df76bebf7011d49521c66796ae303ab86df8e61f54e7c5b826d2b570c0f6b71e

Analysis

max time kernel
120s
max time network
130s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
14/10/2024, 15:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

df76bebf7011d49521c66796ae303ab86df8e61f54e7c5b826d2b570c0f6b71eN.exe
Size

468KB
MD5

8b0702deefa389a7f04fec0bb6726790
SHA1

5a566fd80127fe58cbb554e43cc890831e4fa1de
SHA256

df76bebf7011d49521c66796ae303ab86df8e61f54e7c5b826d2b570c0f6b71e
SHA512

047454e3c713115ea05c8ea42564c8bbb1377f401172281116432251b2d48c0ea65f0f6e2dd4b8b4cd4808206f89fe204e722e5cc5f66a0167d3f548e099eff6
SSDEEP

3072:7+mnogBCj28a2by5P7H/PfP/oDhjyIp4PmHBNTfb8VU+PTRr7vlD:7+WoFXa2AP7/PfR01x8VjrRr7

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2968	Unicorn-6920.exe
2692	Unicorn-24072.exe
2668	Unicorn-49323.exe
2608	Unicorn-41643.exe
3064	Unicorn-62810.exe
808	Unicorn-994.exe
584	Unicorn-19368.exe
2868	Unicorn-51394.exe
2912	Unicorn-52354.exe
2752	Unicorn-65161.exe
3044	Unicorn-52546.exe
1736	Unicorn-44113.exe
2116	Unicorn-34054.exe
2376	Unicorn-47476.exe
2408	Unicorn-23526.exe
1088	Unicorn-20925.exe
2260	Unicorn-36184.exe
2160	Unicorn-8342.exe
968	Unicorn-3127.exe
1480	Unicorn-31716.exe
1732	Unicorn-11850.exe
920	Unicorn-1273.exe
1276	Unicorn-31716.exe
2320	Unicorn-64010.exe
2432	Unicorn-32375.exe
1688	Unicorn-7605.exe
3016	Unicorn-12914.exe
2736	Unicorn-833.exe
2052	Unicorn-45587.exe
1680	Unicorn-64885.exe
2540	Unicorn-46703.exe
2808	Unicorn-34429.exe
2212	Unicorn-48165.exe
3020	Unicorn-54295.exe
1916	Unicorn-54295.exe
556	Unicorn-35913.exe
2124	Unicorn-20288.exe
1920	Unicorn-37636.exe
1580	Unicorn-57502.exe
2908	Unicorn-61586.exe
3064	Unicorn-32036.exe
2880	Unicorn-61586.exe
1788	Unicorn-38596.exe
1384	Unicorn-58462.exe
1892	Unicorn-62281.exe
1716	Unicorn-42894.exe
840	Unicorn-51617.exe
2256	Unicorn-5945.exe
2400	Unicorn-30071.exe
1808	Unicorn-22644.exe
2360	Unicorn-22282.exe
1288	Unicorn-52908.exe
2040	Unicorn-18089.exe
2216	Unicorn-30895.exe
1624	Unicorn-6028.exe
2840	Unicorn-63376.exe
2404	Unicorn-17439.exe
2528	Unicorn-62629.exe
2016	Unicorn-24978.exe
792	Unicorn-11243.exe
1796	Unicorn-11435.exe
1252	Unicorn-22749.exe
2924	Unicorn-19219.exe
2516	Unicorn-39085.exe

Loads dropped DLL 64 IoCs

pid	Process
2732	df76bebf7011d49521c66796ae303ab86df8e61f54e7c5b826d2b570c0f6b71eN.exe
2732	df76bebf7011d49521c66796ae303ab86df8e61f54e7c5b826d2b570c0f6b71eN.exe
2968	Unicorn-6920.exe
2968	Unicorn-6920.exe
2732	df76bebf7011d49521c66796ae303ab86df8e61f54e7c5b826d2b570c0f6b71eN.exe
2732	df76bebf7011d49521c66796ae303ab86df8e61f54e7c5b826d2b570c0f6b71eN.exe
2692	Unicorn-24072.exe
2692	Unicorn-24072.exe
2968	Unicorn-6920.exe
2968	Unicorn-6920.exe
2668	Unicorn-49323.exe
2668	Unicorn-49323.exe
2732	df76bebf7011d49521c66796ae303ab86df8e61f54e7c5b826d2b570c0f6b71eN.exe
2732	df76bebf7011d49521c66796ae303ab86df8e61f54e7c5b826d2b570c0f6b71eN.exe
2076	WerFault.exe
2076	WerFault.exe
2076	WerFault.exe
2076	WerFault.exe
2076	WerFault.exe
2608	Unicorn-41643.exe
2608	Unicorn-41643.exe
808	Unicorn-994.exe
808	Unicorn-994.exe
2668	Unicorn-49323.exe
2668	Unicorn-49323.exe
584	Unicorn-19368.exe
584	Unicorn-19368.exe
2732	df76bebf7011d49521c66796ae303ab86df8e61f54e7c5b826d2b570c0f6b71eN.exe
2732	df76bebf7011d49521c66796ae303ab86df8e61f54e7c5b826d2b570c0f6b71eN.exe
2968	Unicorn-6920.exe
2968	Unicorn-6920.exe
2868	Unicorn-51394.exe
2868	Unicorn-51394.exe
2608	Unicorn-41643.exe
2608	Unicorn-41643.exe
2692	Unicorn-24072.exe
2692	Unicorn-24072.exe
2912	Unicorn-52354.exe
2912	Unicorn-52354.exe
808	Unicorn-994.exe
808	Unicorn-994.exe
3044	Unicorn-52546.exe
3044	Unicorn-52546.exe
584	Unicorn-19368.exe
1736	Unicorn-44113.exe
2752	Unicorn-65161.exe
584	Unicorn-19368.exe
1736	Unicorn-44113.exe
2752	Unicorn-65161.exe
2668	Unicorn-49323.exe
2668	Unicorn-49323.exe
2732	df76bebf7011d49521c66796ae303ab86df8e61f54e7c5b826d2b570c0f6b71eN.exe
2732	df76bebf7011d49521c66796ae303ab86df8e61f54e7c5b826d2b570c0f6b71eN.exe
2116	Unicorn-34054.exe
2116	Unicorn-34054.exe
2968	Unicorn-6920.exe
2968	Unicorn-6920.exe
2376	Unicorn-47476.exe
2376	Unicorn-47476.exe
2868	Unicorn-51394.exe
2868	Unicorn-51394.exe
2160	Unicorn-8342.exe
2160	Unicorn-8342.exe
808	Unicorn-994.exe

Program crash 3 IoCs

pid	pid_target	Process	procid_target
2076	3064	WerFault.exe	34
1860	2840	WerFault.exe	87
3080	2704	WerFault.exe	135

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3994.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55092.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56637.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17598.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42949.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27717.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49323.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3127.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28842.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41179.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47668.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24784.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23348.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22666.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5449.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11049.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51617.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63457.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48165.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-704.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44629.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11236.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33017.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	df76bebf7011d49521c66796ae303ab86df8e61f54e7c5b826d2b570c0f6b71eN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20693.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41548.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7816.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52546.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40559.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18532.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15739.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34800.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46816.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47053.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-883.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59604.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42844.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38952.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63332.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45263.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11050.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49853.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46649.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64940.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2455.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42016.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51205.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64940.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62629.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38992.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60159.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41548.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41548.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11049.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27717.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51713.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59056.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9548.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64885.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34429.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7626.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65203.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16567.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47044.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2732	df76bebf7011d49521c66796ae303ab86df8e61f54e7c5b826d2b570c0f6b71eN.exe
2968	Unicorn-6920.exe
2692	Unicorn-24072.exe
2668	Unicorn-49323.exe
2608	Unicorn-41643.exe
3064	Unicorn-62810.exe
808	Unicorn-994.exe
584	Unicorn-19368.exe
2868	Unicorn-51394.exe
2912	Unicorn-52354.exe
3044	Unicorn-52546.exe
2752	Unicorn-65161.exe
1736	Unicorn-44113.exe
2116	Unicorn-34054.exe
2376	Unicorn-47476.exe
2408	Unicorn-23526.exe
2160	Unicorn-8342.exe
2260	Unicorn-36184.exe
968	Unicorn-3127.exe
1088	Unicorn-20925.exe
1480	Unicorn-31716.exe
920	Unicorn-1273.exe
1276	Unicorn-31716.exe
1732	Unicorn-11850.exe
2320	Unicorn-64010.exe
2432	Unicorn-32375.exe
1688	Unicorn-7605.exe
2736	Unicorn-833.exe
2052	Unicorn-45587.exe
1680	Unicorn-64885.exe
2540	Unicorn-46703.exe
1916	Unicorn-54295.exe
3020	Unicorn-54295.exe
3064	Unicorn-32036.exe
2808	Unicorn-34429.exe
556	Unicorn-35913.exe
2908	Unicorn-61586.exe
2880	Unicorn-61586.exe
1920	Unicorn-37636.exe
2212	Unicorn-48165.exe
2124	Unicorn-20288.exe
1580	Unicorn-57502.exe
1384	Unicorn-58462.exe
1788	Unicorn-38596.exe
1892	Unicorn-62281.exe
1716	Unicorn-42894.exe
840	Unicorn-51617.exe
2256	Unicorn-5945.exe
2400	Unicorn-30071.exe
1324	Unicorn-22666.exe
1808	Unicorn-22644.exe
2360	Unicorn-22282.exe
1288	Unicorn-52908.exe
2216	Unicorn-30895.exe
2040	Unicorn-18089.exe
1624	Unicorn-6028.exe
2840	Unicorn-63376.exe
2404	Unicorn-17439.exe
2528	Unicorn-62629.exe
2016	Unicorn-24978.exe
792	Unicorn-11243.exe
1796	Unicorn-11435.exe
1252	Unicorn-22749.exe
2516	Unicorn-39085.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2732 wrote to memory of 2968	2732	df76bebf7011d49521c66796ae303ab86df8e61f54e7c5b826d2b570c0f6b71eN.exe	30
PID 2732 wrote to memory of 2968	2732	df76bebf7011d49521c66796ae303ab86df8e61f54e7c5b826d2b570c0f6b71eN.exe	30
PID 2732 wrote to memory of 2968	2732	df76bebf7011d49521c66796ae303ab86df8e61f54e7c5b826d2b570c0f6b71eN.exe	30
PID 2732 wrote to memory of 2968	2732	df76bebf7011d49521c66796ae303ab86df8e61f54e7c5b826d2b570c0f6b71eN.exe	30
PID 2968 wrote to memory of 2692	2968	Unicorn-6920.exe	31
PID 2968 wrote to memory of 2692	2968	Unicorn-6920.exe	31
PID 2968 wrote to memory of 2692	2968	Unicorn-6920.exe	31
PID 2968 wrote to memory of 2692	2968	Unicorn-6920.exe	31
PID 2732 wrote to memory of 2668	2732	df76bebf7011d49521c66796ae303ab86df8e61f54e7c5b826d2b570c0f6b71eN.exe	32
PID 2732 wrote to memory of 2668	2732	df76bebf7011d49521c66796ae303ab86df8e61f54e7c5b826d2b570c0f6b71eN.exe	32
PID 2732 wrote to memory of 2668	2732	df76bebf7011d49521c66796ae303ab86df8e61f54e7c5b826d2b570c0f6b71eN.exe	32
PID 2732 wrote to memory of 2668	2732	df76bebf7011d49521c66796ae303ab86df8e61f54e7c5b826d2b570c0f6b71eN.exe	32
PID 2692 wrote to memory of 2608	2692	Unicorn-24072.exe	33
PID 2692 wrote to memory of 2608	2692	Unicorn-24072.exe	33
PID 2692 wrote to memory of 2608	2692	Unicorn-24072.exe	33
PID 2692 wrote to memory of 2608	2692	Unicorn-24072.exe	33
PID 2968 wrote to memory of 3064	2968	Unicorn-6920.exe	34
PID 2968 wrote to memory of 3064	2968	Unicorn-6920.exe	34
PID 2968 wrote to memory of 3064	2968	Unicorn-6920.exe	34
PID 2968 wrote to memory of 3064	2968	Unicorn-6920.exe	34
PID 2668 wrote to memory of 808	2668	Unicorn-49323.exe	35
PID 2668 wrote to memory of 808	2668	Unicorn-49323.exe	35
PID 2668 wrote to memory of 808	2668	Unicorn-49323.exe	35
PID 2668 wrote to memory of 808	2668	Unicorn-49323.exe	35
PID 2732 wrote to memory of 584	2732	df76bebf7011d49521c66796ae303ab86df8e61f54e7c5b826d2b570c0f6b71eN.exe	36
PID 2732 wrote to memory of 584	2732	df76bebf7011d49521c66796ae303ab86df8e61f54e7c5b826d2b570c0f6b71eN.exe	36
PID 2732 wrote to memory of 584	2732	df76bebf7011d49521c66796ae303ab86df8e61f54e7c5b826d2b570c0f6b71eN.exe	36
PID 2732 wrote to memory of 584	2732	df76bebf7011d49521c66796ae303ab86df8e61f54e7c5b826d2b570c0f6b71eN.exe	36
PID 3064 wrote to memory of 2076	3064	Unicorn-62810.exe	37
PID 3064 wrote to memory of 2076	3064	Unicorn-62810.exe	37
PID 3064 wrote to memory of 2076	3064	Unicorn-62810.exe	37
PID 3064 wrote to memory of 2076	3064	Unicorn-62810.exe	37
PID 2608 wrote to memory of 2868	2608	Unicorn-41643.exe	38
PID 2608 wrote to memory of 2868	2608	Unicorn-41643.exe	38
PID 2608 wrote to memory of 2868	2608	Unicorn-41643.exe	38
PID 2608 wrote to memory of 2868	2608	Unicorn-41643.exe	38
PID 808 wrote to memory of 2912	808	Unicorn-994.exe	39
PID 808 wrote to memory of 2912	808	Unicorn-994.exe	39
PID 808 wrote to memory of 2912	808	Unicorn-994.exe	39
PID 808 wrote to memory of 2912	808	Unicorn-994.exe	39
PID 2668 wrote to memory of 2752	2668	Unicorn-49323.exe	40
PID 2668 wrote to memory of 2752	2668	Unicorn-49323.exe	40
PID 2668 wrote to memory of 2752	2668	Unicorn-49323.exe	40
PID 2668 wrote to memory of 2752	2668	Unicorn-49323.exe	40
PID 584 wrote to memory of 3044	584	Unicorn-19368.exe	41
PID 584 wrote to memory of 3044	584	Unicorn-19368.exe	41
PID 584 wrote to memory of 3044	584	Unicorn-19368.exe	41
PID 584 wrote to memory of 3044	584	Unicorn-19368.exe	41
PID 2732 wrote to memory of 1736	2732	df76bebf7011d49521c66796ae303ab86df8e61f54e7c5b826d2b570c0f6b71eN.exe	42
PID 2732 wrote to memory of 1736	2732	df76bebf7011d49521c66796ae303ab86df8e61f54e7c5b826d2b570c0f6b71eN.exe	42
PID 2732 wrote to memory of 1736	2732	df76bebf7011d49521c66796ae303ab86df8e61f54e7c5b826d2b570c0f6b71eN.exe	42
PID 2732 wrote to memory of 1736	2732	df76bebf7011d49521c66796ae303ab86df8e61f54e7c5b826d2b570c0f6b71eN.exe	42
PID 2968 wrote to memory of 2116	2968	Unicorn-6920.exe	43
PID 2968 wrote to memory of 2116	2968	Unicorn-6920.exe	43
PID 2968 wrote to memory of 2116	2968	Unicorn-6920.exe	43
PID 2968 wrote to memory of 2116	2968	Unicorn-6920.exe	43
PID 2868 wrote to memory of 2376	2868	Unicorn-51394.exe	44
PID 2868 wrote to memory of 2376	2868	Unicorn-51394.exe	44
PID 2868 wrote to memory of 2376	2868	Unicorn-51394.exe	44
PID 2868 wrote to memory of 2376	2868	Unicorn-51394.exe	44
PID 2608 wrote to memory of 2408	2608	Unicorn-41643.exe	45
PID 2608 wrote to memory of 2408	2608	Unicorn-41643.exe	45
PID 2608 wrote to memory of 2408	2608	Unicorn-41643.exe	45
PID 2608 wrote to memory of 2408	2608	Unicorn-41643.exe	45

C:\Users\Admin\AppData\Local\Temp\df76bebf7011d49521c66796ae303ab86df8e61f54e7c5b826d2b570c0f6b71eN.exe
"C:\Users\Admin\AppData\Local\Temp\df76bebf7011d49521c66796ae303ab86df8e61f54e7c5b826d2b570c0f6b71eN.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2732
- C:\Users\Admin\AppData\Local\Temp\Unicorn-6920.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-6920.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2968
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24072.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24072.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2692
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41643.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41643.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51394.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47476.exe
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:2376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12914.exe
        7⤵
        Executes dropped EXE
        
        PID:3016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22666.exe
        8⤵
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38992.exe
        9⤵
        
        PID:2440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18532.exe
        9⤵
        
        PID:4940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14131.exe
        9⤵
        
        PID:5912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58557.exe
        9⤵
        
        PID:7144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19126.exe
        8⤵
        
        PID:2428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19465.exe
        8⤵
        
        PID:4220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8761.exe
        8⤵
        
        PID:5228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50823.exe
        8⤵
        
        PID:5196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49884.exe
        8⤵
        
        PID:6688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22644.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40559.exe
        8⤵
        
        PID:1940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-704.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:3596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42844.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:4700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34600.exe
        9⤵
        
        PID:5172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49892.exe
        9⤵
        
        PID:6368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37356.exe
        8⤵
        
        PID:3280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64940.exe
        8⤵
        
        PID:5076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60837.exe
        8⤵
        
        PID:6088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62144.exe
        8⤵
        
        PID:6200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30344.exe
        7⤵
        
        PID:2976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28333.exe
        8⤵
        
        PID:3564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23540.exe
        8⤵
        
        PID:4272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22299.exe
        8⤵
        
        PID:5760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58557.exe
        8⤵
        
        PID:7008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56957.exe
        7⤵
        
        PID:3288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53780.exe
        7⤵
        
        PID:4692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2964.exe
        7⤵
        
        PID:5700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5497.exe
        7⤵
        
        PID:6944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-833.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22282.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38369.exe
        8⤵
        
        PID:948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41548.exe
        9⤵
        
        PID:3312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21065.exe
        9⤵
        
        PID:844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54994.exe
        9⤵
        
        PID:6216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38402.exe
        8⤵
        
        PID:1160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47053.exe
        8⤵
        
        PID:5136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38684.exe
        8⤵
        
        PID:5564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49892.exe
        8⤵
        
        PID:6312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62743.exe
        7⤵
        
        PID:2188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52138.exe
        7⤵
        
        PID:2060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52918.exe
        7⤵
        
        PID:4456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30018.exe
        7⤵
        
        PID:5568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33356.exe
        7⤵
        
        PID:6376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52908.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58213.exe
        7⤵
        
        PID:2936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54900.exe
        8⤵
        
        PID:3940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57173.exe
        8⤵
        
        PID:4196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10178.exe
        8⤵
        
        PID:5816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36653.exe
        7⤵
        
        PID:4404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37546.exe
        7⤵
        
        PID:6352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38104.exe
        6⤵
        
        PID:2120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49338.exe
        6⤵
        
        PID:3168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27717.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42993.exe
        6⤵
        
        PID:5656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28891.exe
        6⤵
        
        PID:6276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23526.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54295.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39085.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59604.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:2764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1537.exe
        8⤵
        
        PID:4304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10955.exe
        8⤵
        
        PID:5472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13632.exe
        8⤵
        
        PID:6876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2681.exe
        7⤵
        
        PID:2208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62139.exe
        7⤵
        
        PID:4504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53132.exe
        7⤵
        
        PID:5780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33356.exe
        7⤵
        
        PID:2504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28347.exe
        6⤵
        
        PID:2264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36610.exe
        7⤵
        
        PID:2356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23540.exe
        7⤵
        
        PID:4312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59056.exe
        7⤵
        
        PID:5340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58557.exe
        7⤵
        
        PID:6996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22036.exe
        6⤵
        
        PID:264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5268.exe
        6⤵
        
        PID:4116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56256.exe
        6⤵
        
        PID:5224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25188.exe
        6⤵
        
        PID:6588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48165.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4269.exe
        6⤵
        
        PID:2380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41548.exe
        7⤵
        
        PID:3320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33317.exe
        7⤵
        
        PID:5128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28734.exe
        7⤵
        
        PID:5384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58557.exe
        7⤵
        
        PID:7020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14038.exe
        6⤵
        
        PID:4000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64940.exe
        6⤵
        
        PID:5116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40993.exe
        6⤵
        
        PID:5628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4967.exe
        6⤵
        
        PID:6868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49121.exe
        5⤵
        
        PID:2564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30204.exe
        6⤵
        
        PID:3784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23300.exe
        6⤵
        
        PID:4488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30277.exe
        6⤵
        
        PID:5932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4967.exe
        6⤵
        
        PID:6924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4745.exe
        5⤵
        
        PID:4028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22024.exe
        5⤵
        
        PID:4200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56786.exe
        5⤵
        
        PID:5188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32975.exe
        5⤵
        
        PID:6484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20925.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20925.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58462.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59204.exe
        6⤵
        
        PID:2992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6127.exe
        7⤵
        
        PID:2184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43721.exe
        7⤵
        
        PID:4336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2455.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58557.exe
        7⤵
        
        PID:6660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24061.exe
        6⤵
        
        PID:2656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24784.exe
        6⤵
        
        PID:4588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3660.exe
        6⤵
        
        PID:6008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41724.exe
        6⤵
        
        PID:6672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23002.exe
        5⤵
        
        PID:628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9588.exe
        6⤵
        
        PID:1016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42016.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18698.exe
        6⤵
        
        PID:3976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5371.exe
        6⤵
        
        PID:4156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28933.exe
        6⤵
        
        PID:5832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-883.exe
        6⤵
        
        PID:6800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11050.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59679.exe
        5⤵
        
        PID:4064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59940.exe
        5⤵
        
        PID:4436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20644.exe
        5⤵
        
        PID:5620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62674.exe
        5⤵
        
        PID:7092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62281.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62281.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40559.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38992.exe
        6⤵
        
        PID:2472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46929.exe
        6⤵
        
        PID:4788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59056.exe
        6⤵
        
        PID:5284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58557.exe
        6⤵
        
        PID:6384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65203.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29444.exe
        5⤵
        
        PID:4440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64921.exe
        5⤵
        
        PID:5332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49892.exe
        5⤵
        
        PID:6416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6356.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6356.exe
      4⤵
      PID:1972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46649.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42844.exe
        5⤵
        
        PID:4708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35128.exe
        5⤵
        
        PID:5708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1188.exe
        5⤵
        
        PID:7032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16380.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16380.exe
      4⤵
      PID:3376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58394.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58394.exe
      4⤵
      PID:4868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35255.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35255.exe
      4⤵
      PID:5252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35808.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35808.exe
      4⤵
      PID:7124
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62810.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62810.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3064
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3064 -s 188
      4⤵
      Loads dropped DLL
      Program crash
      PID:2076
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34054.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34054.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32375.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32375.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42894.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38992.exe
        6⤵
        
        PID:1996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10089.exe
        6⤵
        
        PID:4284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27400.exe
        6⤵
        
        PID:5348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58557.exe
        6⤵
        
        PID:7140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19126.exe
        5⤵
        
        PID:2004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19465.exe
        5⤵
        
        PID:4240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41434.exe
        5⤵
        
        PID:5316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-883.exe
        5⤵
        
        PID:6712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51617.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51617.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3994.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38180.exe
        6⤵
        
        PID:3092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23540.exe
        6⤵
        
        PID:4168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22299.exe
        6⤵
        
        PID:5676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58557.exe
        6⤵
        
        PID:7080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50268.exe
        5⤵
        
        PID:3696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64940.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64921.exe
        5⤵
        
        PID:5216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4967.exe
        5⤵
        
        PID:6916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64553.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64553.exe
      4⤵
      PID:2448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5699.exe
        5⤵
        
        PID:3720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23348.exe
        5⤵
        
        PID:4992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14899.exe
        5⤵
        
        PID:5204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58557.exe
        5⤵
        
        PID:7044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21687.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21687.exe
      4⤵
      PID:3712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13816.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13816.exe
      4⤵
      PID:4648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60333.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60333.exe
      4⤵
      PID:5924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1413.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1413.exe
      4⤵
      PID:6816
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7605.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7605.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5945.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5945.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40559.exe
        5⤵
        
        PID:1932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56179.exe
        6⤵
        
        PID:1740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2004.exe
        6⤵
        
        PID:5032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8973.exe
        6⤵
        
        PID:5464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14610.exe
        5⤵
        
        PID:3652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62445.exe
        5⤵
        
        PID:4744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11331.exe
        5⤵
        
        PID:5868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33356.exe
        5⤵
        
        PID:6320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37605.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37605.exe
      4⤵
      PID:1644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24249.exe
        5⤵
        
        PID:3544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2004.exe
        5⤵
        
        PID:5040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59056.exe
        5⤵
        
        PID:4380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50389.exe
        5⤵
        
        PID:6540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59151.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59151.exe
      4⤵
      PID:3500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30650.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30650.exe
      4⤵
      PID:4520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32327.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32327.exe
      4⤵
      PID:5716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45608.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45608.exe
      4⤵
      PID:7148
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30071.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30071.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2400
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56080.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56080.exe
      4⤵
      PID:2524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23782.exe
        5⤵
        
        PID:1888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51205.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59056.exe
        5⤵
        
        PID:5208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50389.exe
        5⤵
        
        PID:6532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11892.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11892.exe
      4⤵
      PID:2560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15739.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15739.exe
      4⤵
      PID:5024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6173.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6173.exe
      4⤵
      PID:5616
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6878.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6878.exe
    3⤵
    PID:624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13397.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13397.exe
      4⤵
      PID:1856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22367.exe
        5⤵
        
        PID:6624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39310.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39310.exe
      4⤵
      PID:3480
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37084.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37084.exe
      4⤵
      PID:4920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28933.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28933.exe
      4⤵
      PID:5856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-883.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-883.exe
      4⤵
      PID:6792
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62366.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62366.exe
    3⤵
    PID:2488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41548.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41548.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21065.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21065.exe
      4⤵
      PID:2372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41179.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41179.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5400
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13632.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13632.exe
      4⤵
      PID:6968
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17185.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17185.exe
    3⤵
    PID:3620
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7948.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7948.exe
    3⤵
    PID:4996
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30804.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30804.exe
    3⤵
    PID:5480
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20.exe
    3⤵
    PID:6392
- C:\Users\Admin\AppData\Local\Temp\Unicorn-49323.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-49323.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2668
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-994.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-994.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52354.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52354.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36184.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46703.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62629.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65400.exe
        8⤵
        
        PID:2108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24742.exe
        9⤵
        
        PID:1960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11049.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:4580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63332.exe
        9⤵
        
        PID:6024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28420.exe
        8⤵
        
        PID:2204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24784.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6173.exe
        8⤵
        
        PID:956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20693.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21953.exe
        8⤵
        
        PID:3728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11049.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42960.exe
        8⤵
        
        PID:5776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62144.exe
        8⤵
        
        PID:6180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51092.exe
        7⤵
        
        PID:3272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62445.exe
        7⤵
        
        PID:4632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60532.exe
        7⤵
        
        PID:5984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49884.exe
        7⤵
        
        PID:6784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11435.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30201.exe
        7⤵
        
        PID:2056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38402.exe
        7⤵
        
        PID:2532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47053.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38684.exe
        7⤵
        
        PID:5636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49892.exe
        7⤵
        
        PID:6344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53811.exe
        6⤵
        
        PID:272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37199.exe
        6⤵
        
        PID:3420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44253.exe
        6⤵
        
        PID:4620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25927.exe
        6⤵
        
        PID:5512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1413.exe
        6⤵
        
        PID:6720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34429.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27684.exe
        6⤵
        
        PID:2640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8545.exe
        7⤵
        
        PID:2544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41548.exe
        8⤵
        
        PID:3356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51080.exe
        8⤵
        
        PID:5492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58557.exe
        8⤵
        
        PID:6824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18314.exe
        7⤵
        
        PID:4080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64940.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19996.exe
        7⤵
        
        PID:5884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-883.exe
        7⤵
        
        PID:6764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63537.exe
        6⤵
        
        PID:2704
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2704 -s 240
        7⤵
        Program crash
        
        PID:3080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31473.exe
        6⤵
        
        PID:3260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42949.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20267.exe
        6⤵
        
        PID:5844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33356.exe
        6⤵
        
        PID:6212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58118.exe
        5⤵
        
        PID:2648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27461.exe
        6⤵
        
        PID:2636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59181.exe
        6⤵
        
        PID:4552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59056.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58557.exe
        6⤵
        
        PID:7100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38727.exe
        5⤵
        
        PID:2508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57864.exe
        5⤵
        
        PID:4852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39720.exe
        5⤵
        
        PID:5164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42254.exe
        5⤵
        
        PID:6620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8342.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8342.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45587.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18089.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17866.exe
        7⤵
        
        PID:2072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5123.exe
        8⤵
        
        PID:3340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23348.exe
        8⤵
        
        PID:4948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39980.exe
        8⤵
        
        PID:5660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13632.exe
        8⤵
        
        PID:6892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25906.exe
        7⤵
        
        PID:3220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45636.exe
        7⤵
        
        PID:4760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20764.exe
        7⤵
        
        PID:5260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49892.exe
        7⤵
        
        PID:6360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10444.exe
        6⤵
        
        PID:596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58751.exe
        7⤵
        
        PID:4604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55072.exe
        7⤵
        
        PID:5428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52692.exe
        7⤵
        
        PID:6296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56362.exe
        6⤵
        
        PID:3368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42949.exe
        6⤵
        
        PID:4904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24351.exe
        6⤵
        
        PID:6072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45608.exe
        6⤵
        
        PID:6148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30895.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1036.exe
        6⤵
        
        PID:580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17055.exe
        7⤵
        
        PID:5528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60721.exe
        7⤵
        
        PID:6340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42901.exe
        6⤵
        
        PID:3328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34800.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47044.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4967.exe
        6⤵
        
        PID:6852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61403.exe
        5⤵
        
        PID:2228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58003.exe
        5⤵
        
        PID:1756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44253.exe
        5⤵
        
        PID:2172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30011.exe
        5⤵
        
        PID:5588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58590.exe
        5⤵
        
        PID:7048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64885.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64885.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6028.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49853.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55154.exe
        6⤵
        
        PID:3228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52669.exe
        6⤵
        
        PID:5156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4967.exe
        6⤵
        
        PID:6860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46708.exe
        5⤵
        
        PID:328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56637.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44004.exe
        5⤵
        
        PID:6132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45608.exe
        5⤵
        
        PID:5992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17439.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17439.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38992.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10089.exe
        5⤵
        
        PID:4292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27400.exe
        5⤵
        
        PID:5364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58557.exe
        5⤵
        
        PID:6932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30061.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30061.exe
      4⤵
      PID:1952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5449.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5449.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4480
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56786.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56786.exe
      4⤵
      PID:5264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20723.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20723.exe
      4⤵
      PID:6640
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-65161.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-65161.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31716.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31716.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61586.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22749.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58213.exe
        7⤵
        
        PID:2068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62139.exe
        7⤵
        
        PID:4492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24351.exe
        7⤵
        
        PID:5976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25188.exe
        7⤵
        
        PID:6604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47668.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31333.exe
        6⤵
        
        PID:4040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16567.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25188.exe
        6⤵
        
        PID:6596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19219.exe
        5⤵
        Executes dropped EXE
        
        PID:2924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40502.exe
        6⤵
        
        PID:2200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23540.exe
        6⤵
        
        PID:4268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18215.exe
        6⤵
        
        PID:5940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58557.exe
        6⤵
        
        PID:7132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50433.exe
        5⤵
        
        PID:1528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62445.exe
        5⤵
        
        PID:4656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19499.exe
        5⤵
        
        PID:5692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53969.exe
        5⤵
        
        PID:6844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38596.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38596.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27684.exe
        5⤵
        
        PID:3024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5229.exe
        6⤵
        
        PID:2176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53510.exe
        7⤵
        
        PID:5608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64421.exe
        7⤵
        
        PID:6496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6254.exe
        6⤵
        
        PID:3684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37084.exe
        6⤵
        
        PID:4968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20764.exe
        6⤵
        
        PID:6112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49892.exe
        6⤵
        
        PID:6408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14035.exe
        5⤵
        
        PID:1712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41283.exe
        5⤵
        
        PID:3088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32000.exe
        5⤵
        
        PID:4612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21843.exe
        5⤵
        
        PID:5372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5497.exe
        5⤵
        
        PID:6960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29145.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29145.exe
      4⤵
      PID:2672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50813.exe
        5⤵
        
        PID:1256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45632.exe
        6⤵
        
        PID:3384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21065.exe
        6⤵
        
        PID:2612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41179.exe
        6⤵
        
        PID:5412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13632.exe
        6⤵
        
        PID:6908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17598.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47053.exe
        5⤵
        
        PID:4668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51128.exe
        5⤵
        
        PID:5652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-883.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27196.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27196.exe
      4⤵
      PID:1432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41548.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21065.exe
        5⤵
        
        PID:1084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45263.exe
        5⤵
        
        PID:5460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49338.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49338.exe
      4⤵
      PID:4052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27717.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27717.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37580.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37580.exe
      4⤵
      PID:944
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1273.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1273.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63376.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63376.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2840
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2840 -s 220
        5⤵
        Program crash
        
        PID:1860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38727.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38727.exe
      4⤵
      PID:608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28341.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28341.exe
      4⤵
      PID:4172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27717.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27717.exe
      4⤵
      PID:644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38909.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38909.exe
      4⤵
      PID:5200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49503.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49503.exe
      4⤵
      PID:6988
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20288.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20288.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47720.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47720.exe
      4⤵
      PID:2548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24249.exe
        5⤵
        
        PID:3552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27624.exe
        5⤵
        
        PID:4236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22299.exe
        5⤵
        
        PID:5752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58557.exe
        5⤵
        
        PID:7004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11892.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11892.exe
      4⤵
      PID:2644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56580.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56580.exe
      4⤵
      PID:4728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28165.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28165.exe
      4⤵
      PID:5664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4967.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4967.exe
      4⤵
      PID:6836
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31773.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31773.exe
    3⤵
    PID:2628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36610.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36610.exe
      4⤵
      PID:2700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23540.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23540.exe
      4⤵
      PID:4280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59056.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59056.exe
      4⤵
      PID:5292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58557.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58557.exe
      4⤵
      PID:7084
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64813.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64813.exe
    3⤵
    PID:1764
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54310.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54310.exe
    3⤵
    PID:4752
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35255.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35255.exe
    3⤵
    PID:5276
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23556.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23556.exe
    3⤵
    PID:6432
- C:\Users\Admin\AppData\Local\Temp\Unicorn-19368.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-19368.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:584
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52546.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52546.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:3044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3127.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3127.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57502.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44643.exe
        6⤵
        
        PID:2436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48862.exe
        7⤵
        
        PID:3112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2004.exe
        7⤵
        
        PID:5008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59056.exe
        7⤵
        
        PID:1428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62641.exe
        7⤵
        
        PID:6460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30897.exe
        6⤵
        
        PID:3884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5268.exe
        6⤵
        
        PID:4124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56256.exe
        6⤵
        
        PID:5308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33356.exe
        6⤵
        
        PID:6252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49282.exe
        5⤵
        
        PID:2100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41270.exe
        6⤵
        
        PID:2876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51205.exe
        6⤵
        
        PID:5092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59056.exe
        6⤵
        
        PID:5248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13632.exe
        6⤵
        
        PID:6936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46816.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5268.exe
        5⤵
        
        PID:5084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56256.exe
        5⤵
        
        PID:5124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45608.exe
        5⤵
        
        PID:6156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37636.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37636.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32344.exe
        5⤵
        
        PID:2568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52946.exe
        6⤵
        
        PID:3200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38952.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22299.exe
        6⤵
        
        PID:5684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1188.exe
        6⤵
        
        PID:7024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53117.exe
        5⤵
        
        PID:2064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41548.exe
        6⤵
        
        PID:3316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21065.exe
        6⤵
        
        PID:4152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50910.exe
        6⤵
        
        PID:6192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35418.exe
        5⤵
        
        PID:3100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40666.exe
        5⤵
        
        PID:4640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29793.exe
        5⤵
        
        PID:6236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34428.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34428.exe
      4⤵
      PID:1704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44010.exe
        5⤵
        
        PID:1868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63457.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59056.exe
        5⤵
        
        PID:5176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50389.exe
        5⤵
        
        PID:6576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24669.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24669.exe
      4⤵
      PID:2996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62140.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62140.exe
      4⤵
      PID:4104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39720.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39720.exe
      4⤵
      PID:5148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62674.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62674.exe
      4⤵
      PID:7116
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11850.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11850.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54295.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54295.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39085.exe
        5⤵
        
        PID:2904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38992.exe
        6⤵
        
        PID:2828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18532.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59056.exe
        6⤵
        
        PID:6120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13632.exe
        6⤵
        
        PID:6900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60159.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45959.exe
        6⤵
        
        PID:4324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5679.exe
        6⤵
        
        PID:5936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56776.exe
        6⤵
        
        PID:6476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44629.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28165.exe
        5⤵
        
        PID:5724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-883.exe
        5⤵
        
        PID:6808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24455.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24455.exe
      4⤵
      PID:1864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38992.exe
        5⤵
        
        PID:2512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9814.exe
        5⤵
        
        PID:4252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51713.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47236.exe
        5⤵
        
        PID:5960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32861.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32861.exe
      4⤵
      PID:852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50219.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50219.exe
      4⤵
      PID:4204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-96.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-96.exe
      4⤵
      PID:5240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37302.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37302.exe
      4⤵
      PID:5468
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35913.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35913.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7372.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7372.exe
      4⤵
      PID:2308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17866.exe
        5⤵
        
        PID:1572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1005.exe
        6⤵
        
        PID:3424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2881.exe
        6⤵
        
        PID:4624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14838.exe
        6⤵
        
        PID:5796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46101.exe
        5⤵
        
        PID:3460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15739.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6173.exe
        5⤵
        
        PID:5572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13952.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13952.exe
      4⤵
      PID:1380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17485.exe
        5⤵
        
        PID:3828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11049.exe
        5⤵
        
        PID:4572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14838.exe
        5⤵
        
        PID:5436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28842.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28842.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30650.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30650.exe
      4⤵
      PID:4512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11331.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11331.exe
      4⤵
      PID:5788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45608.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45608.exe
      4⤵
      PID:5392
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21990.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21990.exe
    3⤵
    PID:1228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38992.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38992.exe
      4⤵
      PID:1220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39876.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39876.exe
      4⤵
      PID:4400
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38959.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38959.exe
      4⤵
      PID:5876
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50181.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50181.exe
    3⤵
    PID:3052
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41328.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41328.exe
    3⤵
    PID:4800
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11861.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11861.exe
    3⤵
    PID:5880
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28891.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28891.exe
    3⤵
    PID:6280
- C:\Users\Admin\AppData\Local\Temp\Unicorn-44113.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-44113.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:1736
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31716.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31716.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1480
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11243.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11243.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5229.exe
        5⤵
        
        PID:1556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41548.exe
        6⤵
        
        PID:3268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21065.exe
        6⤵
        
        PID:4260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41179.exe
        6⤵
        
        PID:5420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13632.exe
        6⤵
        
        PID:6976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6254.exe
        5⤵
        
        PID:3688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37084.exe
        5⤵
        
        PID:4928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33017.exe
        5⤵
        
        PID:6040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53976.exe
        5⤵
        
        PID:6512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35939.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35939.exe
      4⤵
      PID:1316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54635.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54635.exe
      4⤵
      PID:3856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2571.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2571.exe
      4⤵
      PID:4192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7816.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7816.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54506.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54506.exe
      4⤵
      PID:6468
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24978.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24978.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38992.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38992.exe
      4⤵
      PID:2244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31900.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31900.exe
      4⤵
      PID:4684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14323.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14323.exe
      4⤵
      PID:5440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58557.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58557.exe
      4⤵
      PID:7068
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38727.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38727.exe
    3⤵
    PID:768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47116.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47116.exe
      4⤵
      PID:3632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23348.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23348.exe
      4⤵
      PID:4980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27151.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27151.exe
      4⤵
      PID:6096
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51014.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51014.exe
    3⤵
    PID:4072
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43404.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43404.exe
    3⤵
    PID:4428
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37710.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37710.exe
    3⤵
    PID:5596
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41143.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41143.exe
    3⤵
    PID:6168
- C:\Users\Admin\AppData\Local\Temp\Unicorn-64010.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-64010.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2320
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61586.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61586.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51228.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51228.exe
      4⤵
      PID:1548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8021.exe
        5⤵
        
        PID:2388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62300.exe
        6⤵
        
        PID:3164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3120.exe
        6⤵
        
        PID:4332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63332.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9548.exe
        6⤵
        
        PID:6772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17738.exe
        5⤵
        
        PID:3296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28723.exe
        5⤵
        
        PID:4736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49929.exe
        5⤵
        
        PID:5744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49892.exe
        5⤵
        
        PID:2088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20636.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20636.exe
      4⤵
      PID:1672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37276.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37276.exe
      4⤵
      PID:4216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19996.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19996.exe
      4⤵
      PID:5896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49892.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49892.exe
      4⤵
      PID:6304
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7626.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7626.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17181.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17181.exe
      4⤵
      PID:1540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30542.exe
        5⤵
        
        PID:5804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6476.exe
        5⤵
        
        PID:6780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40078.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40078.exe
      4⤵
      PID:4076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62740.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62740.exe
      4⤵
      PID:4464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33017.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33017.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62144.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62144.exe
      4⤵
      PID:7160
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56359.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56359.exe
    3⤵
    PID:3068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38756.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38756.exe
      4⤵
      PID:3496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23348.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23348.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10178.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10178.exe
      4⤵
      PID:5996
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29939.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29939.exe
    3⤵
    PID:3764
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2571.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2571.exe
    3⤵
    PID:4356
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36404.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36404.exe
    3⤵
    PID:5548
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50422.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50422.exe
    3⤵
    PID:6332
- C:\Users\Admin\AppData\Local\Temp\Unicorn-32036.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-32036.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3064
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27492.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27492.exe
    3⤵
    PID:1664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5229.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5229.exe
      4⤵
      PID:432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62767.exe
        5⤵
        
        PID:3996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21065.exe
        5⤵
        
        PID:4036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1709.exe
        5⤵
        
        PID:5520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35418.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35418.exe
      4⤵
      PID:3108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44004.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44004.exe
      4⤵
      PID:4824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53969.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53969.exe
      4⤵
      PID:6884
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22203.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22203.exe
    3⤵
    PID:1692
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41548.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41548.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21065.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21065.exe
      4⤵
      PID:4664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45263.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45263.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9548.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9548.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6728
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48770.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48770.exe
    3⤵
    PID:3908
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11236.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11236.exe
    3⤵
    PID:4320
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24351.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24351.exe
    3⤵
    PID:5968
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53969.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53969.exe
    3⤵
    PID:6952
- C:\Users\Admin\AppData\Local\Temp\Unicorn-48064.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-48064.exe
  2⤵
  PID:2336
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57279.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57279.exe
    3⤵
    PID:1660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37028.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37028.exe
      4⤵
      PID:3892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11049.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11049.exe
      4⤵
      PID:4536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14838.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14838.exe
      4⤵
      PID:6060
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48770.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48770.exe
    3⤵
    PID:3916
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11236.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11236.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4352
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33095.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33095.exe
    3⤵
    PID:5820
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41524.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41524.exe
    3⤵
    PID:7060
- C:\Users\Admin\AppData\Local\Temp\Unicorn-48811.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-48811.exe
  2⤵
  PID:2988
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55092.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55092.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3448
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23348.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23348.exe
    3⤵
    PID:4956
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27151.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27151.exe
    3⤵
    PID:6064
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50389.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50389.exe
    3⤵
    PID:6600
- C:\Users\Admin\AppData\Local\Temp\Unicorn-1762.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-1762.exe
  2⤵
  PID:3876
- C:\Users\Admin\AppData\Local\Temp\Unicorn-65386.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-65386.exe
  2⤵
  PID:4544
- C:\Users\Admin\AppData\Local\Temp\Unicorn-10660.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-10660.exe
  2⤵
  PID:6032
- C:\Users\Admin\AppData\Local\Temp\Unicorn-63885.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-63885.exe
  2⤵
  PID:6744

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-19368.exe

Filesize
468KB

MD5
5ec0254829600943d32243dcbf4f4a96

SHA1
cce03ddfc9b551612928e76a386628d1bbec72a6

SHA256
d1c4b350b16b569db1d80994c1aabe46d0aace04d8cf727ee5f3d1fe36a0a552

SHA512
de72192b0ca5e07af8eb139313b99047baede949ad39387df13baad18d302ed9f71faf9594a834b66bdd3253c30d99938681ce9f158448d20d800dc0b84435b8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-23526.exe

Filesize
468KB

MD5
2aeb529a47a4ac1e0288b6b867f2b4e3

SHA1
3732a1544d200dad1bd059ec9d0a81ca6e47ebd3

SHA256
6966c7b04c1f61361579537704b1b47780ec0c7570e716882e8e61e9d132b94e

SHA512
8d2b453fff0bddb5a4dbd39c69b9777bb8cf60354e9608bd5ef6c35d38579b34ebb26e22914518b1ca0385d789628b0ac29c297b839bdee1fb0d36e9bf7fcbbc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-36184.exe

Filesize
468KB

MD5
4f3feeb7b815805ddda0f976a01fc9e1

SHA1
eab1a392cfe39ed0b71cffff26f0cde728e7c532

SHA256
66370a270108c23e1a9cc88eb6530d99e2e56e344a17a3181485b0dbab2a05ae

SHA512
26537f627c1e9ee702b3e02737938a6c67c9ebc147a5f910a860f95386e09fb62d0c0c84a0528bcf63053b4df52727ea5a565feeca796f753949d753c22bcd59

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-40078.exe

Filesize
468KB

MD5
1ea647b71767ec7678bd1bf46b3de1fe

SHA1
1ac57fad334323548699fb2672de155f3e351019

SHA256
728f3f1ac336649c6e0203f16e99f806dc6377fcb01a51acd7aa3e2e7aa909ed

SHA512
97cd86aba4e985273f28843d9ccc4944b2ab8f6e775c8a001c2119aac754fb3a51f2e6709c0ae38096fffd79a1edcc7851dcd62eb5b023cc882f1f1e14861f2d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-41643.exe

Filesize
468KB

MD5
76b641593afe5a442ce817fd55b4c97a

SHA1
1eef2cc21d03a9cbf8b24b4f093cd1ffea5caacb

SHA256
e70ea75073543050e789dcd12b2d0882a77c96fd90f10910bf5a93c4b8844e3d

SHA512
0b1500dd2832ea979d5b50fb481a475324e58936136bfa7b5ed757994567ab4f9fbe8026edbd59659c129d544c37c391de89a061d13de8e83e59a493086f17ce

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-51394.exe

Filesize
468KB

MD5
5bfad677fde63d3576511d3c2e636e18

SHA1
64dd630ec1f25a85c7923f8c189d1b4fcd3cfd07

SHA256
b9c843cdd3f9bef0bdd8431a5e7534c362920be8179b6c45fa6744ad52d96997

SHA512
61741d69875e8863ea2f5042102ab9f52202a052c83045bb435219368df0fce6d3a4b0c8fdba22a0a411a0a4f987223ee0ce5341661fb25d1ee4634b52ff354b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5699.exe

Filesize
468KB

MD5
777898a92afcc406d883b64bbcc6fb30

SHA1
d7d992775fac31226ecac1261c4179cd1d5136d3

SHA256
afaacbcd1d452c346c9f69e9870d795073dbfabbe3f92c4d8885f45688fc9390

SHA512
a6e6f0866caa215abe66af9335af430e8a867abb9840c3fd7aab33ad0c7cb385a00e2c655bfb6e8b2edef44be48e0336f2b13a7d9b2abc37486a03716d5f6be1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5945.exe

Filesize
468KB

MD5
acbf4a57c1e1fdaaa107237cd664bf2a

SHA1
7dfbfcbec6af69307a40611b1d85d0da5227ef3c

SHA256
5eaace061e4c97ee4425c2f43f875e0ab3c80295459b288e1e2a66329ecf5ca4

SHA512
be311660afb87b3d7a59f75e8fc9b094176f99f0bc0e53269cd57c6e5bb59b8b908ccc2b802a50733351ba3159b7a31602f747576b5cd4ede88e0d306342dd02

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-20925.exe

Filesize
468KB

MD5
3bac9670e21e3c10d4bd6c5b3dcf6098

SHA1
c388d0acadfa3ed2dad2048c3a2dc784721f8288

SHA256
1c371677346d7f2be4d365854ce1a9b1b7c59bc4d222aac473b3b76fd382cf36

SHA512
2ebceac7838777da27156a0f01a813553d56bddf7acc42a9504d6ca63c96cc1bcc68ff1db9434fd40a2a2772a92c6b43257cf67541534b03718401126d73e2af

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-24072.exe

Filesize
468KB

MD5
a7eed20c3860f7b169cca4adb9d9377c

SHA1
42865b042f114eefccbe49ad78bd5c5f9117df56

SHA256
b8e4ed403552a599603d6133ec5c3d67b61a973938d9eed1540cfb0590e03250

SHA512
c63d885f7b5759c3c993ac5ae9e7da82a02292adc969cfd09f8341fc5f0904c5b106afe5969bf1603f1e6e6c0ed7349854c6cfb530499890877b608e675106a5

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-34054.exe

Filesize
468KB

MD5
37fab748ddaa78ea0e2163b6cd722140

SHA1
a0cb367bfc74763e947fef688f85f104d267cf6b

SHA256
22fa341f45312c89ab808e6733478b3e3fcaebc368d04f09cfae7848704b023a

SHA512
f9b34443c89a56de6e4613bbb23845c1ee1ee97eab0ca5764745198cd246dd71d0605cb7e3be9add0a1d92dfa7c7f8c4a66500d06a909cb085cf28a2869f1a17

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-44113.exe

Filesize
468KB

MD5
d43a27cebd59f6519f23ae8135bfb1a4

SHA1
4274cf086f1d9fce7f89822b108fe6aa5b4b3d05

SHA256
f23c95a7436296e80a31219bc2f0025c042a1363c7c32a53dd4209ca03edf646

SHA512
1a7fa3c0b9c2d31f0c8b039489e96f777fcde4f3d3795fc8e69a132a5fae1016b9df71b65588e4641c3ed33a03f7560d4ce5fc18c15203883da2302b404735fb

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-47476.exe

Filesize
468KB

MD5
319ef9e74a57b999429793e5a52598ad

SHA1
2a48553f0a4b7fd5e7d554c701bc47738c17f75b

SHA256
3a8a53f816278f0da08bf44eabf308708e34b64a721fd38b14e3337dcd22f9de

SHA512
af4adc967c596fae8ac96f4edde88b88d487cf7e7bdc0dec80e0337606522b3555d8a22982a0695f185e46724b706ba17951ee1656c5d6f071003f47b6e8234d

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-49323.exe

Filesize
468KB

MD5
cef6474177d735042b481d6612dbbc93

SHA1
6dffa177576bf5070b6cc381c828f50f0069d642

SHA256
bcbddad6461d58d8c7e1bc70784c381dd2afc3472593194ee015342333bbfc23

SHA512
a82b995f8ff12718e78edd97632629c10b262086a30e837fbc685f1434d38f8f0f0d85fce3a530ab88af66836ca1f41806db25551ef7ccf22c40f6384d1c7e0c

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-52354.exe

Filesize
468KB

MD5
ca10e7bfa1ab1fa817f69844c73ac750

SHA1
c8b3b5412ae50dd72fd2a2bf8553c81f66181f08

SHA256
a3fbaac576700b68664531ec41a1e6a6abbc33ccbcbdfd994a3eb34e4db48a26

SHA512
58496bc26393a8089d2934154a1ebd669695a2029ca2594992e683cf29017937fa676ee32cfc468d294acb46eb97bafc688859fae95d04c7841ad9308f6a05c4

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-52546.exe

Filesize
468KB

MD5
8e784f1eaeb313ba2c27b84641ec3bac

SHA1
4ef92a1da140d8138fb6d7f8661661564465d3e8

SHA256
1ca67bfce73a4fcca707f9440a35391aa4968e3cb34ad40dd49a8d522d27dac0

SHA512
cd1c250eb44d9507b0e3f0a05e72682dad718ef9d249a233528796db3c407d450e040ecfdaa5cd471e557347c548aaec4f77024e421b42836bc5d73f76c72c02

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-62810.exe

Filesize
468KB

MD5
58a7a962f5528e8f01664c9038c5b919

SHA1
afdf240a417cf0530678dd174ab44c1012b8a591

SHA256
080e9a6d28fc0d6e8b133a18d1ba5377d3820376619896a58e40c9742b895898

SHA512
df3d1428fb11e4f846dd467441c4854bab046d94a7f74bbbbffc2ba9e6b9ea23c0c2c78737e58787130d0247a986c4b546d25bba8c1efd7d7bc640905e33fe99

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-65161.exe

Filesize
468KB

MD5
4789582f12a7d1961efa41c42ab57c8f

SHA1
a2b1703cbc7a6b054506de3d802ccaf06814b2c4

SHA256
9cad48668b6253e238adf257238e918850f36c88fa5653ab08b0d9b4c3a81145

SHA512
ff5019ef66f1b19ff4d1c78e98cff8433ed2a833373df1698eec6e91ab02af2ee8e816eeba891cddd3545cf96b3c1d61def0469be3972edcffda75359db6508d

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-6920.exe

Filesize
468KB

MD5
9d0dfe20e4bc0acfe6f3c4a64045bd55

SHA1
edd151b6bdbd79b1a4d4250f84e99781ce658dee

SHA256
53c3ec5f488b477b9cd19ecb1128516103e2f470b4b4f9e1796e77bd52041226

SHA512
168a1515317eeaf64daf17ab32348b9222e02ef6cbf71a776e67c9ac67320e60ee8dc30b74226a5ac509bce172f0cd674a77d30700cacede6b172cc4823ed7c5

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-994.exe

Filesize
468KB

MD5
6db99d32684bd7005bf1abaea23880b6

SHA1
1417f2c4a3869746a510ed2b5eaf007c23e74431

SHA256
cb7de2a41f254adfbd0a37ad532ad999f0fb781fa20e6f8ee189b6973790b3e7

SHA512
d4e6c4b14b2c45eb0c889d776cda43526230528a01eedfc4a7c5c11fd2533e28052f1d229651ea565d08229614269781c1088943e6d42f20c98e1d15442c59c9

Download Submit
memory/556-397-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/584-84-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/584-237-0x00000000005A0000-0x0000000000615000-memory.dmp

Filesize
468KB

Download
memory/584-395-0x00000000005A0000-0x0000000000615000-memory.dmp

Filesize
468KB

Download
memory/584-244-0x00000000005A0000-0x0000000000615000-memory.dmp

Filesize
468KB

Download
memory/584-136-0x00000000005A0000-0x0000000000615000-memory.dmp

Filesize
468KB

Download
memory/584-378-0x00000000005A0000-0x0000000000615000-memory.dmp

Filesize
468KB

Download
memory/808-334-0x0000000002430000-0x00000000024A5000-memory.dmp

Filesize
468KB

Download
memory/808-335-0x0000000002430000-0x00000000024A5000-memory.dmp

Filesize
468KB

Download
memory/808-223-0x0000000002430000-0x00000000024A5000-memory.dmp

Filesize
468KB

Download
memory/808-222-0x0000000002430000-0x00000000024A5000-memory.dmp

Filesize
468KB

Download
memory/808-70-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/920-266-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/968-232-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1088-212-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1480-260-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1680-337-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1688-297-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1732-370-0x0000000002550000-0x00000000025C5000-memory.dmp

Filesize
468KB

Download
memory/1732-367-0x0000000002550000-0x00000000025C5000-memory.dmp

Filesize
468KB

Download
memory/1732-261-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1736-238-0x0000000001E80000-0x0000000001EF5000-memory.dmp

Filesize
468KB

Download
memory/1736-148-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2052-327-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2116-287-0x0000000002620000-0x0000000002695000-memory.dmp

Filesize
468KB

Download
memory/2116-285-0x0000000002620000-0x0000000002695000-memory.dmp

Filesize
468KB

Download
memory/2116-165-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2124-404-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2160-224-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2160-325-0x0000000001F10000-0x0000000001F85000-memory.dmp

Filesize
468KB

Download
memory/2160-320-0x0000000001F10000-0x0000000001F85000-memory.dmp

Filesize
468KB

Download
memory/2212-369-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2260-344-0x00000000024D0000-0x0000000002545000-memory.dmp

Filesize
468KB

Download
memory/2260-215-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2260-343-0x00000000024D0000-0x0000000002545000-memory.dmp

Filesize
468KB

Download
memory/2320-267-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2376-180-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2376-306-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2376-305-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2408-193-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2408-366-0x0000000002650000-0x00000000026C5000-memory.dmp

Filesize
468KB

Download
memory/2432-288-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2540-346-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2608-188-0x0000000000670000-0x00000000006E5000-memory.dmp

Filesize
468KB

Download
memory/2608-51-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2608-359-0x0000000000670000-0x00000000006E5000-memory.dmp

Filesize
468KB

Download
memory/2608-190-0x0000000000670000-0x00000000006E5000-memory.dmp

Filesize
468KB

Download
memory/2608-361-0x0000000000670000-0x00000000006E5000-memory.dmp

Filesize
468KB

Download
memory/2668-396-0x0000000000540000-0x00000000005B5000-memory.dmp

Filesize
468KB

Download
memory/2668-36-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2668-377-0x0000000000540000-0x00000000005B5000-memory.dmp

Filesize
468KB

Download
memory/2668-262-0x0000000000540000-0x00000000005B5000-memory.dmp

Filesize
468KB

Download
memory/2668-263-0x0000000000540000-0x00000000005B5000-memory.dmp

Filesize
468KB

Download
memory/2668-64-0x0000000000540000-0x00000000005B5000-memory.dmp

Filesize
468KB

Download
memory/2692-196-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2692-203-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2692-26-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2732-265-0x0000000002820000-0x0000000002895000-memory.dmp

Filesize
468KB

Download
memory/2732-80-0x0000000002820000-0x0000000002895000-memory.dmp

Filesize
468KB

Download
memory/2732-146-0x0000000002820000-0x0000000002895000-memory.dmp

Filesize
468KB

Download
memory/2732-373-0x0000000002820000-0x0000000002895000-memory.dmp

Filesize
468KB

Download
memory/2732-264-0x0000000002820000-0x0000000002895000-memory.dmp

Filesize
468KB

Download
memory/2732-6-0x0000000003350000-0x00000000033C5000-memory.dmp

Filesize
468KB

Download
memory/2732-399-0x0000000002820000-0x0000000002895000-memory.dmp

Filesize
468KB

Download
memory/2732-371-0x0000000003350000-0x00000000033C5000-memory.dmp

Filesize
468KB

Download
memory/2732-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2732-147-0x0000000002820000-0x0000000002895000-memory.dmp

Filesize
468KB

Download
memory/2732-12-0x0000000002820000-0x0000000002895000-memory.dmp

Filesize
468KB

Download
memory/2732-345-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2736-315-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2752-127-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2752-239-0x0000000002380000-0x00000000023F5000-memory.dmp

Filesize
468KB

Download
memory/2808-364-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2868-177-0x0000000002660000-0x00000000026D5000-memory.dmp

Filesize
468KB

Download
memory/2868-102-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2868-178-0x0000000002660000-0x00000000026D5000-memory.dmp

Filesize
468KB

Download
memory/2868-313-0x0000000002660000-0x00000000026D5000-memory.dmp

Filesize
468KB

Download
memory/2868-314-0x0000000002660000-0x00000000026D5000-memory.dmp

Filesize
468KB

Download
memory/2912-116-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2912-363-0x0000000000530000-0x00000000005A5000-memory.dmp

Filesize
468KB

Download
memory/2912-214-0x0000000000530000-0x00000000005A5000-memory.dmp

Filesize
468KB

Download
memory/2912-213-0x0000000000530000-0x00000000005A5000-memory.dmp

Filesize
468KB

Download
memory/2968-295-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2968-19-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2968-374-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2968-162-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2968-163-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2968-296-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/3016-307-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3020-372-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3044-398-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/3044-231-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/3044-230-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/3044-400-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/3064-92-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3064-60-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download