a7fa9da7d1c9268ec9fbc9c489868ad33bf32fadf685ed2ea7017b6b8382e5fd

Analysis

max time kernel
119s
max time network
17s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
18/10/2024, 01:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a7fa9da7d1c9268ec9fbc9c489868ad33bf32fadf685ed2ea7017b6b8382e5fdN.exe
Size

468KB
MD5

cab8a94cc8bf47b57b872705ebcc1720
SHA1

b156d1eacd57b61c053009f491ca59ab1534826b
SHA256

a7fa9da7d1c9268ec9fbc9c489868ad33bf32fadf685ed2ea7017b6b8382e5fd
SHA512

f668699fe21f885360fb89b22448577f6d7499507d6f8627719c3516e7f64bfb14acc6f25337dbf5b31d8aa8e63df6e116f37007587acbc8ab9d8993a0e1c7eb
SSDEEP

3072:CrYCogKxjT88FbYbPz3yqfL/EpTZsVpKPmHxqloPJyt0krh1gPlV:Cr9otg8F4PDyqfxzr3Jyqeh1g

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2600	Unicorn-52174.exe
2744	Unicorn-40060.exe
2844	Unicorn-56707.exe
2596	Unicorn-7377.exe
2492	Unicorn-18264.exe
1748	Unicorn-38130.exe
2732	Unicorn-31999.exe
540	Unicorn-26112.exe
2696	Unicorn-19959.exe
2052	Unicorn-57349.exe
2332	Unicorn-57614.exe
1992	Unicorn-25326.exe
2188	Unicorn-57614.exe
816	Unicorn-5460.exe
1632	Unicorn-31966.exe
2312	Unicorn-36255.exe
2316	Unicorn-16197.exe
1848	Unicorn-43100.exe
2128	Unicorn-14167.exe
2084	Unicorn-1138.exe
2028	Unicorn-44257.exe
1732	Unicorn-44522.exe
1796	Unicorn-44522.exe
2440	Unicorn-6679.exe
940	Unicorn-58289.exe
1704	Unicorn-10313.exe
2544	Unicorn-53847.exe
3044	Unicorn-55985.exe
2788	Unicorn-45866.exe
1552	Unicorn-24211.exe
2080	Unicorn-37677.exe
2736	Unicorn-35140.exe
2652	Unicorn-33311.exe
2572	Unicorn-57013.exe
2512	Unicorn-37147.exe
476	Unicorn-22421.exe
2924	Unicorn-33473.exe
1196	Unicorn-47771.exe
2668	Unicorn-65295.exe
2936	Unicorn-37382.exe
2284	Unicorn-8549.exe
1624	Unicorn-8549.exe
1644	Unicorn-54221.exe
1616	Unicorn-24409.exe
2160	Unicorn-21609.exe
2156	Unicorn-64364.exe
2296	Unicorn-41618.exe
2308	Unicorn-61484.exe
2320	Unicorn-3730.exe
2252	Unicorn-29196.exe
544	Unicorn-39185.exe
2076	Unicorn-39450.exe
884	Unicorn-34851.exe
1488	Unicorn-54717.exe
2200	Unicorn-53409.exe
1668	Unicorn-7737.exe
2832	Unicorn-835.exe
2176	Unicorn-7737.exe
2232	Unicorn-18816.exe
2396	Unicorn-32551.exe
2856	Unicorn-29248.exe
2800	Unicorn-7270.exe
960	Unicorn-52849.exe
376	Unicorn-11686.exe

Loads dropped DLL 64 IoCs

pid	Process
2192	a7fa9da7d1c9268ec9fbc9c489868ad33bf32fadf685ed2ea7017b6b8382e5fdN.exe
2192	a7fa9da7d1c9268ec9fbc9c489868ad33bf32fadf685ed2ea7017b6b8382e5fdN.exe
2600	Unicorn-52174.exe
2600	Unicorn-52174.exe
2192	a7fa9da7d1c9268ec9fbc9c489868ad33bf32fadf685ed2ea7017b6b8382e5fdN.exe
2192	a7fa9da7d1c9268ec9fbc9c489868ad33bf32fadf685ed2ea7017b6b8382e5fdN.exe
2844	Unicorn-56707.exe
2844	Unicorn-56707.exe
2600	Unicorn-52174.exe
2600	Unicorn-52174.exe
2192	a7fa9da7d1c9268ec9fbc9c489868ad33bf32fadf685ed2ea7017b6b8382e5fdN.exe
2744	Unicorn-40060.exe
2744	Unicorn-40060.exe
2192	a7fa9da7d1c9268ec9fbc9c489868ad33bf32fadf685ed2ea7017b6b8382e5fdN.exe
2596	Unicorn-7377.exe
2596	Unicorn-7377.exe
2844	Unicorn-56707.exe
2844	Unicorn-56707.exe
1748	Unicorn-38130.exe
2192	a7fa9da7d1c9268ec9fbc9c489868ad33bf32fadf685ed2ea7017b6b8382e5fdN.exe
2732	Unicorn-31999.exe
2192	a7fa9da7d1c9268ec9fbc9c489868ad33bf32fadf685ed2ea7017b6b8382e5fdN.exe
2732	Unicorn-31999.exe
1748	Unicorn-38130.exe
2492	Unicorn-18264.exe
2744	Unicorn-40060.exe
2492	Unicorn-18264.exe
2744	Unicorn-40060.exe
2600	Unicorn-52174.exe
2600	Unicorn-52174.exe
540	Unicorn-26112.exe
540	Unicorn-26112.exe
2596	Unicorn-7377.exe
2596	Unicorn-7377.exe
2696	Unicorn-19959.exe
2696	Unicorn-19959.exe
2844	Unicorn-56707.exe
2844	Unicorn-56707.exe
1632	Unicorn-31966.exe
1632	Unicorn-31966.exe
2600	Unicorn-52174.exe
2600	Unicorn-52174.exe
1992	Unicorn-25326.exe
816	Unicorn-5460.exe
1992	Unicorn-25326.exe
816	Unicorn-5460.exe
2744	Unicorn-40060.exe
2744	Unicorn-40060.exe
2492	Unicorn-18264.exe
2492	Unicorn-18264.exe
2188	Unicorn-57614.exe
2188	Unicorn-57614.exe
1748	Unicorn-38130.exe
2732	Unicorn-31999.exe
2332	Unicorn-57614.exe
2052	Unicorn-57349.exe
1748	Unicorn-38130.exe
2732	Unicorn-31999.exe
2332	Unicorn-57614.exe
2052	Unicorn-57349.exe
2192	a7fa9da7d1c9268ec9fbc9c489868ad33bf32fadf685ed2ea7017b6b8382e5fdN.exe
2192	a7fa9da7d1c9268ec9fbc9c489868ad33bf32fadf685ed2ea7017b6b8382e5fdN.exe
2312	Unicorn-36255.exe
2312	Unicorn-36255.exe

Program crash 7 IoCs

pid	pid_target	Process	procid_target
3076	1916	WerFault.exe	118
4880	2252	WerFault.exe	76
5768	4300	WerFault.exe	414
5800	4316	WerFault.exe	412
5808	5136	WerFault.exe	426
5164	1128	WerFault.exe	415
5160	4328	WerFault.exe	413

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53811.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16197.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-698.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47628.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57349.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14567.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32573.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51909.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22872.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61193.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56169.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16931.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41373.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38821.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61135.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21130.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48871.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11662.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35012.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58132.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52777.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11633.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19959.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53847.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4263.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21130.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62167.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22003.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22671.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10024.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41656.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23731.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29154.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51909.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25251.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33259.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26535.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58995.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11670.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5644.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55223.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35172.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47231.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22003.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41618.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62636.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51909.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50833.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29186.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-786.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3412.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38539.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34433.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57664.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17662.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13498.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11670.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31117.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21609.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13186.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55593.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44166.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46636.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21130.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2192	a7fa9da7d1c9268ec9fbc9c489868ad33bf32fadf685ed2ea7017b6b8382e5fdN.exe
2600	Unicorn-52174.exe
2844	Unicorn-56707.exe
2744	Unicorn-40060.exe
2596	Unicorn-7377.exe
2732	Unicorn-31999.exe
2492	Unicorn-18264.exe
1748	Unicorn-38130.exe
540	Unicorn-26112.exe
2696	Unicorn-19959.exe
1992	Unicorn-25326.exe
2332	Unicorn-57614.exe
1632	Unicorn-31966.exe
816	Unicorn-5460.exe
2188	Unicorn-57614.exe
2052	Unicorn-57349.exe
2312	Unicorn-36255.exe
2316	Unicorn-16197.exe
1848	Unicorn-43100.exe
2128	Unicorn-14167.exe
2028	Unicorn-44257.exe
2084	Unicorn-1138.exe
1732	Unicorn-44522.exe
1796	Unicorn-44522.exe
1704	Unicorn-10313.exe
2080	Unicorn-37677.exe
940	Unicorn-58289.exe
2440	Unicorn-6679.exe
3044	Unicorn-55985.exe
2788	Unicorn-45866.exe
2544	Unicorn-53847.exe
1552	Unicorn-24211.exe
2736	Unicorn-35140.exe
2572	Unicorn-57013.exe
2512	Unicorn-37147.exe
2652	Unicorn-33311.exe
2924	Unicorn-33473.exe
476	Unicorn-22421.exe
2668	Unicorn-65295.exe
1196	Unicorn-47771.exe
2936	Unicorn-37382.exe
2284	Unicorn-8549.exe
1624	Unicorn-8549.exe
1644	Unicorn-54221.exe
2320	Unicorn-3730.exe
1616	Unicorn-24409.exe
544	Unicorn-39185.exe
2156	Unicorn-64364.exe
2252	Unicorn-29196.exe
2160	Unicorn-21609.exe
2296	Unicorn-41618.exe
2200	Unicorn-53409.exe
2076	Unicorn-39450.exe
2308	Unicorn-61484.exe
884	Unicorn-34851.exe
2856	Unicorn-29248.exe
1488	Unicorn-54717.exe
1668	Unicorn-7737.exe
2832	Unicorn-835.exe
2176	Unicorn-7737.exe
2800	Unicorn-7270.exe
960	Unicorn-52849.exe
2232	Unicorn-18816.exe
2396	Unicorn-32551.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2192 wrote to memory of 2600	2192	a7fa9da7d1c9268ec9fbc9c489868ad33bf32fadf685ed2ea7017b6b8382e5fdN.exe	28
PID 2192 wrote to memory of 2600	2192	a7fa9da7d1c9268ec9fbc9c489868ad33bf32fadf685ed2ea7017b6b8382e5fdN.exe	28
PID 2192 wrote to memory of 2600	2192	a7fa9da7d1c9268ec9fbc9c489868ad33bf32fadf685ed2ea7017b6b8382e5fdN.exe	28
PID 2192 wrote to memory of 2600	2192	a7fa9da7d1c9268ec9fbc9c489868ad33bf32fadf685ed2ea7017b6b8382e5fdN.exe	28
PID 2600 wrote to memory of 2744	2600	Unicorn-52174.exe	29
PID 2600 wrote to memory of 2744	2600	Unicorn-52174.exe	29
PID 2600 wrote to memory of 2744	2600	Unicorn-52174.exe	29
PID 2600 wrote to memory of 2744	2600	Unicorn-52174.exe	29
PID 2192 wrote to memory of 2844	2192	a7fa9da7d1c9268ec9fbc9c489868ad33bf32fadf685ed2ea7017b6b8382e5fdN.exe	30
PID 2192 wrote to memory of 2844	2192	a7fa9da7d1c9268ec9fbc9c489868ad33bf32fadf685ed2ea7017b6b8382e5fdN.exe	30
PID 2192 wrote to memory of 2844	2192	a7fa9da7d1c9268ec9fbc9c489868ad33bf32fadf685ed2ea7017b6b8382e5fdN.exe	30
PID 2192 wrote to memory of 2844	2192	a7fa9da7d1c9268ec9fbc9c489868ad33bf32fadf685ed2ea7017b6b8382e5fdN.exe	30
PID 2844 wrote to memory of 2596	2844	Unicorn-56707.exe	31
PID 2844 wrote to memory of 2596	2844	Unicorn-56707.exe	31
PID 2844 wrote to memory of 2596	2844	Unicorn-56707.exe	31
PID 2844 wrote to memory of 2596	2844	Unicorn-56707.exe	31
PID 2600 wrote to memory of 2492	2600	Unicorn-52174.exe	32
PID 2600 wrote to memory of 2492	2600	Unicorn-52174.exe	32
PID 2600 wrote to memory of 2492	2600	Unicorn-52174.exe	32
PID 2600 wrote to memory of 2492	2600	Unicorn-52174.exe	32
PID 2744 wrote to memory of 1748	2744	Unicorn-40060.exe	34
PID 2744 wrote to memory of 1748	2744	Unicorn-40060.exe	34
PID 2744 wrote to memory of 1748	2744	Unicorn-40060.exe	34
PID 2744 wrote to memory of 1748	2744	Unicorn-40060.exe	34
PID 2192 wrote to memory of 2732	2192	a7fa9da7d1c9268ec9fbc9c489868ad33bf32fadf685ed2ea7017b6b8382e5fdN.exe	33
PID 2192 wrote to memory of 2732	2192	a7fa9da7d1c9268ec9fbc9c489868ad33bf32fadf685ed2ea7017b6b8382e5fdN.exe	33
PID 2192 wrote to memory of 2732	2192	a7fa9da7d1c9268ec9fbc9c489868ad33bf32fadf685ed2ea7017b6b8382e5fdN.exe	33
PID 2192 wrote to memory of 2732	2192	a7fa9da7d1c9268ec9fbc9c489868ad33bf32fadf685ed2ea7017b6b8382e5fdN.exe	33
PID 2596 wrote to memory of 540	2596	Unicorn-7377.exe	35
PID 2596 wrote to memory of 540	2596	Unicorn-7377.exe	35
PID 2596 wrote to memory of 540	2596	Unicorn-7377.exe	35
PID 2596 wrote to memory of 540	2596	Unicorn-7377.exe	35
PID 2844 wrote to memory of 2696	2844	Unicorn-56707.exe	36
PID 2844 wrote to memory of 2696	2844	Unicorn-56707.exe	36
PID 2844 wrote to memory of 2696	2844	Unicorn-56707.exe	36
PID 2844 wrote to memory of 2696	2844	Unicorn-56707.exe	36
PID 2192 wrote to memory of 2052	2192	a7fa9da7d1c9268ec9fbc9c489868ad33bf32fadf685ed2ea7017b6b8382e5fdN.exe	38
PID 2192 wrote to memory of 2052	2192	a7fa9da7d1c9268ec9fbc9c489868ad33bf32fadf685ed2ea7017b6b8382e5fdN.exe	38
PID 2192 wrote to memory of 2052	2192	a7fa9da7d1c9268ec9fbc9c489868ad33bf32fadf685ed2ea7017b6b8382e5fdN.exe	38
PID 2192 wrote to memory of 2052	2192	a7fa9da7d1c9268ec9fbc9c489868ad33bf32fadf685ed2ea7017b6b8382e5fdN.exe	38
PID 2732 wrote to memory of 2332	2732	Unicorn-31999.exe	39
PID 2732 wrote to memory of 2332	2732	Unicorn-31999.exe	39
PID 2732 wrote to memory of 2332	2732	Unicorn-31999.exe	39
PID 2732 wrote to memory of 2332	2732	Unicorn-31999.exe	39
PID 1748 wrote to memory of 2188	1748	Unicorn-38130.exe	37
PID 1748 wrote to memory of 2188	1748	Unicorn-38130.exe	37
PID 1748 wrote to memory of 2188	1748	Unicorn-38130.exe	37
PID 1748 wrote to memory of 2188	1748	Unicorn-38130.exe	37
PID 2492 wrote to memory of 1992	2492	Unicorn-18264.exe	40
PID 2492 wrote to memory of 1992	2492	Unicorn-18264.exe	40
PID 2492 wrote to memory of 1992	2492	Unicorn-18264.exe	40
PID 2492 wrote to memory of 1992	2492	Unicorn-18264.exe	40
PID 2744 wrote to memory of 816	2744	Unicorn-40060.exe	41
PID 2744 wrote to memory of 816	2744	Unicorn-40060.exe	41
PID 2744 wrote to memory of 816	2744	Unicorn-40060.exe	41
PID 2744 wrote to memory of 816	2744	Unicorn-40060.exe	41
PID 2600 wrote to memory of 1632	2600	Unicorn-52174.exe	42
PID 2600 wrote to memory of 1632	2600	Unicorn-52174.exe	42
PID 2600 wrote to memory of 1632	2600	Unicorn-52174.exe	42
PID 2600 wrote to memory of 1632	2600	Unicorn-52174.exe	42
PID 540 wrote to memory of 2312	540	Unicorn-26112.exe	43
PID 540 wrote to memory of 2312	540	Unicorn-26112.exe	43
PID 540 wrote to memory of 2312	540	Unicorn-26112.exe	43
PID 540 wrote to memory of 2312	540	Unicorn-26112.exe	43

C:\Users\Admin\AppData\Local\Temp\a7fa9da7d1c9268ec9fbc9c489868ad33bf32fadf685ed2ea7017b6b8382e5fdN.exe
"C:\Users\Admin\AppData\Local\Temp\a7fa9da7d1c9268ec9fbc9c489868ad33bf32fadf685ed2ea7017b6b8382e5fdN.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2192
- C:\Users\Admin\AppData\Local\Temp\Unicorn-52174.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-52174.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2600
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40060.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40060.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38130.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38130.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57614.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:2188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10313.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23217.exe
        7⤵
        
        PID:2776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29186.exe
        7⤵
        
        PID:2388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15256.exe
        7⤵
        
        PID:3284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61135.exe
        7⤵
        
        PID:4724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48608.exe
        7⤵
        
        PID:5224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5821.exe
        7⤵
        
        PID:6400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34851.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35052.exe
        6⤵
        
        PID:2460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52777.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44599.exe
        6⤵
        
        PID:4820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-137.exe
        6⤵
        
        PID:5244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19266.exe
        6⤵
        
        PID:5432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53847.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7737.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59015.exe
        7⤵
        
        PID:1300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11516.exe
        7⤵
        
        PID:3592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14433.exe
        7⤵
        
        PID:4116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57774.exe
        7⤵
        
        PID:4316
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4316 -s 188
        8⤵
        Program crash
        
        PID:5800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64918.exe
        7⤵
        
        PID:6244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16347.exe
        6⤵
        
        PID:1544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60527.exe
        7⤵
        
        PID:3300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44166.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47946.exe
        7⤵
        
        PID:4856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34241.exe
        7⤵
        
        PID:5424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19804.exe
        6⤵
        
        PID:3336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31382.exe
        7⤵
        
        PID:3864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-698.exe
        7⤵
        
        PID:5028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51909.exe
        7⤵
        
        PID:4872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26821.exe
        7⤵
        
        PID:6376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31117.exe
        6⤵
        
        PID:3752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14347.exe
        6⤵
        
        PID:4564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24125.exe
        6⤵
        
        PID:5380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39069.exe
        6⤵
        
        PID:932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32551.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42890.exe
        5⤵
        
        PID:316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6591.exe
        5⤵
        
        PID:3344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63349.exe
        5⤵
        
        PID:4468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12192.exe
        5⤵
        
        PID:5436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17538.exe
        5⤵
        
        PID:5632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5460.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5460.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44522.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64364.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57664.exe
        6⤵
        
        PID:1724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9391.exe
        6⤵
        
        PID:3484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21130.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27659.exe
        6⤵
        
        PID:6080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41373.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41618.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5862.exe
        5⤵
        
        PID:2164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15256.exe
        5⤵
        
        PID:3356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9971.exe
        5⤵
        
        PID:2348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44725.exe
        5⤵
        
        PID:6016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56754.exe
        5⤵
        
        PID:6704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6679.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6679.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29196.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34433.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1916
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1916 -s 244
        7⤵
        Program crash
        
        PID:3076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-786.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47687.exe
        7⤵
        
        PID:5680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24460.exe
        6⤵
        
        PID:4516
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2252 -s 236
        6⤵
        Program crash
        
        PID:4880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14567.exe
        5⤵
        
        PID:1216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54929.exe
        6⤵
        
        PID:2292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41656.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14433.exe
        6⤵
        
        PID:4128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57774.exe
        6⤵
        
        PID:5136
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5136 -s 188
        7⤵
        Program crash
        
        PID:5808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42405.exe
        6⤵
        
        PID:5344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5540.exe
        5⤵
        
        PID:112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15256.exe
        5⤵
        
        PID:3280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55223.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14012.exe
        5⤵
        
        PID:5992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24253.exe
        5⤵
        
        PID:6636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39185.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39185.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25251.exe
        5⤵
        
        PID:3616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4263.exe
        5⤵
        
        PID:4804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49109.exe
        5⤵
        
        PID:4252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3062.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3062.exe
      4⤵
      PID:2288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55593.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55593.exe
      4⤵
      PID:3460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61665.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61665.exe
      4⤵
      PID:5052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25480.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25480.exe
      4⤵
      PID:5740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64774.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64774.exe
      4⤵
      PID:6812
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18264.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18264.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25326.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25326.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:1992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44522.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7737.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57446.exe
        6⤵
        
        PID:2948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9391.exe
        6⤵
        
        PID:3520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30419.exe
        7⤵
        
        PID:4160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33259.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41339.exe
        7⤵
        
        PID:5796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4263.exe
        6⤵
        
        PID:4780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49109.exe
        6⤵
        
        PID:1240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25869.exe
        6⤵
        
        PID:5340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18816.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10289.exe
        6⤵
        
        PID:1328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11516.exe
        6⤵
        
        PID:3760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49436.exe
        6⤵
        
        PID:4580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13165.exe
        6⤵
        
        PID:5592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26731.exe
        6⤵
        
        PID:7024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36116.exe
        5⤵
        
        PID:2104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31382.exe
        6⤵
        
        PID:3904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3412.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21830.exe
        6⤵
        
        PID:5568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43267.exe
        6⤵
        
        PID:6992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31117.exe
        5⤵
        
        PID:3680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11633.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60664.exe
        5⤵
        
        PID:5516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39069.exe
        5⤵
        
        PID:5784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58289.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58289.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8549.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26114.exe
        6⤵
        
        PID:2404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26543.exe
        7⤵
        
        PID:676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62262.exe
        8⤵
        
        PID:2700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61193.exe
        8⤵
        
        PID:3792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35172.exe
        8⤵
        
        PID:4704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44195.exe
        8⤵
        
        PID:5928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22003.exe
        8⤵
        
        PID:916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57664.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9391.exe
        7⤵
        
        PID:3584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4263.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49946.exe
        7⤵
        
        PID:6004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59640.exe
        7⤵
        
        PID:7016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62806.exe
        6⤵
        
        PID:2876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11992.exe
        7⤵
        
        PID:448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61193.exe
        7⤵
        
        PID:3272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35172.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44195.exe
        7⤵
        
        PID:5872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22003.exe
        7⤵
        
        PID:2248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35052.exe
        6⤵
        
        PID:1080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52777.exe
        6⤵
        
        PID:3264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44599.exe
        6⤵
        
        PID:4828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49639.exe
        6⤵
        
        PID:4892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19266.exe
        6⤵
        
        PID:5416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55532.exe
        5⤵
        
        PID:2384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50224.exe
        6⤵
        
        PID:1696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17135.exe
        7⤵
        
        PID:1728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11516.exe
        7⤵
        
        PID:3576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14433.exe
        7⤵
        
        PID:5116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57774.exe
        7⤵
        
        PID:4300
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4300 -s 188
        8⤵
        Program crash
        
        PID:5768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64918.exe
        7⤵
        
        PID:6252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3875.exe
        6⤵
        
        PID:2900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22872.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35700.exe
        7⤵
        
        PID:4400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14462.exe
        7⤵
        
        PID:5540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47204.exe
        7⤵
        
        PID:5480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25251.exe
        6⤵
        
        PID:3624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21130.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27659.exe
        6⤵
        
        PID:6088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42935.exe
        6⤵
        
        PID:5352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29044.exe
        5⤵
        
        PID:2644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31117.exe
        5⤵
        
        PID:3768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9971.exe
        5⤵
        
        PID:4660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14012.exe
        5⤵
        
        PID:5956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16931.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24409.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24409.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11670.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61193.exe
        5⤵
        
        PID:3532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29796.exe
        5⤵
        
        PID:4332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44195.exe
        5⤵
        
        PID:5864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27352.exe
        5⤵
        
        PID:6368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11405.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11405.exe
      4⤵
      PID:1852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6591.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6591.exe
      4⤵
      PID:3320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10085.exe
        5⤵
        
        PID:7136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60635.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60635.exe
      4⤵
      PID:5076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49639.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49639.exe
      4⤵
      PID:4364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21404.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21404.exe
      4⤵
      PID:5176
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31966.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31966.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1138.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1138.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37382.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44951.exe
        6⤵
        
        PID:948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28071.exe
        7⤵
        
        PID:1220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33300.exe
        8⤵
        
        PID:2764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61193.exe
        8⤵
        
        PID:3964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14433.exe
        8⤵
        
        PID:5108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8272.exe
        8⤵
        
        PID:5264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45838.exe
        8⤵
        
        PID:5708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-715.exe
        7⤵
        
        PID:3000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9391.exe
        7⤵
        
        PID:3476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20298.exe
        7⤵
        
        PID:4152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47231.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51119.exe
        7⤵
        
        PID:6648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6669.exe
        6⤵
        
        PID:600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11992.exe
        7⤵
        
        PID:596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61193.exe
        7⤵
        
        PID:3188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31646.exe
        7⤵
        
        PID:4188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13165.exe
        7⤵
        
        PID:5600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15634.exe
        7⤵
        
        PID:7040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5862.exe
        6⤵
        
        PID:1908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15256.exe
        6⤵
        
        PID:3416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62095.exe
        6⤵
        
        PID:760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52346.exe
        6⤵
        
        PID:5652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-372.exe
        6⤵
        
        PID:6756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62636.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29186.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15256.exe
        5⤵
        
        PID:3296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61135.exe
        5⤵
        
        PID:4716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32573.exe
        5⤵
        
        PID:5128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40797.exe
        5⤵
        
        PID:5940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54221.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54221.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5994.exe
        5⤵
        
        PID:2740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55102.exe
        6⤵
        
        PID:2108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11670.exe
        7⤵
        
        PID:1368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61193.exe
        7⤵
        
        PID:3948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29796.exe
        7⤵
        
        PID:4336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44195.exe
        7⤵
        
        PID:5888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27352.exe
        7⤵
        
        PID:6384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57342.exe
        6⤵
        
        PID:2012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9391.exe
        6⤵
        
        PID:3536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20298.exe
        6⤵
        
        PID:4144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49109.exe
        6⤵
        
        PID:4232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62904.exe
        6⤵
        
        PID:6192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8205.exe
        5⤵
        
        PID:1680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24475.exe
        6⤵
        
        PID:4304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48719.exe
        6⤵
        
        PID:5824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56871.exe
        6⤵
        
        PID:6340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25251.exe
        5⤵
        
        PID:3744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23013.exe
        5⤵
        
        PID:4500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62167.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43797.exe
        5⤵
        
        PID:6984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-710.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-710.exe
      4⤵
      PID:2660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12017.exe
        5⤵
        
        PID:2088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11516.exe
        5⤵
        
        PID:3600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14433.exe
        5⤵
        
        PID:3248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-944.exe
        5⤵
        
        PID:6000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34053.exe
        5⤵
        
        PID:6608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10024.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10024.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11670.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61193.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29796.exe
        5⤵
        
        PID:4296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44195.exe
        5⤵
        
        PID:5896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23731.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13186.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13186.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55593.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55593.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12163.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12163.exe
      4⤵
      PID:5060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56198.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56198.exe
      4⤵
      PID:5504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12203.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12203.exe
      4⤵
      PID:5444
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44257.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44257.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8549.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8549.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9860.exe
        5⤵
        
        PID:2240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15451.exe
        5⤵
        
        PID:688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31382.exe
        6⤵
        
        PID:3888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1466.exe
        6⤵
        
        PID:4492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21830.exe
        6⤵
        
        PID:5616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25251.exe
        5⤵
        
        PID:3656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20298.exe
        5⤵
        
        PID:4140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49946.exe
        5⤵
        
        PID:5948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22671.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18495.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18495.exe
      4⤵
      PID:2532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29186.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29186.exe
      4⤵
      PID:2152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15256.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15256.exe
      4⤵
      PID:3236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4595.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4595.exe
      4⤵
      PID:3016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61857.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61857.exe
      4⤵
      PID:5304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50319.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50319.exe
      4⤵
      PID:6336
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21609.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21609.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2160
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52064.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52064.exe
    3⤵
    PID:2016
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7121.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7121.exe
    3⤵
    PID:3432
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56169.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56169.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4964
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22773.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22773.exe
    3⤵
    PID:4656
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20269.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20269.exe
    3⤵
    PID:1752
- C:\Users\Admin\AppData\Local\Temp\Unicorn-56707.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-56707.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2844
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7377.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7377.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26112.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26112.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36255.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:2312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35140.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29248.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49020.exe
        8⤵
        
        PID:1640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65363.exe
        8⤵
        
        PID:3140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23096.exe
        8⤵
        
        PID:4100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20298.exe
        8⤵
        
        PID:5100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49109.exe
        8⤵
        
        PID:4248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25869.exe
        8⤵
        
        PID:5328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14567.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40186.exe
        8⤵
        
        PID:2716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11516.exe
        8⤵
        
        PID:3540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35172.exe
        8⤵
        
        PID:4632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44195.exe
        8⤵
        
        PID:5904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38230.exe
        8⤵
        
        PID:6196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50833.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58640.exe
        8⤵
        
        PID:2916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61193.exe
        8⤵
        
        PID:3364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17958.exe
        8⤵
        
        PID:4664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44195.exe
        8⤵
        
        PID:5920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22003.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32748.exe
        7⤵
        
        PID:3112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20296.exe
        7⤵
        
        PID:3796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44599.exe
        7⤵
        
        PID:4764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49639.exe
        7⤵
        
        PID:4136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4383.exe
        7⤵
        
        PID:5388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7270.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20029.exe
        6⤵
        
        PID:288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15256.exe
        6⤵
        
        PID:3424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9971.exe
        6⤵
        
        PID:1416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44725.exe
        6⤵
        
        PID:6008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33765.exe
        6⤵
        
        PID:6168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37147.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29154.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47628.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39653.exe
        7⤵
        
        PID:6600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13561.exe
        6⤵
        
        PID:3124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31382.exe
        7⤵
        
        PID:3880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29306.exe
        7⤵
        
        PID:4668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52860.exe
        7⤵
        
        PID:5984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38539.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31117.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4595.exe
        6⤵
        
        PID:1792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28703.exe
        6⤵
        
        PID:5748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58506.exe
        6⤵
        
        PID:6904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13470.exe
        5⤵
        
        PID:2828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31382.exe
        6⤵
        
        PID:3848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-698.exe
        6⤵
        
        PID:5044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51909.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51070.exe
        6⤵
        
        PID:5312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35052.exe
        5⤵
        
        PID:3092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55101.exe
        5⤵
        
        PID:4532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28610.exe
        5⤵
        
        PID:4896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7356.exe
        5⤵
        
        PID:920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16197.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16197.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57013.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52849.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6937.exe
        7⤵
        
        PID:868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7438.exe
        8⤵
        
        PID:3400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55986.exe
        8⤵
        
        PID:5072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21830.exe
        8⤵
        
        PID:5624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64106.exe
        8⤵
        
        PID:6940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11516.exe
        7⤵
        
        PID:3568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14433.exe
        7⤵
        
        PID:3232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57774.exe
        7⤵
        
        PID:4328
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4328 -s 188
        8⤵
        Program crash
        
        PID:5160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64918.exe
        7⤵
        
        PID:6204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54913.exe
        6⤵
        
        PID:564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65283.exe
        6⤵
        
        PID:3288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26506.exe
        6⤵
        
        PID:4852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27659.exe
        6⤵
        
        PID:6100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43750.exe
        6⤵
        
        PID:6308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11686.exe
        5⤵
        Executes dropped EXE
        
        PID:376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29186.exe
        5⤵
        
        PID:2480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21660.exe
        5⤵
        
        PID:4476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48871.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17538.exe
        5⤵
        
        PID:5644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33311.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33311.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8822.exe
        5⤵
        
        PID:1048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15451.exe
        5⤵
        
        PID:2228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51789.exe
        5⤵
        
        PID:4216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17662.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62167.exe
        5⤵
        
        PID:5564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59640.exe
        5⤵
        
        PID:7032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57291.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57291.exe
      4⤵
      PID:2024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26535.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11516.exe
        5⤵
        
        PID:3784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17147.exe
        5⤵
        
        PID:4528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13165.exe
        5⤵
        
        PID:5588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15634.exe
        5⤵
        
        PID:7052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58995.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58995.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5916.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5916.exe
      4⤵
      PID:3700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50757.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50757.exe
      4⤵
      PID:4940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17859.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17859.exe
      4⤵
      PID:5964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32630.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32630.exe
      4⤵
      PID:5500
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19959.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19959.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43100.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43100.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22421.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19601.exe
        6⤵
        
        PID:1664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15451.exe
        6⤵
        
        PID:3084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57901.exe
        6⤵
        
        PID:4548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53811.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5423.exe
        6⤵
        
        PID:5180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4837.exe
        6⤵
        
        PID:6804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37690.exe
        5⤵
        
        PID:1888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29186.exe
        5⤵
        
        PID:2204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28962.exe
        5⤵
        
        PID:3324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61135.exe
        5⤵
        
        PID:4708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45204.exe
        5⤵
        
        PID:5688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55296.exe
        5⤵
        
        PID:6132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33473.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33473.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61972.exe
        5⤵
        
        PID:2140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2388.exe
        6⤵
        
        PID:2540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54929.exe
        7⤵
        
        PID:1872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36053.exe
        8⤵
        
        PID:4040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51378.exe
        8⤵
        
        PID:4308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51909.exe
        8⤵
        
        PID:4948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62374.exe
        8⤵
        
        PID:5860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11516.exe
        7⤵
        
        PID:3728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35172.exe
        7⤵
        
        PID:4676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44195.exe
        7⤵
        
        PID:5848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22003.exe
        7⤵
        
        PID:6120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57342.exe
        6⤵
        
        PID:2356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9391.exe
        6⤵
        
        PID:3968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4263.exe
        6⤵
        
        PID:4788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49946.exe
        6⤵
        
        PID:5976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22671.exe
        6⤵
        
        PID:6884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4949.exe
        5⤵
        
        PID:2448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31382.exe
        6⤵
        
        PID:3832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-698.exe
        6⤵
        
        PID:4996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51909.exe
        6⤵
        
        PID:4912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48932.exe
        6⤵
        
        PID:3196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25251.exe
        5⤵
        
        PID:3648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20298.exe
        5⤵
        
        PID:4172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65144.exe
        5⤵
        
        PID:5252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22003.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38821.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38821.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13327.exe
        5⤵
        
        PID:2000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22205.exe
        6⤵
        
        PID:2988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11516.exe
        6⤵
        
        PID:3560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14433.exe
        6⤵
        
        PID:4108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57774.exe
        6⤵
        
        PID:1128
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1128 -s 188
        7⤵
        Program crash
        
        PID:5164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51575.exe
        6⤵
        
        PID:6416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3081.exe
        5⤵
        
        PID:2996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55392.exe
        5⤵
        
        PID:3988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21130.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27659.exe
        5⤵
        
        PID:6072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42935.exe
        5⤵
        
        PID:5348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22741.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22741.exe
      4⤵
      PID:2684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11670.exe
        5⤵
        
        PID:3056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61193.exe
        5⤵
        
        PID:3920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35172.exe
        5⤵
        
        PID:4692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44195.exe
        5⤵
        
        PID:5912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3062.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3062.exe
      4⤵
      PID:2680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55593.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55593.exe
      4⤵
      PID:3440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-130.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-130.exe
      4⤵
      PID:4320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12877.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12877.exe
      4⤵
      PID:5840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-717.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-717.exe
      4⤵
      PID:6628
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14167.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14167.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47771.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47771.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44951.exe
        5⤵
        
        PID:2444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7513.exe
        6⤵
        
        PID:2564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8408.exe
        6⤵
        
        PID:3956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64895.exe
        6⤵
        
        PID:2992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4868.exe
        6⤵
        
        PID:5660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54766.exe
        6⤵
        
        PID:5456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57342.exe
        5⤵
        
        PID:2816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9391.exe
        5⤵
        
        PID:1968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4263.exe
        5⤵
        
        PID:4772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54060.exe
        5⤵
        
        PID:5788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38230.exe
        5⤵
        
        PID:6184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8090.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8090.exe
      4⤵
      PID:908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35317.exe
        5⤵
        
        PID:756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31382.exe
        6⤵
        
        PID:3840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-698.exe
        6⤵
        
        PID:5004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51909.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51070.exe
        6⤵
        
        PID:5300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25251.exe
        5⤵
        
        PID:3664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21130.exe
        5⤵
        
        PID:4344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27659.exe
        5⤵
        
        PID:6044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39069.exe
        5⤵
        
        PID:6124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7197.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7197.exe
      4⤵
      PID:1876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31117.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31117.exe
      4⤵
      PID:3672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61135.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61135.exe
      4⤵
      PID:4732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32573.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32573.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62308.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62308.exe
      4⤵
      PID:6504
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-65295.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-65295.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58132.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58132.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15451.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15451.exe
      4⤵
      PID:1484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31382.exe
        5⤵
        
        PID:3896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12093.exe
        5⤵
        
        PID:4644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35012.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15634.exe
        5⤵
        
        PID:7060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25251.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25251.exe
      4⤵
      PID:3632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46931.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46931.exe
      4⤵
      PID:4272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30219.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30219.exe
      4⤵
      PID:5756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22003.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22003.exe
      4⤵
      PID:532
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19051.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19051.exe
    3⤵
    PID:2036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55183.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55183.exe
      4⤵
      PID:1972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11516.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11516.exe
      4⤵
      PID:3736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15201.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15201.exe
      4⤵
      PID:4588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20327.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20327.exe
      4⤵
      PID:5532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38539.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38539.exe
      4⤵
      PID:5712
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17330.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17330.exe
    3⤵
    PID:1592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15349.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15349.exe
      4⤵
      PID:4636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13498.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13498.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57566.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57566.exe
      4⤵
      PID:6152
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22981.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22981.exe
    3⤵
    PID:3708
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56169.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56169.exe
    3⤵
    PID:4980
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38808.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38808.exe
    3⤵
    PID:5216
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12502.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12502.exe
    3⤵
    PID:6220
- C:\Users\Admin\AppData\Local\Temp\Unicorn-31999.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-31999.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2732
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57614.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57614.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45866.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45866.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39450.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57664.exe
        5⤵
        
        PID:2952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31382.exe
        6⤵
        
        PID:3812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-698.exe
        6⤵
        
        PID:4988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2407.exe
        6⤵
        
        PID:5272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26821.exe
        6⤵
        
        PID:6436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25251.exe
        5⤵
        
        PID:3776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55301.exe
        5⤵
        
        PID:4424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11662.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22003.exe
        5⤵
        
        PID:6140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53409.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53409.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38361.exe
        5⤵
        
        PID:1676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57539.exe
        6⤵
        
        PID:2524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11516.exe
        6⤵
        
        PID:3548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29796.exe
        6⤵
        
        PID:4288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44195.exe
        6⤵
        
        PID:5880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26174.exe
        6⤵
        
        PID:6236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45671.exe
        5⤵
        
        PID:748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31382.exe
        6⤵
        
        PID:3856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-698.exe
        6⤵
        
        PID:5020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51909.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47852.exe
        6⤵
        
        PID:6264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25251.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21130.exe
        5⤵
        
        PID:4504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27659.exe
        5⤵
        
        PID:6064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38052.exe
        5⤵
        
        PID:5488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22147.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22147.exe
      4⤵
      PID:272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35692.exe
        5⤵
        
        PID:1056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9391.exe
        5⤵
        
        PID:3200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4263.exe
        5⤵
        
        PID:4796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49946.exe
        5⤵
        
        PID:6036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21902.exe
        5⤵
        
        PID:6744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33123.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33123.exe
      4⤵
      PID:2008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58858.exe
        5⤵
        
        PID:2768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61193.exe
        5⤵
        
        PID:3260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63935.exe
        5⤵
        
        PID:4972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8272.exe
        5⤵
        
        PID:5280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40267.exe
        5⤵
        
        PID:5724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51604.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51604.exe
      4⤵
      PID:1444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24984.exe
        5⤵
        
        PID:3820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-698.exe
        5⤵
        
        PID:5012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51909.exe
        5⤵
        
        PID:4224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47852.exe
        5⤵
        
        PID:6260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5916.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5916.exe
      4⤵
      PID:3720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62625.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62625.exe
      4⤵
      PID:4604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40739.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40739.exe
      4⤵
      PID:5672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28430.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28430.exe
      4⤵
      PID:6208
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55985.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55985.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3044
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17610.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17610.exe
    3⤵
    PID:1500
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31117.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31117.exe
    3⤵
    PID:3608
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61135.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61135.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4740
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48608.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48608.exe
    3⤵
    PID:5232
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40797.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40797.exe
    3⤵
    PID:5844
- C:\Users\Admin\AppData\Local\Temp\Unicorn-57349.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-57349.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2052
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24211.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24211.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54717.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54717.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58214.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58214.exe
      4⤵
      PID:2476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9391.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9391.exe
      4⤵
      PID:3800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5223.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5223.exe
      4⤵
      PID:4612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61740.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61740.exe
      4⤵
      PID:5636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33351.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33351.exe
      4⤵
      PID:6716
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-835.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-835.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2832
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5644.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5644.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2608
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15256.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15256.exe
    3⤵
    PID:3216
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46636.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46636.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4472
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13695.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13695.exe
    3⤵
    PID:5612
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22266.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22266.exe
    3⤵
    PID:6976
- C:\Users\Admin\AppData\Local\Temp\Unicorn-37677.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-37677.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2080
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61484.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61484.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31382.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31382.exe
      4⤵
      PID:3872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-698.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-698.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51909.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51909.exe
      4⤵
      PID:4860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47852.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47852.exe
      4⤵
      PID:6180
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57664.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57664.exe
    3⤵
    PID:2628
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9391.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9391.exe
    3⤵
    PID:3332
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21130.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21130.exe
    3⤵
    PID:4280
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27659.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27659.exe
    3⤵
    PID:6056
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40797.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40797.exe
    3⤵
    PID:5820
- C:\Users\Admin\AppData\Local\Temp\Unicorn-3730.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-3730.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2320
- C:\Users\Admin\AppData\Local\Temp\Unicorn-3592.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-3592.exe
  2⤵
  PID:852
- C:\Users\Admin\AppData\Local\Temp\Unicorn-51127.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-51127.exe
  2⤵
  PID:3472
- C:\Users\Admin\AppData\Local\Temp\Unicorn-34799.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-34799.exe
  2⤵
  PID:4956
- C:\Users\Admin\AppData\Local\Temp\Unicorn-43008.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-43008.exe
  2⤵
  PID:5288
- C:\Users\Admin\AppData\Local\Temp\Unicorn-55932.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-55932.exe
  2⤵
  PID:5744

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-17330.exe

Filesize
468KB

MD5
1708297df7d0c8c5ccb6f48aaa8d7613

SHA1
9afbb7a23d2109edbd89735857ec687e251c4170

SHA256
88a31222e15c05aa28178c11e39cd5172ef970a208c7df5f4c5ba355e176b4a7

SHA512
8f4d85c4a3565856498e77d6890cda06b5173116662834ff3cb749c4187214759f74a3b67109919dfd65da4514d80b2f37ef086ca7bf6f1da31214b2a2b769dc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5460.exe

Filesize
468KB

MD5
94a396ac8799c2fd22803fea2cce15ba

SHA1
e9cc9e58cce6dbe9d44e007f0faf7e0140bd8175

SHA256
7637bb9c1f84a62029918574ce50d488d74cbe96b73e173fd8f184cf2d25a9d6

SHA512
d4f3c6edc5e3fa852b6ac14c2cbb7c92e86fb5940f846b5605e808e404a2d797e9abcb2e5f18388ea8283f55549bbc666127265379cbb5a4334c00df6ac65142

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-55986.exe

Filesize
468KB

MD5
815bfc0aaff83eb32e50fc19d512bf98

SHA1
2f909fe62916d4e6abf3fc1e24c4294495d56743

SHA256
845a7a30ec0913547c660eb6a4758ce3e884aee0602c266db5e6b62ab9e757ed

SHA512
b8dd16e166d021c6909574aaa24959f6c8a7e299492136056973783dabc0dfed480fb35bacb961100bd193935856d999444a61b401168ab2d7be3d128bfa10a8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-57614.exe

Filesize
468KB

MD5
4638f4547648844e688f60f978c94c95

SHA1
a667ace64dfc507a3d42318e0963898183b417f6

SHA256
e6dff2bc7f1f27df7a5c8eb161a0791928fa5887d3ef4e63e81b218d9f509a89

SHA512
0a8d98625fe2d8f6889ecbb6262a8cc3061ef7386fef8c84cc7cbbb8c6269c6f9230e60b40425537ca22da2767add121cab3b491e2f71c8d9b9525016b210d91

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-57901.exe

Filesize
468KB

MD5
81460467ff570ed3474967ab247b404d

SHA1
15f2d95f658705d66996bbc22558156fbed39468

SHA256
91d526ed3f203cda79c33aa03a3178257ec0b68615ac2cbcc5c6124857e57171

SHA512
f7a723984dce32306da204f28e0711d76bc3312f5b58bdea133a2a507a3ca31463d43fc66a63996ac2fc1673318b0d33e78768740cefe2cb469a7075f65ef08d

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-16197.exe

Filesize
468KB

MD5
711131eed770746f092bf2d66aa9c325

SHA1
8fb6642f787237bd6450948b1cf9a32905e398f3

SHA256
5747c5b1f6b20550ca04588fc958daf4745fa96b19cebfd6c1965f5bbb45dfbf

SHA512
5014afbb559a63501bb01655021c663ceeee41b3c174ac3890af812bed0dc3b081e0b1b1bfa37089557985015956f4c86db5fee674b2344833cb617a02b0ecd8

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-18264.exe

Filesize
468KB

MD5
d4e66032ac364df9ddf52e294bb42723

SHA1
ff0f79cc8b0f05101521d05b074510f4dbb73faa

SHA256
d499443ae66fd6d5b68ba5953bfe37811be73b504677e72f668b78b9232bc9f9

SHA512
a16673c9448c821be7acee93373b744f8f45bc1dad5f7eb034ce327bd53f57c5baf4f53bd5b39d9eec7cd624a420b8a96bd73282147fd083674d4d1ba15d7bf8

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-19959.exe

Filesize
468KB

MD5
d2ab9c9c776187a0eda8a099cf5e4bd0

SHA1
980159012fbb4bbeb991370f0cb0af6185a8cd0a

SHA256
5ce26c080f3d84487155307a3c279088714cc98dfbf6033e852c593848f22188

SHA512
d9a86bf32dc35b5966fd1154215e44f38c28c5b1f0d25d375feb49b1e4c6603d90bff66d6c3d4c28cef780860485349631b7ea182fcc423ef36686c49463a5a1

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-25326.exe

Filesize
468KB

MD5
5fcd85dc15e28f73e235ecb2a1d251ff

SHA1
33e1d313480854563f0ae14ce327dd423b409132

SHA256
ae1140ff47e7b7242ea7616ed2cff22e9310a8af9aa262254232d3ac5deb6507

SHA512
7a8ac1b6f72a2e5f0409b8424f1cd2c79a2487278c05cb92e7d8e38af2378ce7127c6a9b1166dd0f1c94a3db1a66995793973f32e329b01062ff860758bb05fa

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-26112.exe

Filesize
468KB

MD5
7ee22d0e55be4743e2d08697816edde8

SHA1
191431e2c71d5bf80a03b99122e37020edb9d524

SHA256
9243dc09ac1bb2b84412181668eea1cbd80c65000f4b85b7e7a6a68a80206bef

SHA512
4a885bc88ca731bc47c5afcabe5c3f37f3068eee91ea3744356ded694587fda38db9454ae1a22170900e561c4e963c7f8158e44666ff5fc1024d23dc08cfaac4

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-31966.exe

Filesize
468KB

MD5
9c195dda5f354651da68c340b1a5b1ac

SHA1
e9d10be75e42d385ee9f65eec37b6f699c42e9ec

SHA256
24f0909e3a1b52aff4b5bd449531910b384580258f48c38d8ba0e446a7853b80

SHA512
223f3b2614d7ba5039356a6624501dc8090a089a9a39c90d68df61ad4207f4172e5109ac5ddfad73f191e6b79ed4828486e70e1747ddfc936ca1874216c4bb10

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-31999.exe

Filesize
468KB

MD5
59961e4a92ab84afa95ed3ee7eaf25ca

SHA1
551c62a282d6582c537c27c96ef84ebc97f5f6b7

SHA256
9c1a9d32b0949fa83b838ff0a62eb37c593d57c2085a85bf792a08aae1624700

SHA512
82712be05c8f7c32dfede8840d28f6c5283495538ddb7cdac971dc738997ec689f8538c8cdc0eb245300a10decfafae16258a91f18022ab062d7d59bb1d23eb6

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-36255.exe

Filesize
468KB

MD5
03c1c54f9be14ea5cc9f26cd9802ee24

SHA1
8e6f62875af00ec218bada438379dd73e12b0252

SHA256
012b2e063f57810a5e1452a0e2ce514a8704b365fc1ac3ea1a05790ac122eaea

SHA512
a7b0d74377682fba94c43b59df130454bc1548caae836ce4f5bb59ee48427045fa96ff0235c0c248f668d9c93b42d65d5357ce09df9b8ab97e41216dd19decce

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-38130.exe

Filesize
468KB

MD5
b385a54a27d0ab32e57a7e736ceac832

SHA1
b013e090460f22a3239b19635cebee229e6f2937

SHA256
cd1fcc453890fde2986d61f4b54c81e4acf31068776a21ead49b79ceeb3643e0

SHA512
a891c78c14c49d70ed0e75f1d2ac53dbcc252cda813da25b3a0ad36a524f2f39e2cfa50def28abf8ea51941e70fe41b6915d66c40f13ace8a0780e2f43b3f060

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-40060.exe

Filesize
468KB

MD5
68c126e7984d1879cb465a445961b9cc

SHA1
41e9578f7f0d3ae8d06a7d6a8693e95cd31b30cf

SHA256
3cd7c6c610eeaa0cf81b98b0c240ba6c438666c149de0561b17057b93951eb3d

SHA512
7ce69f51e85deb4dc81427dd2c3bbb248df13e0d6a1c722e1670015d39f9096a9ff5f461818e6ef227bb428cbf437e5b86ea34d8c7cd3d5d3ff7e0d5fc1c541c

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-43100.exe

Filesize
468KB

MD5
9da37586df8b72a6654efdd334661348

SHA1
35819715c727d1011f10fb02a15a6dfd57558d88

SHA256
50630a6d512362e54d55ac191c47f0a0f2f5c52302673e25dc6ce9bda78274c8

SHA512
8e0c50d6172d5458236310768d5a37bf1e9a262c2182f5992c71ac2f2ff5bd9e73da631f24032ca4d8b20d6c611252c168f6247a95f1d264c292159f392e0e82

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-52174.exe

Filesize
468KB

MD5
a3ed65884be911e7bf4a213f6eac8d41

SHA1
27535edbad16c999a9c5ab0592c2511243bc52b9

SHA256
4bf9d4a8604dc1af140a88234f7623afb12299874e159779fd8977d001a3e1a4

SHA512
d3d57834c69ba50fefaa805f7466c93520a032fbf9af31e3303985b677ef3856916fcc5d799be709bc7589e6352a90b68ba3f4bd33df5dfefa7ebaf6e1bbc32c

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-56707.exe

Filesize
468KB

MD5
5ab19e1b8d4064ded82d27408283b0ba

SHA1
4600587ade2f125d5eccb49a06e82671703da7b9

SHA256
4399c8ce9a233af77d7c649c9f9b1d1d07e5bd4accce8ec03cdab4399443c74e

SHA512
28022341193466325b96710d9f73b7ba8a49feea194bebfdbddc937b7529f6dd6a97200cdf508c564c14554598e35b21e46aa2e95f31107ec8641bb65dc5a5ed

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-57349.exe

Filesize
468KB

MD5
10499f3cbd3d3da527e2c9d77e5d0a49

SHA1
22bca7da0bcf8512508edbb143b7b9eab95dd1ae

SHA256
c80a943fc02b606716ac4d35aab273ac44c50e896c743789366824a99c645af5

SHA512
db7293e1259ddf4795a0d93ac80a14db74054b3f910da1859ce217ae87e87d765a8c187ccbfc76c0a7773a09f3f2c948926eb4513110771356731b03af0def8d

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-7377.exe

Filesize
468KB

MD5
d5776490f7e2039f188bebf797a9f205

SHA1
89ba657e24da9a487c7a4aa118108ec2dc0c5850

SHA256
eece1c975df07ff6c2cddec525a7f639fb544b03b18b9e2c27e934355dbe7ed4

SHA512
0580142bc8430ff8faac37a933aac31ad81494e2020eab4838007d3550718e310d23b457cea9a8e334d3f5c3d5c68de1876cedb504cccc053c0c2ca978fd7ea4

Download Submit
memory/476-400-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/540-194-0x0000000000380000-0x00000000003F5000-memory.dmp

Filesize
468KB

Download
memory/540-378-0x0000000000380000-0x00000000003F5000-memory.dmp

Filesize
468KB

Download
memory/540-193-0x0000000000380000-0x00000000003F5000-memory.dmp

Filesize
468KB

Download
memory/816-162-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/816-259-0x0000000002690000-0x0000000002705000-memory.dmp

Filesize
468KB

Download
memory/816-255-0x0000000002690000-0x0000000002705000-memory.dmp

Filesize
468KB

Download
memory/940-282-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1552-319-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1632-236-0x0000000002880000-0x00000000028F5000-memory.dmp

Filesize
468KB

Download
memory/1632-247-0x0000000002880000-0x00000000028F5000-memory.dmp

Filesize
468KB

Download
memory/1632-172-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1704-291-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1732-260-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1748-122-0x0000000001E50000-0x0000000001EC5000-memory.dmp

Filesize
468KB

Download
memory/1748-303-0x0000000001E50000-0x0000000001EC5000-memory.dmp

Filesize
468KB

Download
memory/1748-141-0x0000000001E50000-0x0000000001EC5000-memory.dmp

Filesize
468KB

Download
memory/1748-78-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1748-294-0x0000000001E50000-0x0000000001EC5000-memory.dmp

Filesize
468KB

Download
memory/1992-158-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1992-256-0x00000000024D0000-0x0000000002545000-memory.dmp

Filesize
468KB

Download
memory/1992-261-0x00000000024D0000-0x0000000002545000-memory.dmp

Filesize
468KB

Download
memory/2028-254-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2052-302-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2052-318-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2052-132-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2080-329-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2084-249-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2128-411-0x00000000028F0000-0x0000000002965000-memory.dmp

Filesize
468KB

Download
memory/2128-231-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2188-290-0x0000000002870000-0x00000000028E5000-memory.dmp

Filesize
468KB

Download
memory/2188-289-0x0000000002870000-0x00000000028E5000-memory.dmp

Filesize
468KB

Download
memory/2192-327-0x0000000002490000-0x0000000002505000-memory.dmp

Filesize
468KB

Download
memory/2192-33-0x0000000002490000-0x0000000002505000-memory.dmp

Filesize
468KB

Download
memory/2192-6-0x0000000002490000-0x0000000002505000-memory.dmp

Filesize
468KB

Download
memory/2192-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2192-387-0x0000000002490000-0x0000000002505000-memory.dmp

Filesize
468KB

Download
memory/2192-328-0x0000000002490000-0x0000000002505000-memory.dmp

Filesize
468KB

Download
memory/2192-304-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2192-130-0x0000000002490000-0x0000000002505000-memory.dmp

Filesize
468KB

Download
memory/2312-352-0x0000000001E00000-0x0000000001E75000-memory.dmp

Filesize
468KB

Download
memory/2312-353-0x0000000001E00000-0x0000000001E75000-memory.dmp

Filesize
468KB

Download
memory/2312-196-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2316-207-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2316-376-0x0000000001CA0000-0x0000000001D15000-memory.dmp

Filesize
468KB

Download
memory/2316-377-0x0000000001CA0000-0x0000000001D15000-memory.dmp

Filesize
468KB

Download
memory/2332-316-0x0000000002890000-0x0000000002905000-memory.dmp

Filesize
468KB

Download
memory/2332-297-0x0000000002890000-0x0000000002905000-memory.dmp

Filesize
468KB

Download
memory/2440-272-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2492-152-0x0000000002550000-0x00000000025C5000-memory.dmp

Filesize
468KB

Download
memory/2492-64-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2492-150-0x0000000002550000-0x00000000025C5000-memory.dmp

Filesize
468KB

Download
memory/2492-273-0x0000000002550000-0x00000000025C5000-memory.dmp

Filesize
468KB

Download
memory/2492-277-0x0000000002550000-0x00000000025C5000-memory.dmp

Filesize
468KB

Download
memory/2512-384-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2544-305-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2572-379-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2596-206-0x0000000002800000-0x0000000002875000-memory.dmp

Filesize
468KB

Download
memory/2596-205-0x0000000002800000-0x0000000002875000-memory.dmp

Filesize
468KB

Download
memory/2596-49-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2596-373-0x0000000002800000-0x0000000002875000-memory.dmp

Filesize
468KB

Download
memory/2596-91-0x0000000002A00000-0x0000000002A75000-memory.dmp

Filesize
468KB

Download
memory/2596-374-0x0000000002800000-0x0000000002875000-memory.dmp

Filesize
468KB

Download
memory/2600-250-0x00000000025A0000-0x0000000002615000-memory.dmp

Filesize
468KB

Download
memory/2600-364-0x00000000025A0000-0x0000000002615000-memory.dmp

Filesize
468KB

Download
memory/2600-165-0x00000000025A0000-0x0000000002615000-memory.dmp

Filesize
468KB

Download
memory/2600-23-0x00000000025A0000-0x0000000002615000-memory.dmp

Filesize
468KB

Download
memory/2600-24-0x00000000025A0000-0x0000000002615000-memory.dmp

Filesize
468KB

Download
memory/2600-330-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2600-63-0x00000000025A0000-0x0000000002615000-memory.dmp

Filesize
468KB

Download
memory/2600-248-0x00000000025A0000-0x0000000002615000-memory.dmp

Filesize
468KB

Download
memory/2600-171-0x00000000025A0000-0x0000000002615000-memory.dmp

Filesize
468KB

Download
memory/2652-375-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2696-221-0x0000000000520000-0x0000000000595000-memory.dmp

Filesize
468KB

Download
memory/2696-215-0x0000000000520000-0x0000000000595000-memory.dmp

Filesize
468KB

Download
memory/2696-390-0x0000000000520000-0x0000000000595000-memory.dmp

Filesize
468KB

Download
memory/2696-395-0x0000000000520000-0x0000000000595000-memory.dmp

Filesize
468KB

Download
memory/2696-107-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2732-312-0x0000000002730000-0x00000000027A5000-memory.dmp

Filesize
468KB

Download
memory/2732-80-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2732-137-0x0000000002730000-0x00000000027A5000-memory.dmp

Filesize
468KB

Download
memory/2732-295-0x0000000002730000-0x00000000027A5000-memory.dmp

Filesize
468KB

Download
memory/2736-354-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2744-159-0x0000000002620000-0x0000000002695000-memory.dmp

Filesize
468KB

Download
memory/2744-271-0x0000000002620000-0x0000000002695000-memory.dmp

Filesize
468KB

Download
memory/2744-26-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2744-151-0x0000000002620000-0x0000000002695000-memory.dmp

Filesize
468KB

Download
memory/2744-383-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2744-270-0x0000000002620000-0x0000000002695000-memory.dmp

Filesize
468KB

Download
memory/2844-230-0x0000000001F70000-0x0000000001FE5000-memory.dmp

Filesize
468KB

Download
memory/2844-229-0x0000000001F70000-0x0000000001FE5000-memory.dmp

Filesize
468KB

Download
memory/2844-391-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2844-47-0x0000000001F70000-0x0000000001FE5000-memory.dmp

Filesize
468KB

Download
memory/2844-401-0x0000000001F70000-0x0000000001FE5000-memory.dmp

Filesize
468KB

Download
memory/2844-402-0x0000000001F70000-0x0000000001FE5000-memory.dmp

Filesize
468KB

Download
memory/3044-317-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download