcfc026

SHA512
74250b53278a4d45209d7b6ce1854c9a321afa4e6a2871dca9508212a359b264af218a37d4e6b6a8feda0cd66559bf16f5127307df217700ca5c95a6157254a9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-55586.exe

Filesize
468KB

MD5
a4a986b66e6f49f30528082388379e79

SHA1
6c057b874ed5131c31deac3979b5fb03e6625aa7

SHA256
23dd5ac8637071d9bf8ef41723db42f3678c25a4c12f8255abb708b762d7a3cb

SHA512
264fab2061c4a943a81c8242dced63367b1824841c5e2912c0a2288fc1d994ca51b066c8bf34f6166b84c97a1feb04f4a15f7a7079ff6029205141bbcbf89d01

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-11242.exe

Filesize
468KB

MD5
9fe648155c1686abb2ae5d47a670a1ee

SHA1
9557e5b2c1a513cf5f003102ea2be2e68e80b7c6

SHA256
8fbe20023181dd29e260627324811b8885588d368522f1df68a03a9d4decee3f

SHA512
f432c0bf0290e4039067b3bff76347604c2ec0cbc50708b326cdc4e633e0fa1c8afd74d7db2488269374c7e4eff18039c91d09c82942022e443d0710dfb5564a

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-11408.exe

Filesize
468KB

MD5
1e5ba0626ca4261db3435b136e83d7d9

SHA1
ec3fd618e83e18ac697bec8eda54df6177fb0ec8

SHA256
581811992db997c080cf6aa1c109509411cb81873c6ba7f69d31fad95d217ee1

SHA512
94f721e7321f587f00538afeb6a2372991558a56aa60ed2900771206dfb2497489b2810e286cde2c2c0e71e5be1b989ef9f51f21afeb54436b7a1240e7726da0

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-1211.exe

Filesize
468KB

MD5
ff8af677e7c78b4266eea262265c400a

SHA1
7dc278de4e8bca626c17c58d2ac27c01f94a0668

SHA256
783f36344e3ad689f74a27f6bf2f6fe431cd0ebe62bc8e4733edb5f9dcfd64c8

SHA512
e45557927c92941ef3f39255f4632beadac6e8520986827e6a02fec7361c0301365ed5d4946e84144139802d19630f5755542c73aa9ca62d65f8d1a56d6dc309

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-14101.exe

Filesize
468KB

MD5
cbe6517fcb11813244c1a9c2bdfd0816

SHA1
92fd9964a145b461eaba4de1a5b2cb80add8b0c1

SHA256
c746d977907dfeee5cfd2dc6913f53649a53af9bb5387a578781bf06de02ab9e

SHA512
b7953341369c62ad399c07dfceb200abd3e08735d56b066ace54c4b8540a769813aac51572b13fb0f2f4019c11bca55784ae8f56b05e86ac61ce0acd995269ce

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-18830.exe

Filesize
468KB

MD5
6d75026a08d50b74e00f4eba6e25d9ef

SHA1
3399e02885800961ad6e42969e340443a9c1b6dd

SHA256
fc626fd2edc82ff93fdc8d2072f34c88009f55676161af16a12d4d902d5da82a

SHA512
d8cc0862599d527e198878eb3a2218437987064f4794f445136968e06c2f40eb39ffe337030b5410303586d14ac8c015b956b6173c3f77ab3bf1f3747cbe81b5

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-20867.exe

Filesize
468KB

MD5
2885a3294d90b4dfad45639e1be7929c

SHA1
b90da237b51e4caf49fed6f9f4b5aa20d941dcd4

SHA256
63e6f1fe05b0c0cbbb06d720fe13885781a0528cff0b3f3c1daedcd1b3ac0acc

SHA512
37532b416f9a1b7c524671e2fb9e632a9dd444bb39487b0594b45881d7b4e2a0b99b965868468fd49106a048275b1d6717548fc5150f00306f8fb93f5fb43fcc

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-23468.exe

Filesize
468KB

MD5
2b9410e231c373c2464e7e88df31f41f

SHA1
321808f174c5913092ceba06799ce829eb18322d

SHA256
85c40253d0e4ec3271bc30bc1482a3900181505908b33ad87fec75b052f872a3

SHA512
d86e39c722685c73624260e9daeaffde9f7b6a5b649d71f62d48f85be052e8dafba5f124c8ed1357dbd70ab46d66831d1300717285a1ab52c86ccd9ed20eeb98

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-26951.exe

Filesize
468KB

MD5
bffafc96787fdf16ed3763502aee6c48

SHA1
ff6daa1e65f385528b655cc6a86a2c73377c6ddb

SHA256
b5e5ccb23d101abed61efc6769c36fb0f7cedb9d4677941111d989e1322513d4

SHA512
a020b69d3018cc93a4f9c2b4aee359f4ce48800e349260f5d2b3f39b2c6e4ee2907d1e719f9c95ad8bb77f9c430e1e5f02d7f8f15640edb0cd86ea877847281b

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-32021.exe

Filesize
468KB

MD5
0f719d65d7e3e40bdd92c1da400bea23

SHA1
09416b892c4ba1eceeca69faf29cb767593c3f3b

SHA256
c6fd85ad2254a6e3b18b6aefb3f39b4f4ad51db8ef97efe942398b855d6bac49

SHA512
61200d7890ae1b0ba5947ae0c3e5bff8119d86533472d7f5082a4a09d10f894b1b718255ffb33e7def1a09981975ebe700833098e5c084ee548b6931268d160e

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-34361.exe

Filesize
468KB

MD5
5452bf92b786bcbe663c188d6fe927b5

SHA1
6dcf2fbc1c7a75976a038a3887319a0fec8070fd

SHA256
08f80c92a5c6a5e35a166285213d37e6ba2a41a333659b5f8769f41ea3b73faa

SHA512
b61362e842986fe0d02ef693448ed612b7b7a88745f5bd847fef8eb37371c267ccd191d5254fc84299b23fef11cb51467fdbde10a6505480df6a20da133d68cb

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-4947.exe

Filesize
468KB

MD5
ebc6c3db3fdcf4b7d125c8fcc293b90f

SHA1
486e201fbb8c7576ccdc115ddced347571930f6c

SHA256
b64f03733f070262614c263953b2848ea5e322db96c457a33cab37a4572ddd2a

SHA512
d7d246c4af3bf8be9bc2e8a8688a1252b89dc141d7e06b22bf983e66a561f4696b3d1ecd543dfe012265d02e8aac2b5f16ec6dc43b615c1760fa82b942f32010

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-54148.exe

Filesize
468KB

MD5
a3873cf33cbac9f6419ae844fa5be10f

SHA1
566793a511e932e39f9a548b9695d85621e8e67d

SHA256
6d12ef4b01339dd0c2ac4b3e762da405fc43d5ce6609ae5b18f5bf6b3f58f210

SHA512
f685274b58b3af814f3c23055d55716169cdcbf93ec78e26a443dec866dabfaf8175e6dab30a003604cb5c1b83235432873d5b7d026772ae3a02f17a9e9b8818

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-59135.exe

Filesize
468KB

MD5
882b774d2e856ef381d98e9a33cdf5ea

SHA1
c7e2723a1657ba1b500bcbf66322090fcc6b32ec

SHA256
fc64784ccadcd2bf1bf6cf6b89b0ae5bd80cec6cefb5b1083b82bc17022a31c2

SHA512
6090e10107f023287bf9a5d0d5c0c3dcace3d2e76f5360b7c8d72675fe0913856aadc162b4f02a3c77da9dc1f0e7236a2929c478d1e8ecb342acac0043d3e69f

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-9362.exe

Filesize
468KB

MD5
a1d145a8568d8d43ef114fbd675e9555

SHA1
363c376ae3141be7d003c9abdb3ffce2902f96bc

SHA256
db277b0794de1eecf1cc6743c0bd8a8e9f6eea5510050705718a5ed9ad83e5cb

SHA512
e83b84c064d2b73cedf7fbd9d76a7c020ca05e3de44a11c5ec009a48061837e046fd4b0d82a044d66ca66b9e858a8b9868a97f66275655580d368add1f91702d

Download Submit
memory/264-84-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/264-283-0x0000000001E00000-0x0000000001E75000-memory.dmp

Filesize
468KB

Download
memory/264-284-0x0000000001E00000-0x0000000001E75000-memory.dmp

Filesize
468KB

Download
memory/264-165-0x0000000001E00000-0x0000000001E75000-memory.dmp

Filesize
468KB

Download
memory/264-173-0x0000000001E00000-0x0000000001E75000-memory.dmp

Filesize
468KB

Download
memory/268-391-0x00000000020B0000-0x0000000002125000-memory.dmp

Filesize
468KB

Download
memory/268-232-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/352-287-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/540-146-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/540-321-0x00000000009C0000-0x0000000000A35000-memory.dmp

Filesize
468KB

Download
memory/540-311-0x00000000009C0000-0x0000000000A35000-memory.dmp

Filesize
468KB

Download
memory/560-290-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/772-413-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/868-397-0x0000000001D80000-0x0000000001DF5000-memory.dmp

Filesize
468KB

Download
memory/868-228-0x0000000001D80000-0x0000000001DF5000-memory.dmp

Filesize
468KB

Download
memory/868-227-0x0000000001D80000-0x0000000001DF5000-memory.dmp

Filesize
468KB

Download
memory/868-110-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1200-380-0x0000000002840000-0x00000000028B5000-memory.dmp

Filesize
468KB

Download
memory/1200-213-0x0000000002840000-0x00000000028B5000-memory.dmp

Filesize
468KB

Download
memory/1200-212-0x0000000003370000-0x00000000033E5000-memory.dmp

Filesize
468KB

Download
memory/1200-51-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1200-381-0x0000000002840000-0x00000000028B5000-memory.dmp

Filesize
468KB

Download
memory/1200-392-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1200-108-0x0000000003370000-0x00000000033E5000-memory.dmp

Filesize
468KB

Download
memory/1452-250-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1516-320-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1564-350-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/1564-358-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/1564-202-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1604-239-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1636-323-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1660-215-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1660-370-0x0000000001FA0000-0x0000000002015000-memory.dmp

Filesize
468KB

Download
memory/1692-371-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1736-162-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1736-285-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/1736-286-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/1780-175-0x00000000026A0000-0x0000000002715000-memory.dmp

Filesize
468KB

Download
memory/1780-10-0x00000000026A0000-0x0000000002715000-memory.dmp

Filesize
468KB

Download
memory/1780-299-0x00000000026A0000-0x0000000002715000-memory.dmp

Filesize
468KB

Download
memory/1780-35-0x00000000026A0000-0x0000000002715000-memory.dmp

Filesize
468KB

Download
memory/1780-11-0x00000000026A0000-0x0000000002715000-memory.dmp

Filesize
468KB

Download
memory/1780-319-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1780-327-0x00000000026A0000-0x0000000002715000-memory.dmp

Filesize
468KB

Download
memory/1780-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1780-78-0x00000000026A0000-0x0000000002715000-memory.dmp

Filesize
468KB

Download
memory/1780-181-0x00000000026A0000-0x0000000002715000-memory.dmp

Filesize
468KB

Download
memory/1788-182-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1788-277-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/1788-278-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/1884-270-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1936-328-0x0000000002350000-0x00000000023C5000-memory.dmp

Filesize
468KB

Download
memory/1936-148-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2016-268-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2016-269-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2016-174-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2032-306-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2100-360-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2100-361-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2100-109-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2100-200-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2100-199-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2144-329-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2216-310-0x00000000025D0000-0x0000000002645000-memory.dmp

Filesize
468KB

Download
memory/2216-19-0x00000000025D0000-0x0000000002645000-memory.dmp

Filesize
468KB

Download
memory/2216-13-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2216-145-0x00000000025D0000-0x0000000002645000-memory.dmp

Filesize
468KB

Download
memory/2216-344-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2216-68-0x00000000025D0000-0x0000000002645000-memory.dmp

Filesize
468KB

Download
memory/2256-393-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2468-260-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2572-259-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2572-258-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2572-72-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2572-122-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2620-144-0x0000000001EE0000-0x0000000001F55000-memory.dmp

Filesize
468KB

Download
memory/2620-312-0x0000000001EE0000-0x0000000001F55000-memory.dmp

Filesize
468KB

Download
memory/2620-71-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2620-143-0x0000000001EE0000-0x0000000001F55000-memory.dmp

Filesize
468KB

Download
memory/2672-415-0x00000000025F0000-0x0000000002665000-memory.dmp

Filesize
468KB

Download
memory/2672-241-0x00000000025F0000-0x0000000002665000-memory.dmp

Filesize
468KB

Download
memory/2672-246-0x00000000025F0000-0x0000000002665000-memory.dmp

Filesize
468KB

Download
memory/2672-123-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2688-387-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2688-151-0x0000000002820000-0x0000000002895000-memory.dmp

Filesize
468KB

Download
memory/2688-37-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2688-307-0x0000000002820000-0x0000000002895000-memory.dmp

Filesize
468KB

Download
memory/2736-362-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2744-351-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2788-376-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2788-50-0x0000000002950000-0x00000000029C5000-memory.dmp

Filesize
468KB

Download
memory/2788-233-0x00000000026D0000-0x0000000002745000-memory.dmp

Filesize
468KB

Download
memory/2788-399-0x00000000026D0000-0x0000000002745000-memory.dmp

Filesize
468KB

Download
memory/2788-238-0x00000000026D0000-0x0000000002745000-memory.dmp

Filesize
468KB

Download
memory/2864-382-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3068-322-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download